Nonprofit cybersecurity before giving season: Protect donor data and online gifts

Giving season brings more donations, new supporters, and increased activity across your nonprofit’s fundraising tools. But it also creates more opportunities for cybercriminals to target donation pages, donor information, and financial accounts.

The risks are serious. In 2025, the FBI received 1,008,597 internet crime complaints, with reported losses of nearly $20.9 billion. Phishing and spoofing were among the most common threats, while business email compromise alone accounted for approximately $3 billion in reported losses.

Donors are concerned, too. A 2025 BBB Give.org survey found that 68.8% of respondents worried about their information being hacked or stolen when considering a donation to a charity they had not previously supported.

With Giving Tuesday and year-end fundraising approaching, cybersecurity deserves a place on every nonprofit’s campaign checklist.

The good news is that protecting donor data does not always require expensive software or a dedicated IT department. Many of the most useful safeguards involve existing accounts, payment settings, staff permissions, and simple security habits.

Why is cybersecurity important for nonprofits during giving season?

Nonprofit cybersecurity protects donor information, online payments, fundraising systems, and the trust supporters place in your organization. Strong security practices also help prevent interruptions that could affect donations during busy campaigns.

A cyberattack can have consequences beyond stolen information.

For example, a compromised fundraising account could give someone access to donor records. A fake donation page could redirect contributions to scammers. A ransomware attack could prevent staff from accessing campaign files or processing gifts.

These incidents can also affect future giving.

79.8% of surveyed respondents said they would stop donating or delay future gifts if a charity they supported suffered a hack involving stolen donor data.

Nonprofits cannot eliminate every security risk. They can, however, make their fundraising systems harder to compromise and prepare their teams to respond when something goes wrong.

What donor information should nonprofits protect?

Donor data includes personal details, giving records, and other sensitive information collected throughout the fundraising process.

The most common categories include:

• Personal information: Names, email addresses, phone numbers, and mailing addresses.
• Donation records: Giving amounts, contribution dates, recurring donation preferences, and transaction histories.
• Financial information: Bank details, payment records, and payment-related identifiers.
• Account information: Passwords, login credentials, and access permissions.
• Sensitive donor records: Personal circumstances, beneficiary information, and confidential notes collected for legitimate purposes.

Not all nonprofit systems hold the same types of information.

For example, a donor database may contain contact details and giving histories, while a third-party payment processor handles card numbers.

Your nonprofit should know exactly which systems collect, process, store, or share donor information.

The Federal Trade Commission recommends keeping only the sensitive information an organization needs and protecting it throughout its use.

Practical step: Review your donation forms and donor database. Remove unnecessary information fields and restrict access to sensitive records.

What are the biggest cybersecurity threats to online fundraising?

Most nonprofits need to prepare for five common fundraising security risks.

1. Phishing and fake fundraising emails

Phishing involves fraudulent emails, texts, or messages designed to trick someone into revealing information or opening a harmful link.

During giving season, an employee might receive a message that appears to come from a payment provider, fundraising director, or major donor.

The message may ask them to confirm login details, review an unfamiliar attachment, or update financial information.

The FBI recorded 191,561 phishing and spoofing complaints in 2025.

How to reduce the risk: Train staff to verify unexpected requests through a separate, trusted communication channel. Never share passwords or authentication codes through email.

2. Fake donation pages and charity impersonation

Scammers sometimes create fundraising pages that copy a nonprofit's name, logo, or campaign message.

They may distribute these links through social media, email, or text messages.

The FTC warned donors in November 2025 to check the identity of charities and verify donation links before contributing.

How to reduce the risk: Publish one official donation destination on your website. Link to it consistently across fundraising emails, social media, and campaign materials.

3. Donation card-testing fraud

Card testing occurs when criminals use stolen payment card details to attempt small online transactions.

Donation pages can attract this activity because they often accept small contributions.

Stripe's June 2026 guidance specifically identifies charitable donation pages as possible card-testing targets.

Signs may include repeated declined transactions, unusual groups of small donations, and multiple payment attempts within a short period.

How to reduce the risk: Use a payment provider with fraud detection and bot protection. Ask about transaction monitoring, card verification, and alerts for suspicious payment activity.

4. Donor database and account takeovers

A stolen password can allow someone to enter a fundraising account or donor management system. Attackers may download donor lists, view confidential records, or change account settings.

Access risks also increase when former volunteers or temporary workers retain permissions after their work ends.

How to reduce the risk: Use multifactor authentication, separate user accounts, and limited access permissions. Remove accounts that are no longer needed.

5. Website attacks and ransomware

Outdated website software and compromised devices may expose donor records or disrupt fundraising operations.

The 2026 Verizon Data Breach Investigations Report found that 31% of analyzed breaches began with the exploitation of software vulnerabilities. Ransomware was involved in 48% of breaches.

These findings cover organizations across industries, not only nonprofits.

How to reduce the risk: Install security updates, remove unused software, maintain protected backups, and test your ability to restore important records.

How can nonprofits protect donor data and online donations?

The most practical approach is to review the complete donation process, from the first fundraising email to the final payment receipt.

1. Secure fundraising accounts with multifactor authentication

Multifactor authentication (MFA) requires another form of verification beyond a password.

Start with the accounts that could expose donor information or affect fundraising revenue.

These include:

• Donation and payment platforms.
• Donor management software.
• Staff email accounts.
• Website administrator accounts.
• Banking and accounting tools.
• Social media and email marketing accounts.

Use unique passwords and a password manager. Choose phishing-resistant authentication methods, such as passkeys or security keys, when supported.

CISA recommends MFA, strong passwords, phishing awareness, and software updates as basic online security practices.

Before giving season: Have every authorized fundraising team member verify that MFA is active on their important accounts.

2. Choose secure, PCI-compliant payment processing

A secure online donation platform can reduce the amount of sensitive payment information your nonprofit handles.

When evaluating a fundraising provider, ask about:

• PCI DSS compliance and payment processing.
• Encryption and secure payment collection.
• Fraud detection and transaction monitoring.
• Data access and privacy controls.
• Payment dispute and refund procedures.
• Support during suspicious transactions or security incidents.

PCI DSS is a set of payment security standards designed to protect cardholder information.

Using a PCI-compliant processor can reduce your organization's compliance workload. However, it does not automatically remove every responsibility.

The PCI Security Standards Council confirms that some website security requirements can still apply to merchants using outsourced payment pages. Your requirements depend on your payment setup.

Before giving season: Confirm your provider's current PCI compliance status and ask which security responsibilities remain with your nonprofit.

3. Test your donation page from start to finish

A donation page may appear normal even when links, checkout settings, or payment details contain errors. Test the complete donor experience before launching your campaign.

Start with your website and follow the same steps a supporter would take.

Check that:

• The donation link opens the correct fundraising page.
• The web address is accurate and uses HTTPS.
• The form works on desktop and mobile devices.
• One-time and recurring donation options work correctly.
• The donation amount and any fees are clearly displayed.
• The donor receives a confirmation and receipt.
• The transaction appears in your fundraising records.
• The payout account belongs to your organization.

Use an approved test mode or a small authorized transaction.

Remember that HTTPS protects information in transit, but it does not prove a website is legitimate. The FTC warns that scammers can also use encrypted websites.

Before giving season: Ask someone unfamiliar with the campaign setup to complete a donation test and report any problems.

4. Review everyone who can access donor data

Fundraising campaigns often involve staff, board members, volunteers, and outside service providers. Each additional account creates another point of access.

Review your current user list and determine what each person actually needs.

For example, a volunteer promoting a campaign may not need access to individual donation histories. An event coordinator may need ticketing tools but not permission to change payment settings.

Avoid shared administrator accounts and remove access promptly when someone leaves.

Also review connections between your donor database, email platform, payment system, and accounting software.

Before giving season: Check administrator permissions, inactive accounts, and third-party integrations. Remove anything unnecessary.

5. Protect fundraising emails and official donation links

Your fundraising emails should help donors recognize legitimate messages from your nonprofit.

Use your official domain, consistent branding, and approved donation links. Ask your email provider to check three important authentication tools:

• SPF: Identifies authorized email servers for your domain.
• DKIM: Helps verify that an email has not been altered during delivery.
• DMARC: Gives receiving email systems instructions for handling messages that fail authentication checks.

These measures can reduce email impersonation risks when correctly configured.

Review any QR codes printed on fundraising materials, too. They should lead to the same verified donation destination.

Before giving season: Send test appeals, inspect the sender addresses, and open every fundraising link.

6. Review donation fraud and refund settings

Fraud prevention deserves special attention during high-volume campaigns.

Ask your payment provider which safeguards are available for card testing and suspicious transactions.

Possible controls include:

• Automated fraud screening.
• Bot detection or CAPTCHA protection.
• Alerts for repeated payment failures.
• Card verification checks.
• Risk-based transaction review.
• Refund and dispute monitoring.

Do not automatically reject every small donation. Legitimate supporters may prefer giving modest amounts.

Instead, work with your payment provider to identify unusual transaction patterns.

If someone asks for a refund to a different bank account or card, follow the provider's approved refund process. Do not send money separately based on an unexpected request.

Before giving season: Identify the person responsible for reviewing suspicious transactions and reporting problems to your provider.

7. Secure financial accounts and payout changes

Someone who gains access to financial settings may try to redirect fundraising proceeds. It can happen through account takeovers or fraudulent messages requesting new bank information.

Require independent verification before changing payout instructions.

Use a previously confirmed phone number to check unusual requests. Consider requiring a second authorized person to approve important financial changes.

Activate available account-change alerts and review payout details before major appeals begin.

Before giving season: Confirm your payout account and document how financial changes must be approved.

8. Update your systems and protect backups

Security updates fix software problems that attackers may exploit.

Ask your IT provider or website administrator to review:

• Website software, themes, and plugins.
• Staff devices and operating systems.
• Donor management applications.
• Security settings and backups.
• Unused applications and integrations.

Keep backups protected from unauthorized changes and ransomware. Follow a regular schedule and test that important information can be restored.

Before giving season: Confirm that critical updates are complete and a recent backup is recoverable.

Nonprofit cybersecurity checklist before Giving Tuesday 2026

Giving Tuesday falls on December 1, 2026. Use this schedule to complete security checks before the busiest fundraising days.

Three to four weeks before giving season

• Review donor information collected and stored.
• Enable MFA for important staff accounts.
• Remove inactive users and old integrations.
• Confirm payment processing security requirements.
• Update website software and verify backups.
• Assign responsibility for cybersecurity questions.

One week before campaign launch

• Test online donation forms and receipts.
• Verify official fundraising links and QR codes.
• Review payment fraud detection settings.
• Confirm banking and payout details.
• Test fundraising emails and sender authentication.
• Brief volunteers on phishing and fake messages.

During Giving Tuesday and year-end campaigns

• Review unusual transaction activity daily.
• Monitor account and security alerts.
• Investigate unexpected payment failures.
• Check donation pages after major website changes.
• Keep security and payment support contacts accessible.

If your team is small, assign these responsibilities to existing staff rather than creating new positions. The important part is knowing who will act when something needs attention.

What should nonprofits do after a cybersecurity incident?

If your nonprofit discovers suspicious activity, take action immediately.

A written response plan helps reduce confusion and limits delays in addressing the problem.

The FTC's Data Breach Response Guide provides guidance on containing incidents, investigating affected systems, and meeting notification obligations.

Follow these steps:

Step 1: Contain the incident. Contact your IT or security provider. Secure affected accounts, revoke suspicious access, and preserve evidence. Avoid deleting logs or shutting down affected equipment without technical guidance.

Step 2: Contact the appropriate providers. If online payments or bank details may be involved, notify your payment provider and financial institution.

Step 3: Determine what information was affected. Review available records and work with qualified specialists to identify the scope of the incident.

Step 4: Review legal reporting obligations. Data breach notification requirements vary by state and by the type of information involved. Consult legal counsel about the rules that apply.

Step 5: Communicate with affected donors. Provide accurate information about the incident, the potential risks, and the steps donors can take. Give supporters a reliable way to contact your organization.

Step 6: Address the cause. Correct identified weaknesses, update affected credentials, review access permissions, and document lessons learned.

Internet-related crimes can be reported to the FBI's Internet Crime Complaint Center.

Keep an emergency contact list somewhere your authorized team can reach it even if organizational email becomes unavailable.

How can nonprofits help donors feel safe giving online?

Cybersecurity works best when technical protection is supported by clear communication.

Donors should be able to find your official donation page, understand how their information is used, and contact your organization if something seems suspicious.

A few simple practices can help:

• Publish a clear privacy policy that explains data collection, use, sharing, and retention.
• Direct supporters to the donation page linked from your official website.
• Provide accurate contact information.
• Send donation receipts promptly.
• Give donors an easy way to report suspicious fundraising messages.
• Explain that your organization will never request passwords or authentication codes through email.

Avoid vague promises that donations are completely risk-free. Instead, explain the steps your nonprofit takes to protect information and handle payments responsibly.

Transparency helps supporters understand what to expect when they give.

Protect donor information and simplify online giving with BetterWorld

Your nonprofit already has enough to manage during giving season. Fundraising technology should make collecting donations and supporting donors simpler.

BetterWorld brings donations, recurring giving, peer-to-peer campaigns, events, auctions, and other fundraising tools into one platform.

BetterWorld uses PCI-compliant payment infrastructure through Stripe to process donations. Our fundraising pages use encryption and data protection practices designed to safeguard donor information.

You can learn more on BetterWorld's Security and Compliance page.

The platform also provides donation receipts and fundraising management tools to help your team stay organized.

BetterWorld's Free plan has a 0% platform fee, with standard payment processing fees applying.

Ready to prepare for giving season?

Get started with BetterWorld and give your supporters a simple, secure way to contribute to your mission.