In this era of social media, cybersecurity has become an essential tool for protecting organisations and the information they hold. The Church cannot remain untouched by these developments. As churches increasingly rely on digital platforms for evangelism, communication, administration, and nurturing the faith of their members, the risks posed by cybercrime continue to grow. It is therefore crucial for the Church to adopt effective measures to safeguard information, serve its members, and maintain confidentiality.
October marks the observance of Cybersecurity Awareness Month, a global initiative aimed at educating the public about online safety. It also provides an opportunity to raise awareness of cybersecurity within the Church and encourage responsible digital practices among church leaders, workers, and members.
The Church of Pentecost’s mission field extends far beyond the physical walls of our sanctuaries. Through platforms such as Facebook, YouTube, Instagram, and WhatsApp, we share the Gospel, stream worship services, and build meaningful online fellowships.
However, these digital spaces also present hidden risks. Just as we take measures to secure our physical church buildings, we must guard our digital gates against malicious online threats.
Why Are Churches Targeted?
Many people believe that cybercriminals target only large corporations and financial institutions. In reality, churches are also frequent targets. Cybercriminals exploit the trust, openness, and compassion that characterise Christian ministry. By compromising official church accounts or impersonating church leaders, they take advantage of members’ willingness to help, often resulting in financial fraud or identity theft.
Common Threats To Our Ministry Platforms
1. Account Takeovers (Hijacking)
Hackers use leaked passwords or phishing links to gain administrative control of official church social media accounts. Once inside, they may lock out legitimate administrators, publish inappropriate content or circulate fraudulent links to followers.
2. Impersonation and Social Engineering
Scammers create fake accounts using the names and photographs of pastors or other church leaders. They then send private messages to members requesting urgent financial assistance, gift cards or confidential personal information.
3. Phishing Emails
Church staff and volunteers may receive convincing emails that appear to come from church leaders, domain registrars or social media platforms. These fraudulent messages are designed to deceive recipients into revealing their login credentials or other sensitive information.
4. WhatsApp Account Hijacking
Scammers may trick individuals into sharing the six-digit verification code sent to their phones. Once they obtain the code, they can take over the victim’s WhatsApp account and message their contacts, including church groups, to solicit money. Because the messages come from a familiar number, recipients may believe the requests are genuine.
5. Fake Giving and Mobile Money Requests
Fraudsters circulate false appeals for offerings, tithes, or so-called seed contributions, directing members to send money to unofficial mobile money numbers. These requests may feature copied church logos, photographs, or flyers to appear authentic.
6. AI-Generated Fakes
Artificial intelligence can be used to create cloned voice notes and manipulated videos of pastors or other church leaders. Such content may appear highly convincing, reminding us that a familiar voice or face is no longer sufficient proof of identity.
How We Can Protect Our Digital Fellowship
Protecting our digital presence requires collective vigilance. The following six practices should guide our ministry teams, church leaders, workers and members.
1. Enable Multi-Factor Authentication (MFA)
Everyone who has administrative access to official church social media accounts should enable multi-factor authentication. This security measure requires an additional verification step during login, making it more difficult for unauthorised persons to gain access. Where possible, use an authenticator app rather than relying solely on SMS verification codes.
2. Verify Before You Give
Church leaders should not be assumed to be genuine simply because a message bears their names or photographs. Be cautious of private messages requesting gift cards, urgent transfers, or personal information. If you receive a suspicious request from someone claiming to be a pastor or church leader, verify it through a direct phone call or in person before taking action. Make contributions only through officially announced church accounts and mobile money numbers.
3. Review Account Access Regularly
The number of people with administrative privileges on church platforms should be limited to those who genuinely need them. When a staff member or volunteer leaves a role, their access should be withdrawn promptly. At least two trusted individuals should be able to manage account recovery, while recovery email addresses and telephone numbers should be securely controlled by the church rather than tied solely to one person’s private account.
4. Use Strong, Unique Passwords
Avoid reusing passwords across different platforms. A strong, unique password for each account reduces the risk that a breach on one platform will compromise others. A reputable password manager can help generate and securely store complex passwords.
5. Never Share Verification Codes
A one-time verification code sent to your phone is for your use alone. No pastor, church officer, bank representative, or mobile money agent should ask you to disclose it. Even if the request appears to come from someone you know, do not share the code. Their account may have been compromised, or someone may be impersonating them.
6. Protect Our Members’ Privacy
Think carefully before posting photographs of children, full names, home addresses, or sensitive prayer requests on public pages or during livestreams. Obtain appropriate consent before sharing personal images or information, particularly those involving children. Where necessary, use restricted-access groups and avoid publishing details that could expose members to harm. Remember that information shared online can be difficult to remove completely.
What Should We Do If Our Digital Gates Are Breached?
Even careful ministries can fall victim to cyberattacks. Prompt action can help limit the damage.
- Alert: Inform church leadership and the church office immediately.
- Secure: Change compromised passwords, remove unauthorised administrators, sign out other active sessions where possible, and follow the platform’s official account recovery procedures.
- Warn: Notify the congregation through other trusted channels, such as church announcements or telephone calls, so that members do not respond to fraudulent messages.
- Report: Report the incident to the affected platform and the Cyber Security Authority of Ghana through its official reporting channels. The Authority’s short code, 292, may be used to report cybersecurity incidents. Preserve screenshots and other relevant evidence.
A Biblical Reminder For The Digital Frontier
In Matthew 10:16 (ESV), Jesus instructs His disciples: “Behold, I am sending you out as sheep in the midst of wolves, so be wise as serpents and innocent as doves.”
As we harness technology to fulfil the Great Commission, let us apply this divine wisdom to our online activities. Our commitment to evangelism and fellowship must go hand in hand with vigilance, discernment, and responsible digital conduct.
By staying informed and adopting safe digital habits, we can protect the integrity of our message and help ensure that our online spaces remain safe and welcoming environments for all.
This October, let each of us take one practical step towards greater digital security: enable multi-factor authentication on our accounts, review who has administrative access to our church platforms, or share this article with a fellow member.
Written By David Appiah Dankwah