What happened
In 2025, a church in Troup County, Georgia, lost $60,000 to an email scheme, according to the Troup County Sheriff’s Office. Lt. Stewart Smith told FOX 5 Atlanta that the scammers manipulated emails and accounts tied to an organization the church already had a relationship with. Church leaders believed they were sending money to that organization. Instead, investigators say, it went into accounts the scammers had set up, and the cash was pulled out at ATMs.
Deputies arrested one man within a couple of months of the theft. In early October 2026, they took a second man into custody at Newark International Airport after he arrived on a flight from Ghana and brought him back to Georgia, FOX 5 reported. 11Alive reported that a Virginia man accused in the scam had been brought to Troup County to face charges. The sheriff’s office says the men face charges including identity fraud, money laundering, theft by taking and deceptive commercial email. The charges are allegations.
The sheriff’s office has not named the church. Investigators said arrests in international cyber schemes like this are rare and that recovering the money is unlikely.
What safety teams can take from it
- This is a safety issue, not just a finance issue. Business email compromise is one of the most expensive threats churches face. Your treasurer and office staff are part of the safety team here.
- Call to confirm any change in payment details. If a vendor or partner sends new bank information, call them on a phone number you already have on file, never the one in the email.
- Require two people for every wire or ACH payment. One person sets up the payment and another approves it after checking where it’s going. Slow down anything marked “urgent.”
- Look closely at the sender address. Scammers use addresses that are one letter off, or take over a real account. Turn on two-factor authentication for every church email and banking login.
- If money goes out, call the bank right away. Funds can sometimes be frozen in the first day or two. Then report it to local police and the FBI’s IC3 at ic3.gov.