Church Impersonation Scams: How the Fake Pastor Gift Card Text Works and How to Stop It

If members are getting texts from "Pastor" asking for gift cards, you are dealing with a church impersonation scam: someone has paired your leaders' names with your members' phone numbers and is using your pastor's authority as the pressure. Usually nobody hacked your database. You stop it by warning members from your real channel within the hour, publishing a standing rule that staff will never privately ask anyone for gift cards or money, and removing the public pairing of names and contact details these scams feed on.

Move fast. By the time the first member forwards you a screenshot, assume the same text has reached others on your list, and every hour gives another kind person time to reply.

What a church impersonation scam actually is

It is fraud by borrowed trust. The attacker poses as someone your members already listen to, usually the senior pastor, and needs no technical skill to do it. By text, it is called smishing.

The sender is faked, or spoofed. In email that usually means the display name reads "Pastor Dave Miller" while the address behind it is a random Gmail account, which many phone mail apps hide until you tap. Texts can come from a new number or look like the pastor's real one: a 2024 alert from the Knox County, Tennessee, Sheriff's Office warned that scammers were spoofing actual pastors' phone numbers.

How the attack runs, step by step

1. Harvest. Your staff page lists names and titles, your bulletin PDF lists a cell number, and your public Facebook group lists members. A 2019 consumer alert from the Texas Attorney General's office said scammers appeared to be pulling details from church websites and online bulletins.

2. Pretext. The first text is deliberately boring. "Hi, are you available? I need a favor but I'm going into a meeting." No links, no ask. It is a filter for who replies.

3. Escalation. Once someone replies, a charitable story arrives: a family in need, someone in the hospital. The Texas alert describes the shape. The cards are for a good cause, the "pastor" cannot pick them up in person, and the member will be paid back. The ask is gift cards from brands like Apple, Google Play, Amazon or Target (all named in the FTC's gift card scam guidance), with the number and PIN from the back of each card sent in reply.

4. Cash-out. The card number and PIN are all a scammer needs to spend the balance. The money may be gone before anyone calls the church, and any recovery depends on the card issuer.

The email version targets your finance team instead: a fake invoice, a "new" vendor bank account, or an urgent wire request signed with the senior pastor's name. Same playbook, bigger dollar amounts. A third variant skips people entirely and copies your giving page onto a domain one character off from yours.

What to do in the first hour

The reporting routes below are US-specific. Outside the US, use your national fraud reporting service.

• Warn everyone from your real channel, whatever your members actually read. If your ChMS can already send a mass text to your whole congregation, use it. Quote the scam's actual wording and state plainly that staff will never privately ask anyone for gift cards. People recognize the exact sentence. Vague warnings slide past.
• Tell members not to reply or click. Screenshot, block, delete. Caller ID and sender names can be faked, so anyone unsure should call the church office on a number they already have. The FCC's robotext scam alert says not to respond even when a message offers "text STOP," and to forward unwanted texts to 7726 (SPAM). The FTC's spam text guidance adds the report-junk option inside the messaging app.
• Report the impersonating account through the platform's impostor report. Takedowns can take days. Do it anyway, because it builds the paper trail.
• Help anyone who already sent cards. They should contact the card issuer right away, keep the card and the store receipt, and ask for the money back. Refunds are not guaranteed, but the FTC says to ask. Then report it at ReportFraud.ftc.gov.
• If church money went out by wire or ACH, call your bank first and ask for a recall or reversal, as the FBI's IC3 guidance on business email compromise advises. Then file a complaint at ic3.gov with the banking details.
• Do not let the pastor text the scammer back. The same FCC alert notes that some scammers only want to confirm a number is active for use in future scams. Any reply confirms it.
• Log which members were contacted. That list is your leak map. If everyone on it is in your public Facebook group, start there.

If it repeats under a different name, such as a worship leader or a board chair, warn people again. Do not apologize for over-communicating.

A warning text you can send word for word

Keep it short enough to read on a lock screen. Send it by text, email and social at the same time, so members find the warning wherever they saw the scam.

[Church name] alert: some of you have received a text from someone pretending to be Pastor [Name]. It starts "[first line of the scam text]." That is not Pastor [Name], even if it shows their real number. No one on staff will ever privately text, email or message you to buy gift cards, send money to a person, or give anywhere except [official giving URL]. Please don't reply. Block the number and delete the message. If you already sent cards, call the card company right away, then let the church office know at [office number from your website].

How to make your church a harder target

Publish a "we will never" rule on your giving page, in your newsletter and in new member onboarding:

No one on staff at [Church name] will ever privately text, email or message you to buy gift cards, send money to a person, or give anywhere except [official giving URL].

Keep it that narrow so your own year-end giving email and camp-fee reminders do not break it. A rule the church breaks every December teaches members it is not real. Repeat it quarterly.

Publish one official giving URL. Put it everywhere and say plainly that you will never send members a different giving link. A lookalike page works best on a congregation that has seen three giving links and cannot tell which one is real.

Stop publishing name plus contact pairs. Use role aliases and web forms instead of personal cell numbers on public pages. Attackers need both halves, and you control one of them.

Require two people for any money movement. Every vendor bank change and every wire gets confirmed by phone on a number you already had, not the number in the email. IC3 recommends this kind of second-channel check for account changes. No exceptions for urgency. Urgency is the attack.

Lock down directory exports. Control who can export member contact lists, and keep a record of when exports happen. Then ask who has a copy of the member list on a laptop. If nobody can answer, that is the real exposure, and what church member data privacy actually requires covers it in more depth.

Turn on SPF, DKIM and DMARC for your church domain. These DNS records let receiving mail servers check whether a message claiming to come from your domain really did. Your email host's admin help covers setup. Start DMARC at p=none, which asks receivers to take no action and just sends you reports, so it blocks nothing yet. Use those reports to confirm that every tool sending mail as your domain (your ChMS, newsletter tool, giving platform) passes SPF or DKIM, or real church mail will start landing in spam later. Then move to p=quarantine or p=reject, which tells receivers to filter or refuse mail spoofing your exact domain. Even then, as the current DMARC standard itself says, it does nothing about lookalike domains or a Gmail account with your pastor's name as the display name. It closes one door. The "we will never" rule and your one official giving URL cover the doors it leaves open.

Use one recognizable sender. Scams work when members cannot tell what a real message from your church looks like. If announcements arrive from five different tools and three volunteer phones, a sixth sender raises no alarms. One consistent, properly registered number for church-wide messages works as a security control, and the primer on opt-in consent and 10DLC registration explains the registration side. Group leaders can keep texting their own groups. Anything church-wide or about money comes from the one sender members know.

Where to start

Write the "we will never" sentence today and put it in this week's announcements, next to your one official giving URL. Save the warning text with your church name and office number already filled in, so the next incident takes five minutes. Then count two things: how many places your member contact data lives, and how many different senders your congregation hears from in a normal month. Both numbers should go down this quarter, and a one-page church communication plan is the simplest way to cut the second.

If you are weighing new software that touches member records, ask the vendor what you just asked your own team: who sees member data, and where does it go? ChurchAI will not stop a scam text, and nothing on this list depends on it, but its security page answers both plainly: it works from a copy of your ChMS records, does not sell member data or share it between churches, and your team decides who on staff sees what.