For Churches: Safeguard Your Congregation Phishing Simulator

Phishing emails almost always create time pressure to prevent you from thinking critically or verifying the request. Legitimate requests for sensitive documents rarely demand same-day turnaround with no prior discussion.

W-2 forms are among the most valuable documents for identity theft. They contain everything a criminal needs: full legal names, SSNs, home addresses, and income data. No legitimate request would ask for these to be emailed as an unencrypted PDF.

This is the most dangerous element. By asking you not to tell anyone, the attacker eliminates the one thing that would expose the scam: you walking down the hall and asking Pastor David in person. Legitimate leadership never asks staff to secretly send tax documents.

Church administrators feel personally responsible for their colleagues’ pay. This email weaponizes that care — making you feel that your coworkers won’t get paid if you don’t act immediately. Real payroll providers don’t threaten service suspension via a single email with a 24-hour window.

The link goes to hcm-workforce-notify.com — the fake domain. It will show a convincing replica of your provider’s login page and capture your username and password. Never click links in unexpected emails. Instead, open a new browser tab and go directly to your provider’s website.

Losing 501(c)(3) status would be catastrophic for a church — donors lose their tax deductions, the organization owes back taxes, and operations may become unsustainable. The attacker knows this is the single most terrifying threat for a church administrator, and uses it to override your judgment.

The IRS already has your Form 990 (you filed it). They would never ask for bank statements, donor records, and board minutes via email. This request is designed to harvest your church’s complete financial profile — donor identities, account numbers, and internal governance documents.

IRC Section 7611 and Section 501(c)(3) are real parts of the tax code. Including them makes the email feel legally authoritative. But quoting real law doesn’t make the email real — it just means the attacker did their homework. The IRS initiates examinations by certified mail, never by email with a link.