1 in 8 charities experienced cyber crime last year

This followed earlier findings indicating that the pandemic prompted increasing numbers of charities to move to digital fundraising and operating, exposing them to the risk of cyber crime.

Most concerningly, the survey highlighted a potential lack of awareness of the risks facing charities online, with just over 24 per cent having a formal policy in place to manage the risk. Similarly, only around half (55 per cent) of charities reported that cyber security was a fairly or very high priority in their organisation.

The warning comes ahead of Charity Fraud Awareness Week, which begins on Monday (17 October). The campaign raises awareness of fraud and cyber crime and brings the charity sector together to share knowledge, expertise and good practice. It is run by the Charity Commission and the Fraud Advisory Panel and a partnership of charities, NGOs, regulators, law enforcers, and other not-for-profit stakeholders.

The Charity Commission’s new survey explored charities’ experiences of online cyber attack. It found that over half of charities (51 per cent) held electronic records on their customers, while 37 per cent enabled people to donate online. A greater digital footprint increases a charity’s vulnerability. The most common types of attacks experienced were phishing and impersonation (where others impersonate the organisation in emails or online). For both attacks, personal data is often at risk.

The survey also confirmed that there is an under-reporting of incidents when they do occur, with only a third (34 per cent) of affected charities reporting breaches. It’s important that charities get in touch with the commission where there has been a serious incident, even where there may be no regulatory role for the commission. This helps the regulator identify trends and patterns and help prevent others from falling victim to fraud.

Amie McWilliam-Reynolds, assistant director intelligence and tasking, from the Charity Commission, said online financial transactions, and online working, present a great opportunity for charities — whether in engaging supporters, raising funds, and streamlining their operations.

“This was demonstrated in particular during the pandemic, when the longer-term move away from cash to online fundraising accelerated,” she said.

“But online financial transactions and the collection and storage of personal data also harbour risk, and we are concerned that some charities may be underestimating that risk, and are therefore exposing their charity to potential fraud.”