Why it matters

Nonprofits rely on trust to fulfill their missions, making them especially vulnerable to AI-powered cyberattacks that target donor relationships, financial transactions, and sensitive data. A successful attack can disrupt operations, damage an organization's reputation, jeopardize funding, and erode stakeholder confidence. 

The risk is no longer theoretical. The FBI's 2025 Internet Crime Report reported nearly $21 billion in cyber enabled crime losses and, for the first time, included a dedicated section on artificial intelligence related cybercrime. The report noted nearly $893 million in losses associated with AI related complaints and warned that scammers are increasingly using voice clones, fake social profiles, identification documents, and believable videos to make fraud schemes more convincing. 

By understanding how AI is changing the threat landscape and strengthening core cybersecurity practices, nonprofits can better protect their mission, safeguard donor trust, and build long-term organizational resilience.

How is Artificial Intelligence (AI) changing the threat landscape for nonprofits?

While phishing emails and online scams aren't new, AI is making them significantly more convincing. Instead of generic messages filled with spelling mistakes, attackers can now use AI to create highly personalized emails that closely mimic the tone, language, and writing style of trusted colleagues, executives, donors, or vendors.

AI is also fueling a rise in:

• Sophisticated phishing campaigns that are harder to identify
• Business email compromise scams designed to redirect payments or donations
• Deepfake audio and video that can imitate organizational leaders
• Automated vulnerability scanning that helps attackers identify weaknesses faster
• Synthetic identities and fraudulent donation activity that can distort fundraising data and create financial risks 

For nonprofits built on trust and relationships, these tactics can be particularly damaging.

Security expectations continue to grow

At the same time cyber threats are evolving, expectations around cybersecurity are increasing.

Depending on the organization, nonprofits may need to comply with requirements related to:

• HIPAA and protected health information
• PCI DSS payment card security standards
• State privacy regulations
• Grant and funding agreements
• Vendor and contractual security obligations 

Donors, grantmakers, regulators, and board members are also paying closer attention to how organizations protect sensitive information.

Cybersecurity is no longer viewed solely as an IT issue. Increasingly, it's a governance and risk management issue.

Questions nonprofit boards and finance committees should ask

1. What sensitive donor, employee, client, and financial data do we collect, and where is it stored?
2. Do we require multi factor authentication for email, finance systems, donor databases, and cloud applications?
3. How do we verify vendor banking changes, wire transfers, and urgent payment requests?
4. Do we have an AI use policy that tells staff what data may not be entered into public AI tools?
5. When was our incident response plan last tested?
6. Are cybersecurity risks included in board or audit committee discussions at least annually?

Practical steps nonprofits can take today

The good news is that reducing risk doesn't always require a large cybersecurity budget. Organizations can make meaningful improvements by focusing on a few foundational areas:

1. Understand where sensitive data lives. Start by identifying what information you collect, where it's stored, who has access to it, and which vendors are involved.
2. Strengthen payment and financial systems. Multi-factor authentication, secure payment platforms, and strong access controls can significantly reduce risk.
3. Focus on cybersecurity basics. Keeping systems updated, limiting user access, maintaining backups, and enforcing strong passwords remain some of the most effective defenses available.
4. Prepare for AI-enabled scams. Train staff and volunteers to verify urgent financial requests through a second communication channel and include AI-generated phishing examples in awareness training.
5. Review your incident response plan. Organizations should consider how they would respond to ransomware, data breaches, impersonation attempts, and deepfake-related incidents before they happen.

AI is creating new opportunities for nonprofits, but it is also giving fraudsters new ways to exploit trust, urgency, and limited resources. Nonprofits do not need enterprise level cybersecurity budgets to improve their defenses, but they do need clear ownership, practical controls, staff training, and a plan for responding when something goes wrong. By focusing on data protection, payment verification, employee awareness, vendor oversight, and basic cybersecurity hygiene, organizations can strengthen resilience, protect donor trust, and continue advancing their missions in an increasingly complex digital environment.