"I have a confidential request": the fake pastor scam is still working

What happened

Not every threat to a congregation comes through the front door. Throughout 2026, churches and dioceses kept issuing the same warning: scammers are posing as pastors.

In February, St. Stephen’s United Methodist Church in Fairfax, Virginia, warned members that emails were impersonating its pastors and staff and asking for the church directory and other sensitive information. In May, the Gulf Atlantic Diocese described messages that seemed to come from a rector or the bishop. The sender says they’re stuck in a meeting and can’t talk, asks for an urgent “favor,” and then asks for gift card numbers and PINs, “to help someone less fortunate.”

In September, Australia’s ABC reported that a Sydney church volunteer received an email that seemed to be from her minister, announcing a new email address. The IT head for Sydney Anglican Services described how it works. Scammers use leaders’ names, which are easy to find online, to get the church directory. Then they email members pretending to be the rector and ask them to buy gift cards for “a vulnerable member of the congregation.” Australia’s National Anti-Scam Centre said the scheme had been hitting churches in every state since 2021.

What safety teams can take from it

• Protect your directory. The scam depends on getting your member list. Never send it in response to an email request. Use a church management system with logins instead of PDFs sent by email.
• Announce the rules ahead of time. Tell your congregation, more than once: “Our pastors will never ask you for gift cards, money or personal information by email or text.” Put that statement on your website and in the bulletin.
• Verify on a second channel. Any unusual request from a leader gets checked by calling a number you already have, not one in the message.
• Watch for look-alike addresses. A pastor’s name with a Gmail address, or a domain one letter off, is a red flag. Set up email authentication (SPF, DKIM and DMARC) on your church’s domain so spoofed messages are easier to catch.
• Report and record it. Ask members to forward suspicious messages to the church office so you can warn everyone. Report losses to the FTC (reportfraud.ftc.gov) or the FBI’s IC3.