On October 12, most or all of us received an email purporting to be from Pastor Jim asking that we communicate by email about a sensitive matter. The email was not from Pastor Jim - it was part of a scam. I've heard from a few congregants who replied and received a follow-up email requesting that they purchase gift cards. Had anyone done so, they would have received instructions for what to do with the gift cards, which would have ended up in the hands of the scammers.
Scams involving faith communities are very common. We are a trusting, generous bunch, and evildoers try to take advantage of that.
We know how the scammers got our email addresses. An earlier scam email was sent to the @oldsloop.org email addresses that are listed on the church website. Email sent to those addresses goes to church staff, officers, and committee chairs. That scam purported to be from a church staff member and requested a copy of the church directory. Unfortunately at least one of us replied and sent a directory.
Since the scammers now have all of our email addresses, we can expect more attacks like this. So we must be extra vigilant about email security. Here are some tips:
- Be suspicious. Any email that asks for untraceable payments such as gift cards or wire transfers is probably a scam. Any email that asks for your bank account or credit card number is probably a scam. Nobody from the church will ever send you an email asking for such payments or account numbers. Many scams originate abroad and use awkward English or unusual language constructs, or have misspellings or typographical errors. Scams often try to create a sense of urgency hoping you will act without thinking. Don't react to the urgency - take a minute to consider whether the message really makes sense.
- Look carefully at the "from" email address. Scammers often create likely-looking email addresses. The ones that were used for the October 12 scam looked perfectly reasonable as email addresses for pastor Jim - but they were not.. Scammers often create email addresses that resemble actual email addresses. For instance, if they want to impersonate John Doe who has a Yahoo email address, they may create a Gmail account with the same user name and hope the recipient doesn't notice the difference.
- Most email from the church will use an oldsloop.org email address. Email blasts will all come from , email from Pastor Jim will come from , email from Katie will come from , and email from the church office will come from . If an email purporting to be from the church doesn't come from an oldsloop.org email address, be suspicious.
- Do not click a link in an email or open an attachment unless you are certain the email is from a trusted source. Doing so can execute code that can do such things as install a computer virus or allow an attacker to take control of your computer.
- Sometimes an evildoer will "hack" someone's email account, and they can then send email using the victim's actual email address. Scams sent this way can be harder to detect since there is nothing suspicious about the sending email address. If you receive a suspicious email from a friend's actual email address, contact them to ask about it. But do not use email to do so since the evildoer may intercept your message and reply to it.
- It is also important to protect your own email account from attack. Such attacks almost always occur when an evildoer discovers or guesses your password. Use a strong password. Do not write it down in a place that an attacker might see it (such as a sticky note on a laptop). Do not share it with anyone. Or, if you must share it, don't send it in an email that could be intercepted. Use a unique password for each of your online accounts, or an attacker who gets into one of your accounts can get into other accounts too. Consider using a password manager to create and manage strong, unique passwords for all your accounts.
If you have questions or concerns about any of this, feel free to contact Trustees chair geoflyon at .
Regards,
Geof Lyon, for the Board of Trustees