Nonprofit Gift Card Scams Exploit the Personal Ask Small Charities Depend On

A board member for a four-person nonprofit gets a text from the executive director: "In back-to-back donor calls all afternoon — can you grab five $100 Target cards for the volunteer appreciation gifts and text me the codes? I'll reimburse you from petty cash." It's the kind of message the real director sends all the time. She runs the organization's day-to-day herself, texts board members directly, and handles small purchases informally because there is no purchasing department to route them through. This time the text isn't from her. It's a nonprofit gift card scam, and it works precisely because nothing about the request looks out of character for an organization this size.

Nonprofit gift card scams exploit an org chart of one

At a nonprofit with real overhead — a communications team, a controller, a formal approvals process — an urgent gift-card request from "the director" would trip an obvious wire. At a nonprofit run by one paid staffer and a handful of volunteers, there is no second desk for the request to pass through. The executive director is the only point of contact for the board, the only signature on outgoing asks, and the only identity a scammer needs to copy to reach every volunteer, board member, and part-time bookkeeper the organization has. Impersonate one person and the whole organization is reachable.

This is not a new scam, just a familiar one aimed at a familiar target

Consumer protection agencies have warned about gift card scams for years: a message that appears to come from a boss, a pastor, or a director, asks for gift cards under time pressure, and asks that the codes be sent directly rather than the physical cards. Small charities and congregations show up in those warnings again and again, for the same structural reason independent landlords and solo sellers do — the person being impersonated already communicates informally, urgently, and directly with the people being asked to pay.

The urgency that makes a real request work is what makes the fake one work too

A director who runs fundraising, programs, and board relations alone doesn't have time to route a purchase order for volunteer thank-you gifts through anyone. She sends a fast text between meetings and trusts the board member to just handle it, because that informality is part of how an organization this small functions at all. A scammer isn't inventing a new kind of message to get someone to act quickly. It is copying the one the organization already relies on every week.

A warning email to the board fixes today's scam, not next quarter's

Once a gift card scam succeeds, the usual response is an all-board email: "Please note I will never ask you to purchase gift cards by text." That protects the people who read it. It does nothing for the volunteer who joins in six months, the new part-time bookkeeper who never saw the warning, or a donor who later gets a similarly worded message asking her to move a pledge payment through an unusual channel. A stated policy has to be re-learned by every new person who touches the organization, and small nonprofits turn over volunteers and board seats faster than most policies get repeated to them.

What actually helps is something to check that isn't the message itself

Telling people to "call and confirm" sounds reasonable until you notice that the callback number in a scam text is often the scammer's own, and a board member with no independent way to reach the director may simply call the number she was just given. What actually closes the gap is giving whoever receives an urgent, money-related request something to check that doesn't depend on the message in front of them: a way to confirm, independently, that this specific communication was personally reviewed and sent by the director it claims to be from.

That is the narrow, specific thing a Human ID is built for. How it works covers the mechanics — a permanent identity tied to a real person, and a verification code attached to a specific message that a board member can look up on a page the sender doesn't control and can't talk her out of doubting.

It's worth being exact about what that does and doesn't settle. A verification confirms that a message was personally reviewed and authorized by the person shown — not that a purchase request is a good use of the organization's money, and not that the underlying ask makes sense. What verification does and does not confirm says so directly, because a small nonprofit that overclaims what a checkmark means is one bad text away from losing the trust it was trying to protect.

For an organization with one director and no back office, that is a smaller promise than a fraud-prevention policy usually implies, and a more honest one. It won't stop a scammer from sending the next urgent text. It gives the volunteer holding that text a way to check that isn't just her own judgment about whether the tone sounded right — which, for a scam built to sound exactly like the real thing, was never going to be enough on its own.