In this era of social media, cybersecurity has become an essential tool for protecting organisations and the information they hold. The Church cannot remain untouched by these developments. As churches increasingly rely on digital platforms for evangelism, communication, administration, and nurturing the faith of their members, the risks posed by cybercrime continue to grow. It is therefore crucial for the Church to adopt effective measures to safeguard information, serve its members, and maintain confidentiality.October marks the observance of Cybersecurity Awareness Month, a global initiative aimed at educating the public about online safety. It also provides an opportunity to raise awareness of cybersecurity within the Church and encourage responsible digital practices among church leaders, workers, and members.The Church of Pentecost’s mission field extends far beyond the physical walls of our sanctuaries. Through platforms such as Facebook, YouTube, Instagram and WhatsApp, we share the Gospel, stream worship services, and build meaningful online fellowships.However, these digital spaces also present hidden risks. Just as we take measures to secure our physical church buildings, we must guard our digital gates against malicious online threats.Why Are Churches Targeted?Many people believe that cybercriminals target only large corporations and financial institutions. In reality, churches are also frequent targets. Cybercriminals exploit the trust, openness, and compassion that characterise Christian ministry. By compromising official church accounts or impersonating church leaders, they take advantage of members’ willingness to help, often resulting in financial fraud or identity theft.Common Threats To Our Ministry Platforms1. Account Takeovers (Hijacking)Hackers use leaked passwords or phishing links to gain administrative control of official church social media accounts. Once inside, they may lock out legitimate administrators, publish inappropriate content or circulate fraudulent links to followers.2. Impersonation and Social EngineeringScammers create fake accounts using the names and photographs of pastors or other church leaders. They then send private messages to members requesting urgent financial assistance, gift cards or confidential personal information.3. Phishing EmailsChurch staff and volunteers may receive convincing emails that appear to come from church leaders, domain registrars, or social media platforms. These fraudulent messages are designed to deceive recipients into revealing their login credentials or other sensitive information.4. WhatsApp Account HijackingScammers may trick individuals into sharing the six-digit verification code sent to their phones. Once they obtain the code, they can take over the victim’s WhatsApp account and message their contacts, including church groups, to solicit money. Because the messages come from a familiar number, recipients may believe the requests are genuine.5. Fake Giving and Mobile Money RequestsFraudsters circulate false appeals for offerings, tithes, or so-called seed contributions, directing members to send money to unofficial mobile money numbers. These requests may feature copied church logos, photographs, or flyers to appear authentic.6. AI-Generated FakesArtificial intelligence can be used to create cloned voice notes and manipulated videos of pastors or other church leaders. Such content may appear highly convincing, reminding us that a familiar voice or face is no longer sufficient proof of identity.How We Can Protect Our Digital FellowshipProtecting our digital presence requires collective vigilance. The following six practices should guide our ministry teams, church leaders, workers and members.1. Enable Multi-Factor Authentication (MFA)Everyone who has administrative access to official church social media accounts should enable multi-factor authentication. This security measure requires an additional verification step during login, making it more difficult for unauthorised persons to gain access. Where possible, use an authenticator app rather than relying solely on SMS verification codes.2. Verify Before You GiveChurch leaders should not be assumed to be genuine simply because a message bears their names or photographs. Be cautious of private messages requesting gift cards, urgent transfers or personal information. If you receive a suspicious request from someone claiming to be a pastor or church leader, verify it through a direct phone call or in person before taking action. Make contributions only through officially announced church accounts and mobile money numbers.3. Review Account Access RegularlyThe number of people with administrative privileges on church platforms should be limited to those who genuinely need them. When a staff member or volunteer leaves a role, their access should be withdrawn promptly. At least two trusted individuals should be able to manage account recovery, while recovery email addresses and telephone numbers should be securely controlled by the church rather than tied solely to one person’s private account.4. Use Strong, Unique PasswordsAvoid reusing passwords across different platforms. A strong, unique password for each account reduces the risk that a breach on one platform will compromise others. A reputable password manager can help generate and securely store complex passwords.5. Never Share Verification CodesA one-time verification code sent to your phone is for your use alone. No pastor, church officer, bank representative or mobile money agent should ask you to disclose it. Even if the request appears to come from someone you know, do not share the code. Their account may have been compromised, or someone may be impersonating them.6. Protect Our Members’ PrivacyThink carefully before posting photographs of children, full names, home addresses or sensitive prayer requests on public pages or during livestreams. Obtain appropriate consent before sharing personal images or information, particularly those involving children. Where necessary, use restricted-access groups and avoid publishing details that could expose members to harm. Remember that information shared online can be difficult to remove completely.What Should We Do If Our Digital Gates Are Breached?Even careful ministries can fall victim to cyberattacks. Prompt action can help limit the damage.
- Alert: Inform church leadership and the church office immediately.
- Secure: Change compromised passwords, remove unauthorised administrators, sign out other active sessions where possible, and follow the platform’s official account recovery procedures.
- Warn: Notify the congregation through other trusted channels, such as church announcements or telephone calls, so that members do not respond to fraudulent messages.
- Report: Report the incident to the affected platform and the Cyber Security Authority of Ghana through its official reporting channels. The Authority’s short code, 292, may be used to report cybersecurity incidents. Preserve screenshots and other relevant evidence.
