Guides · 6-minute read · Published October 22, 2026

Is that giving link real?

Updated October 22, 2026 · Sources checked October 19, 2026

Scammers know church people are generous. They copy the church’s name, logo, and even the pastor’s photo. Then they send a “giving link” that sends the money to them. Here’s how to spot a fake, how to make the real one obvious, and what to do if someone already got fooled.

Words you’ll see

Phishing: a fake message that tries to get you to click, pay, or type a password.
Look-alike website: a web address made to look like the real one, with one letter changed or a word added. For example, gracechurch-give.com instead of gracechurch.org.
QR code: the square barcode you scan with your phone’s camera. It opens a web address. You can’t tell where it goes just by looking at it.

Signs a giving request is fake

It’s rushed. “Give in the next hour.” “The pastor needs this today.” Real churches don’t pressure you like this.
It came out of the blue. A text, email, or social media message you didn’t expect, with a link inside.
The address is a little off. Misspelled. Extra words. A different ending (.net instead of .org). A shortened link that hides where it goes.
It wants an odd way to pay. Gift cards, wire transfers, cryptocurrency, or a payment app sent to a person’s name. The FTC says if a charity insists on these, “it’s likely a scam.”
It’s a personal crowdfunding page. Money given there goes to whoever set it up, not to the church.
The QR code is a sticker. Scammers stick their own QR code on top of a real one.

The FTC (Federal Trade Commission, the U.S. consumer protection agency) gives the same warnings. It says don’t click links in unexpected texts, watch for look-alike websites, and give directly through the charity’s own website (FTC: Before Giving to a Charity). For QR codes, the FTC says look at the web address before you open it, and don’t scan codes in texts or emails you weren’t expecting (FTC: QR code scams). The FBI has warned about criminals tampering with QR codes, too (IC3 public service announcement).

Make your real giving link easy to recognize

The best defense is a habit: everyone knows the one real way to give.

Pick one official giving link and stick with it. Ideally it's on your own church domain, like yourchurch.org/give, which then sends people on to your giving provider. Put it in the same places every time: the top of the website, the bulletin, the screen before the offering, and the church's verified social media profiles. Print the address next to every QR code. Write "Scan or type: yourchurch.org/give." Then people can check where the code goes. Check your printed QR codes every few weeks, especially on posters in the lobby or outside. Look for stickers on top. Say the rule out loud, often: "We will never text you a giving link or ask for gift cards. To give, go to yourchurch.org/give." Never send giving links in mass texts or emails unless they point to that same official address. Consistency is what makes fakes stand out. Turn on two-step login for the giving platform's admin account, so nobody can swap the bank account it pays into.

Bulletin line you can copy: "Our only online giving page is yourchurch.org/give. We never ask for gifts by text, gift card, or payment app. If you're unsure, call the church office."

Our free bulletin insert on fake pastor messages pairs well with this.

If someone already gave to a fake page

Speed matters. Help them do these in order.

Call the card company or bank right away. Use the number on the back of the card. Say it was a scam and ask them to reverse the charge. If they used a payment app (like Venmo, Cash App, or PayPal), report it in the app and ask for a refund. Gift cards: call the number on the back of the card and keep the card and receipt. These steps come from the FTC (What To Do if You Were Scammed).
Change any password they typed on the fake page, and turn on two-step login for that account.
Save the evidence. Screenshot the text, email, or page, including the web address. Write down the date, time, and amount.
Report it. File with the FTC at ReportFraud.ftc.gov and with the FBI’s Internet Crime Complaint Center at ic3.gov.
Report the fake page or profile to the site hosting it (Facebook, Instagram, the crowdfunding site) so it can be taken down.
Tell the church. Send a short, calm note to the congregation. Name the fake address and repeat the real one. Others may have gotten the same message.

Be kind to anyone who got fooled. These scams are built to work on good-hearted people. Shame keeps people from reporting, and reporting is how others get warned.

For more on spotting fake messages in general, see CISA’s guide, Recognize and Report Phishing. CISA is the U.S. government’s cybersecurity agency.