First published 7 August 2025 and updated 29 October 2026
Charities are facing growing threats as cybercrime continues to rise.
Our on-demand training: Cybersecurity for Small Charities covers the basics of staying safe online, but the digital landscape is evolving fast. That’s why our Development Team has pulled together a few extra, practical tips to help you protect your data, your people, and your mission. With limited resources and a reliance on volunteers, a little awareness can go a long way.
Why are charities more vulnerable?
- High staff turnover: Many charities rely on part-time or volunteer staff, often with limited training.
- Personal devices: Many charities use personal phones or laptops, Bring Your Own Device (BYOD), which may lack proper security.
- Smarter scams: Technological advances, especially with AI mean that phishing emails are harder to spot—making training essential.
- Social engineering: Scammers have been known to target and manipulate individuals online and via phone calls to disclose confidential information or perform actions detrimental to the charity’s interests. Individuals have been completely unaware they have been targeted or scammed until after the damage has been done. Training and awareness raising is vital to build confidence and resilience.
Phishing: one click can cost you
Phishing emails can look incredibly real. Clicking a single link could lead to:
- Data breaches
- Financial loss
- Reputational damage
In March 2025, the Charity Commission published a blog alerting charities to correspondence, including phishing emails being sent out claiming to be from the Charity Commission. The emails request action to be taken, such as removing a trustee or chief executive from their position, releasing funds as part of a grant or supplying documents such as a passport or utility bill. The emails may be signed as coming from ‘the Commission,’ Chief Executive Officer and/or its Directors. The blog post continues to provide practical top tips on how to tell if emails or correspondence is from The Charity Commission and also acknowledges, “that it’s not always easy to tell if correspondence is real or fake….”
What you can do
- Train your team, including volunteers. Include phishing awareness in all your onboarding. Monthly reminders help too.
- Email filters: Don’t move junk mail to your inbox—leave it in the junk mail folder.
- Report suspicious emails: Encourage staff and volunteers to flag anything odd to IT or colleagues. This could be with clear procedures in place for who to report and how, and what action and follow up action should be taken, and again by whom on these reports.
- Cyber insurance: Often requires that you do have basic protections are in place—so check any policy before your purchase.
Stay safe online
- Avoid public Wi-Fi: Free hotspots aren’t secure, they won’t have business grade protection and security in place. Use 4G/5G or a business-grade VPN. (Virtual Private Network. A service that creates a secure, encrypted connection over the internet.)
- Encrypt your connection: VPNs protect your data when working remotely.
- Multi-factor authentication (MFA): Helps protect your account by requiring an extra check, like a code sent to your phone. It’s one of the easiest and most effective ways to improve your online security.
Passwords & tools
- Don’t share passwords in chat apps like Teams: Use tools like TeamPassword.
- Use a password manager: Try Dashlane to create and store strong passwords. Avast also provides support with passwords and password managers. Other password managers are available.
Further links for free online resources:
-
- Tenable Nessus Vulnerability Scanner
- KnowBe4 Security Awareness Training
- Avast Antivirus
- Markel Insurance Company free cybersecurity template for small charities, community groups and social enterprises Markel also offer cybersecurity insurance for charities, click here for further information.
- Fraud and Cyber Protect Eastern Region webinars for charities. Recordings are also available.
Final Top Tip: Cybersecurity doesn’t have to be complicated. A few simple habits can make a big difference.
Do check out our on-demand training – Cybersecurity for Small Charities for a comprehensive introductory guide to ensure that you are protecting your charities or community groups’ online safety.
Any questions, do get in touch; we are here to help: info@supportcambridgeshire.org.uk