Keeping Safe from Text and Email Scams

If you receive a text message email that appears to be from a member of the Heavenly Rest clergy or staff, asking you to take some kind of unusual action – click a link or download an attachment you didn’t request, wire money to a specified account, purchase gift cards and reply with the serial numbers, or simply to reply quickly, watch out – it could be a form of email “phishing” known as “whaling.”

“Whaling” involves forging communications that look like they’re from the “big fish” in an organization, i.e. the “whale.” For us, this usually means the Rector or a clergy person, although it could be someone else in authority.

The message will give some explanation of why the leader needs your help immediately. They may include some story about another person in dire circumstances whom the priest or staff member is trying to help. But instead of helping a needy person, if you respond you will actually be turning over money and possibly your identity information to a scammer. 

Because these emails or text messages are usually crafted more carefully than your standard “phishing” email or text, they can be more difficult to detect.

Recently, several Heavenly Rest parishioners and staff have received texts emails claiming to be from Father David. Sometimes, the clergy and other members have received them as well. Previously, we have seen similar emails go out to our community.

Unfortunately, it’s difficult to stop these “whaling” attacks. The email accounts in question have not been hacked. Instead, they are being “spoofed” – that is, a fraudulent email account is cleverly configured to look at first glance like a legitimate one. Even if you block the fraudulent email, they’ll just use another. Same thing with text messages from fraudulent phone numbers. It’s like playing “whack-a-mole.”

You can’t stop the senders of “whaling” emails, but what you can do – which is entirely free – is educate yourself and other potential recipients. Here are two simple guidelines to help potential recipients avoid being tricked:

Verify the “from” email

The malicious actors behind “whaling” attacks are counting on people springing into action as soon as they see an important name on an email or in a text. You can outsmart them by looking beyond the name and checking the “from” email address to see if it matches what you know the alleged sender’s email to be or seeing if you recognize the phone number. 

If you only see a name, you can cause the “from” email address to be displayed by hovering the cursor over the name. If you don’t recognize the number, call the parish office directly.

If you get a text message, don’t trust the Caller ID name/number as these can be faked. If you get spam text and you have the person’s number, you can call that person directly or start a new text chain. Do not reply to the original text message.

Confirm requests with a conversation

Even if the email or text seems legitimate, if a request seems even remotely “off,” don’t act on it until you confirm it with a phone call or face-to-face conversation.

In the case of an alleged message from our clergy or staff, you may want to reach out to a member of the clergy or staff, using their official email address or church landline. Email the person directly using an email address you know to be correct. DO NOT reply to the suspicious email or text. Likewise, if a member of your parish staff is asking you to do something unusual, confirm with a phone call.

Observing these two steps will go a long way in identifying and avoiding “whaling” attacks before they get their hooks in you.

Remember:

• We keep our directory safe and secure. We take significant efforts to keep our community members' information safe. We monitor access to our site and have not detected any unusually activity or access. Unfortunately, scammers can use publicly available information to try and scam members of our community.

• Any legitimate requests will be announced via official channels. If you ever have any questions, please reach out directly to the church office. Clearly state that requests for donations will also appear in church publications, including the website.

• Our church clergy and staff will only use their church’s email account for all church-related correspondence.These accounts all end in @heavenlyrestabilene.org.

• Keep your eyes out for anything suspicious. If a suspicious email or text claims appears to be from a member of the clergy or parish staff, recipients can double-check the “from” address or number. If that doesn’t match up with the church’s usual address, or if it’s even a slight variation, that’s a red flag.

• When in doubt, ask! If you ever have questions or concerns, they should contact the leader directly or call the church office. Instead of hitting “reply” on a questionable email or texts, recipients should pick up the phone and call, or start a new email or text chain, using the contact information published in official church channels.

The U.S. Federal Trade Commission has issued warnings about scams targeting churches and congregants. This government agency urges anyone who’s been victimized by a scam to send a report to ftc.gov/complaint.

Thank you to the communications staff in the Diocese of Newark for their resources around this subject matter.