Temple / Mosque Donation Phishing Scam

This scam targets the donation channels of a specific, real, and identifiable temple, mosque, or other place of worship, rather than a generic or invented cause. Scammers clone the institution's real website, email communications, or QR codes, or impersonate its official social media presence, to intercept donations intended for the actual, known institution.

This differs from a fully fabricated fake charity in that the impersonated organisation is genuine and locally trusted — congregants already have an established giving relationship with the actual institution, which the scam exploits by inserting itself into that existing relationship rather than trying to build trust from nothing.

The scam is particularly common around religiously significant periods and events — major festivals, building projects, or annual fundraising drives — when donation volume and urgency are naturally elevated, and it can affect institutions of any faith tradition with an established local congregation and public donation infrastructure.

Scammers typically begin by copying the visual design, name, and any publicly available branding of a specific, known place of worship, registering a similar domain name or building a page on a common donation-processing platform designed to closely resemble the institution's real one. Distribution follows the institution's own usual communication patterns — a fake email blast to a scraped or purchased mailing list, a social media post from an impersonating account, or a printed QR code placed in or near the physical premises.

Donors familiar with the institution recognise its name, logo, and general appearance and proceed to donate without closely checking the exact web address or account details, particularly when the request references a specific, real event or campaign the institution is known to be running, such as a festival collection or a genuine ongoing renovation.

Because the impersonated institution is real, verification is more straightforward than with a fully invented charity — a phone call or in-person visit to the temple or mosque can immediately confirm whether the donation channel is genuine — but many donors do not take this step, particularly when time pressure or the routine nature of giving discourages a pause to verify.

Existing trust in a specific, known local institution transfers automatically to anything bearing its name and visual branding, and most donors do not expect an impersonation targeting an organisation they already have a direct, ongoing relationship with, as opposed to a stranger charity appealing for the first time. This makes routine, low-scrutiny giving especially vulnerable.

The concentration of legitimate giving activity around major festivals and events also creates a natural moment when a fraudulent appeal referencing the same event blends in with a wave of genuine communications from the institution and its members, making it harder to notice a single fraudulent message among many expected ones.

During a major religious festival, a member of a mosque's congregation receives a text message with a link to donate toward the festival's charitable collection, referencing the specific, real event the mosque is running that week. The message appears to reference genuine details and the linked page closely resembles the mosque's usual donation platform. The member donates by card. Days later, mosque leadership announces during prayers that no such text was sent and that its actual donation channel has a different web address entirely, at which point several congregants realise they gave through the fraudulent link instead.

Join our festival giving campaign this week — donate here: [fake link]

Our regular donation system is temporarily down — please use this alternative method for now: [fake link]

Scan this code to contribute to our renovation fund conveniently from your phone. [QR code]

Please note our account details have changed — send your contribution to this new account.

Confirm any donation link, QR code, or account detail directly with the temple, mosque, or institution in person or by a phone number you already know or can verify independently, particularly before donating a significant amount or setting up a recurring gift. Compare the exact web address of any donation page character by character against the institution's known, established website rather than assuming visual similarity is sufficient.

For QR codes on printed materials at the physical premises, check with staff whether the code is original to the printed material or a possible sticker overlay, and be cautious of any donation appeal received via unfamiliar text message or email address that does not match the institution's known communication channels.