Staying Safe Online: A Guide for Our Church Family
Recently, several people in our church family have received emails that appear to come from Pastor Shawn or other members of our staff. They are not from us. They come from scammers who have learned that church communities are trusting communities — and who count on that trust.
We want to help you recognize these messages, and to share some broader habits that will keep you safer online generally. None of this requires you to be good with computers. It mostly requires knowing what to look for.
The scam going around right now
The email looks like this. The sender's name says "Pastor Shawn Beaty." The message is warm and familiar in tone. It says something like:
"I have a matter on my heart that calls for discretion and wisdom, and I would be honoured to have your help with it. I am unable to take calls at this time, but I would greatly appreciate it if you could reply to this email when convenient."
Notice what it does not say. It does not say what the matter is. It does not give a phone number. It creates a small obligation and asks you to write back.
If you reply, the second email arrives. That one asks for something specific: buy gift cards for a family in need, send money to help someone quietly, keep it between the two of you because it's sensitive. That is the whole point of the first email — to find out who will answer.
Four things that are always true
These are worth committing to memory. If any one of them is broken, the message is fake.
1. Our pastors and staff will never email you asking for gift cards, wire transfers, Venmo, Zelle, Cash App, or cryptocurrency. Not for a family in need, not for a missions emergency, not for any reason at all.
2. We will never ask you to keep a financial request secret. Real ministry needs go through the church. Scammers ask for secrecy because secrecy keeps you from checking with someone who would recognize the scam.
3. Official staff email always ends in @hillsonline.org. A message from a gmail.com, yahoo.com, or outlook.com address is not from our staff, no matter whose name is on it.
4. All giving goes through our regular, published channels: hillsonline.churchcenter.com/giving, the Church Center app, or in person. We will never email you a new or one-time payment link.
How to check who really sent an email
This is the single most useful skill on this page, and it takes five seconds.
The name at the top of an email means nothing. Anyone can type any name they want, the same way anyone can write any return address on an envelope. What matters is the actual email address underneath it.
On a phone: tap the sender's name. The real address appears.
On a computer: hover your mouse over the name, or click the small arrow beside it.
Then read the address carefully, especially the part after the @ symbol. Scammers use addresses that look almost right — an extra letter, a swapped letter, .co instead of .com, or a real-looking name in front of a personal email service.
Other scams we've seen in our congregation
The pastor email is one shape of the same trick. Here are others that have reached people here.
"Grandma, I'm in trouble." A call or text from someone claiming to be a grandchild in an accident, in jail, or stranded, needing money right away and asking you not to tell their parents. Some now use recorded voices that sound convincing. Hang up. Call your grandchild directly on the number you already have. It has never once been real.
The delivery text. A text says a package couldn't be delivered and you need to click a link to reschedule. The link asks for your card number for a small redelivery fee. Real carriers don't text you links asking for payment.
"Your account has been suspended." An email from your bank, Amazon, Netflix, or Social Security saying something urgent is wrong and you must click to fix it. Don't click. Open your browser and go to the company's website the way you normally would, or call the number on the back of your card.
The computer pop-up. A loud warning appears saying your computer is infected and giving a phone number to call for support. This is always a scam. Real virus warnings never give you a phone number. Close the browser — or hold the power button until the machine shuts off if you can't.
Charity appeals after a disaster. After hurricanes, fires, and tragedies, fake charities appear within hours. Give to organizations you already know, through their own websites.
The pattern underneath all of them
Every one of these scams uses the same three ingredients:
Urgency. Something must happen right now.
Secrecy or isolation. Don't tell anyone, or don't hang up.
An unusual form of payment. Gift cards, wire transfers, cash apps, crypto.
Legitimate organizations do not operate this way. If you notice any two of these three in a message, you can stop reading and delete it.
Simple habits that protect you
Use a different password for every important account. If a scammer gets the password you use everywhere, they get everything. Your email password especially — because whoever controls your email can reset every other password you own.
Use a passphrase instead of a password. Something like Coffee-Porch-Tuesday-7 is far stronger than Bethany2019! and far easier to remember. Length matters more than symbols.
Turn on two-step verification for your email and your bank. It sends a code to your phone when someone tries to sign in. It is a minor inconvenience once a month and it stops the great majority of account takeovers.
Slow down. Nearly every scam depends on you acting faster than you think. Almost nothing legitimate in life requires a decision in the next ten minutes.
When in doubt, hang up and call back. On a number you look up yourself — not one from the message. This one habit defeats nearly every phone scam.
If you get one of these emails
Don't reply, even to ask who it is. A reply confirms your address is active.
Don't click links or open attachments.
Report it in your email program, then delete it. In Gmail: open it, tap the three dots, choose Report phishing. In Outlook or Yahoo, use Report or Junk. This teaches your provider to block the sender for everyone.
You don't need to forward it to the church. We're aware of this campaign and working on it.
If you already responded or sent something
Please give us a call at 559.297.2600
We want to say this as plainly as we can: you were not foolish. These messages are written by people who do this professionally, and they are designed to work on careful, generous, trusting people. Being generous is not a character flaw. Being targeted for it is not your failure.
If you sent money or gift cards, call your bank or the gift card company right away — before anything else. The window for recovery is measured in hours. And call us. We would rather walk through it with you than have you carry it alone.
Look out for one another
If you have a parent, grandparent, or neighbor in our church family, take a few minutes this week to talk with them about this. A conversation over coffee reaches people that an email never will.
And if something ever feels off about a message that seems to come from one of us — call the office at 559.297.2600 and ask. We would far rather answer a question than clean up after a scam. There is no such thing as bothering us about this.