Accepting online donations without putting your donors at risk

If your organisation takes donations through a website, you are asking people to enter payment details on the strength of your name. That creates two obligations. The obvious one is keeping the page and the account behind it secure. The less obvious one is that your name will be used by other people to collect money that never reaches you — and your donors will have very little to go on when it happens. This is a practical account of both, written from published guidance rather than any particular organisation’s experience.

Start with the account that controls the money

Before anything on the public-facing page, deal with the administrative accounts: the payment processor login, the website’s content management system, and the email address that can reset either of them. A donation page is only as secure as the weakest of those three.

Authentication is the thing to get right, and the ranking is published. CISA’s hierarchy runs from phishing-resistant MFA using FIDO/WebAuthn, through app-based codes or push with number matching, then push without number matching, down to SMS and voice — which CISA describes as vulnerable to phishing, SS7 and SIM swap attacks. NCSC’s finding is the same from the other direction: all traditional second factors are vulnerable to adversary-in-the-middle phishing, while no FIDO2 credential type is.

For a small organisation the practical instruction is: passkeys or security keys on the processor and the email account if they are offered; an authenticator app if not; SMS only where nothing else exists. CISA is clear that any MFA beats none, so an imperfect option today is better than a perfect one next quarter.

Who else holds the keys

• List every person with access to the payment processor and the site. Remove anyone who has left. This is the control most often skipped in volunteer-run organisations.
• Use individual accounts rather than one shared login. A shared password cannot be revoked from one person.
• Keep the recovery email and phone number on the processor account current, and know who controls them.
• Make sure at least two people can get in. A single point of access is its own kind of incident.

What the padlock on your donation page proves

Encryption on your site is necessary and it is not a trust signal you should teach your donors to rely on. The FBI’s PSA is unambiguous: do not trust a website just because it has a lock icon or https in the address bar. The FTC makes the same point about the consequence — data "may be encrypted on its way to the site, but it won’t be safe from scammers operating the site."

This matters for how you write your own donation appeals. "Look for the padlock" is advice that helps whoever is impersonating you, because their page has one too. The useful thing to teach donors is the exact domain your donations are collected on, written out in full, every time you ask.

Assume your name will be used to phish

A fundraising appeal is a message asking for money with urgency attached, which is also the shape of a phishing email. That is uncomfortable but it is the situation, and it means your communications should be designed to be verifiable.

• Send from one consistent domain and say so on your website. Donors can then check the sender against a fixed reference.
• Avoid shortened links in appeals. CISA lists untrusted shortened URLs among phishing indicators; using them trains donors to click things they cannot read.
• Never ask for card details by email or over the phone in an inbound call. Then say publicly that you never do this.
• Give donors a route to verify. The FBI’s advice is to look up another way to contact the organisation directly rather than using details in the message — make sure that route exists and is answered.

When a donor reports a fake page

1. Get the exact address they were sent to. Compare it against yours character by character — the FBI’s misspelling and wrong-domain check applies here.
2. Tell your donors directly, on your own channels, naming the real donation domain. Do not rely on the fraudulent page being taken down quickly.
3. Report the fraudulent site to the FBI’s IC3 and to the FTC at ReportFraud.ftc.gov.
4. If a donor believes they handed over card or bank details, point them to IdentityTheft.gov, which produces a personal recovery plan rather than just taking a complaint.
5. Notify your payment processor. They may have takedown routes you do not.

The limits of what a small organisation can carry

You cannot vet the whole internet for pages using your name, and you cannot make your donors immune to a convincing message. What you can do is remove the reasons a fake would be believable: one donation domain, stated everywhere; consistent messaging that never asks for details by email; strong authentication on the accounts that hold the money; and a fast, public correction when something is reported.

None of that requires a security budget. It requires deciding these things once and then being boringly consistent about them.

Sources: FBI IC3 — PSA I-061019 on the lock icon and HTTPS · FTC — Are public Wi-Fi networks safe? · CISA — Implementing phishing-resistant MFA (fact sheet) · NCSC UK — Traditional and FIDO2 credentials for personal use · FTC — IdentityTheft.gov

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from the FBI, the FTC, CISA and NCSC UK. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.