Facebook Scam Warning for Churches

The warning comes after a church discovered that unauthorised changes had been made to its Facebook administration settings, prompting the parish to delete its account and start afresh as a precautionary measure.

The church reported that one of its social media administrators was removed from the account without any knowledge of the wider team and with no corresponding record appearing in the Facebook activity log. The administrator subsequently received an email incorrectly stating that another member of the team had removed them.

As volunteers investigated the issue, they discovered the page appeared to have been linked to a Meta business account based in the United States. A second administrator was later removed from the account, again without authorisation and without any record appearing in the page's administrative activity history.

Concerns deepened when password and two-factor authentication systems also appeared to be compromised, leading the church's social media team to conclude that deleting the account was the safest option.

The parish has since advised all administrators to change the passwords associated with their email and social media accounts and is encouraging others to do the same.

The incident follows several recent scams in which fraudsters have used church names and identities to promote events that were never planned by the parish. In one case, advertisements appeared online claiming that the church was hosting concerts and charging £40 for a tabletop event despite no such event having been organised.

While churches have long been targets for email phishing scams, fraudsters are increasingly seeking access to social media accounts, where they can impersonate organisations, advertise fake events, request payments or gather personal information from followers.

Churches are encouraged to take a number of simple precautions, including:

• Regularly reviewing who has administrator access to social media accounts.

• Enabling two-factor authentication for all administrators.

• Using strong, unique passwords for social media and associated email accounts.

• Removing former administrators who no longer require access.

• Regularly checking account activity and security settings.

• Being wary of unsolicited emails claiming to be from Facebook, Meta or other social media platforms.

Anyone who notices suspicious activity on a church account should report it to the platform immediately and make other administrators aware.

Harriet Roberts, Director of Communications for the Diocese of Chester said: "Many churches rely on social media to share news, events and worship opportunities with their communities. Unfortunately, these platforms can also attract criminals seeking to exploit trusted organisations. We would encourage all churches to review their security settings and remain vigilant for any unusual account activity."

Parishes that experience attempted scams, account breaches or online impersonation are encouraged to share details with diocesan colleagues so that other churches can be made aware of emerging threats and help protect their online presence.