Series: Scams on Nonprofits

Internal AND External Fraud Risk for Nonprofits

Nonprofits face the unique threat of scams, fraud, or theft—whatever you wish to call it—from both internal and external sources. This has the potential to be even more costly than scams faced by solopreneurs and authors as discussed in the linked blog posts. 

PBMares notes a median reported loss in 2024 of $76,000-$85,000 - egad! Bear in mind, "nonprofit" covers a range of organizations from those small enough to not have any salaried staff to large hospital chains for where such large numbers may come from. 

Internal Fraud
Examples noted can occur in any size organization. The PBMares article and Church Mutual Insurance are resources for this information.

• Corruption: Outright theft. "Theft" can be anything from swiping office supplies to products that would otherwise be sold to customers for personal use or, more often, resale. It can also include pocketing cash at events from gift shop or raffle ticket sales. 
• Billing fraud: This can include billing for a more expensive item.
• Check or payment tampering: The PBMares article shares a story of someone opening a bank account with the same name of the employer at a different bank and simply diverting checks to the personal account.
• Skimming: This includes overcharging and pocketing the extra.  

Red Flags
These are things to pay attention to with staff and volunteers:

• Living beyond their means
• Financial difficulties
• Extremely close relationships with vendors
• Defensiveness
• Bullying
• Unwilling to share duties

Detection

• Whistleblowers: anonymous online forms, email, or message tip lines
• Fraud awareness training
• Regular internal audits
• Management reviews
• More than one person as a system of checks and balances

​External Fraud
In this digital era, outdated security mechanisms, AI helping scammers sound very convincing, and trusting volunteers open the door to risk for nonprofits. Lack of documented policies about fraud or theft responses and what/how to share information with external agencies increase nonprofit risk according to the same PBMares article.

According to Nonprofits Insurance Alliance, ​"losses tied to voluntary transfer of funds are not covered under standard insurance terms." There are a number of examples shared on the post from those impacted by scammers. Information from Intermixit and Church Mutual Insurance are included in this list of scams as well. 

Types of scams

• Cyberattacks: Cautiously review who messages are actually from, not just who they say they're from (bogus email addresses or phone numbers). Opening attachments from unknown or fake sources can lead to malware incidents or ransomware that install harmful software on your system to lock it from your use with the intent of stealing information or funds, insisting you pay a ransom to regain your access. Back up your data off-site, install antivirus and software to detect threats. Staff/volunteer training are useful.
• Phishing: Emails, texts, or messages on your website's contact form "that appear to be from partners, lawyers, banks, contractors, common software vendors, or other nonprofit organizations" per Nonprofits Insurance Alliance. Another form of phishing is "from" a respected leader in the organization; Intermixit calls this Business Email Compromise. 
• Vendor fraud: Be careful of fraudulent invoices. 
• Charity fraud: Impersonating your nonprofit and soliciting donations in your name. Regularly monitor the internet for the name of your organization, make sure your donation page is secure, and ensure donors/the public know how to safely donate to you. 
• Grant scams: Verify, verify, verify. Be cautious of unsolicited grant offers, especially if they insist on payment from you up front, and research the grant source. 
• Check scams: You receive a (fake) check as a donation or grant with a refund then requested where the nonprofit loses funds by promptly trying to respond without asking enough questions. 

How to Protect Your Nonprofit
Per The National Bank of Indianapolis and Nonprofits Insurance Alliance:

• Verify donors and vendors: Contact the donor or vendor directly and do some research on websites and social media. 
• Wait for clearance: Be patient - banks take time. Don't issue a refund (or spend the funds!) until the check has cleared. If someone is demanding immediate responses, especially if money is involved, let the situation sit overnight and alert others. 
• Educate your team: Train about signs to look for, ask others for validation, and two-factor authorization of processes are useful.
• Consult with your bank: Your bank may have training and tools for your team to spot and mitigate scams.

Your Turn
This concludes our series about scams facing solopreneurs, authors, and nonprofits. Any hard lessons you've learned or heard from others? Love to hear to keep each other aware!

Let's Chat or find me on LinkedIn or Substack to continue the conversation! 

---