More and more, individuals’ emails are the targets of spoofing, scams, attempted takeovers, and more.
Clergy and laity emails in the Virginia Conference are no strangers to these dangers, as such attempts are becoming much more commonplace and frequent.
The attempts in the past have been somewhat easier to spot, though more recent attempts can be more sophisticated and confusing.
The Virginia Conference was recently hit by a number of emails with hacking attempts by sending out party invitations to their sender list in hopes of recipients opening the email and clicking on the link.
Another attempt was made by sending email address links from “DocuSign.”
In August, the New England Conference had $1.6 million stolen through a sophisticated cybersecurity incident. The Virginia Conference takes our own security very seriously and it is the role of the conference, districts, local churches, pastors and members to all play a part in being careful with how we use our email and react to links and phishing attempts.
For both pastors and laity alike, it is important to be aware of these scams and to become more alert and well-versed in how these attempts show up in your inbox.
Red flags:
● The sender name and email address do not match.
● Strange word choices or phrasing and misspellings
● Emails causing you to panic or create a sense of urgency
Safe practices for all:
● Slow down. Allow yourself time to think before clicking on an email.
● It is more important than ever to verify the source of an email before clicking on an email or clicking on a link within an email.
● Pay Attention to Language/Trends: Even if you recognize the name of the sender on the email, pay attention to the Subject line and any part of the email you can see in the email preview before clicking on it. If the subject or tone of the email sounds out of character, use other means to contact the sender to verify its veracity by calling them or by using a new email chain to the sender you know to verify.
● Ignore spam emails entirely. Don’t click on the email and just report as Spam.
● Enable Two-Factor Authentication (2FA), especially if you are using email on your cell phone.
⚬ For VAUMC.org or Google emails: Two-Factor Authentication (2FA) is an extra layer of security for your vaumc.org. It requires users to enter in a code sent to them via text message (or the Google Authenticator) any time they attempt to login to your vaumc.org account from a new device. This prevents a large number of hacking/takeover attempts, as the bad actor must also have possession of your phone to bypass this security. Learn more: https://support.google.com/accounts/answer/185839
Good practices for leaders:
● Regularly remind your church members about gift card scams and common ways that the church leadership will reach out for monetary assistance
● If such an attempt is made, be sure to make your congregation aware so more don’t fall victim to the scam
If you do click on a malicious link and your email is compromised, do the following:
● If you still have access to your email, change your password and turn on Two-Factor Authentication if you can. If you are logged on to your VAUMC email account, you can also use this link (https://myaccount.google.com/device-activity) to see which devices have logged into your account. Click on each device and sign them all out. This will ensure that any device wishing to access your account needs to sign in with the new password.
● If you use the same password for other online accounts (banking, e-commerce, etc.), change the password for these as well.
● If you clicked on the link while using a PC, use your Anti-Virus/Anti-Malware software to scan your system for any problems.
● CodeBlue is our IT Services Provider and they manage our VAUMC.org email domain. If you have any further questions or concerns, please reach out to them CodeBlue team at 804-456-4500 or email them at service@codebluetechnology.com.