1
Off company systems
Texts bypass our spam filtering, External labels, logging and security team. Nobody else can see the conversation.
How it showed up hereThe sender says they will "be in touch from a secondary number".
Leadership Impersonation & "Text Me" Scams
This short course is required for everyone at Charitybuzz. It takes about ten minutes: a few focused lessons, a quick quiz, and a confirmation that goes on your training record. Everything in it comes from the kinds of messages and requests our team is actually receiving, so what you learn here is what you will use at work.
What this covers How scammers pose as Charitybuzz leaders, move you onto text, and then ask for gift cards, wires or payment changes.
What this is about
Right now, people across Charitybuzz are getting messages that look like they come from our leaders, including former executives. They are not from them.
They almost always start the same way: a short, friendly email from a free Gmail address asking "which number is best for text messaging?" There is no link and no attachment, so nothing looks dangerous. That is the point. The email only exists to get you onto text, where the real request comes: buy gift cards, send a wire, or change where a payment goes.
Scammers watch LinkedIn for new job announcements and profile updates, so if you recently joined or changed roles you are a likelier target.
$3.05B
reported lost to business email compromise (BEC) in 2025
24,768
BEC complaints filed with the FBI in 2025
#2
BEC ranks second among all cybercrime types by dollar loss
Take apart the "text me" email
This is based on a real message sent to a Charitybuzz executive. Click every detail that should make you stop. There are nine.
0 of 9 red flags found Click anything in this message that looks suspicious.
Today's work Operation
Good morning Alex
Which of your numbers is suitable for text messaging concerning today's duty, I'll be in touch from my secondary number.
Sincerely,
Get Outlook for iOS
Link goes to:—
Click anything in this message that looks suspicious.
Take apart the fake "shared a spreadsheet" email
Not every message asks for your number. This one is based on a real fake Google share that reached Charitybuzz staff. There are seven details to find.
0 of 7 red flags found Click anything in this message that looks suspicious.
Updated invitation: Performance Evaluation @ Wed Jul 8, 2026 7:30am – 12:30pm (EDT) (00-KWI Office Calendar) ZuVijG
charitybuzz shared a spreadsheet
People Operations (Operations) has invited you to edit the following document:
Performance Evaluation
Open
Link goes to:—
Click anything in this message that looks suspicious.
Why they want you on text
The first email is a hook. Once you reply with a number, the scammer has moved you somewhere they have the advantage:
2
Authority
A request that appears to come from a leader is hard to question, especially for newer staff.
How it showed up hereThe display name is a leader's name. The tone is short and confident.
3
Urgency and secrecy
The task is always "right now" and "between us", so you do not stop to check or ask a colleague.
How it showed up here"I'm stuck in a meeting and need a quick favor."
4
Small first step
Sharing a phone number feels harmless. But each small yes makes the next, bigger request feel natural.
How it showed up hereNumber first. Then "are you free?". Then the real ask.
What they ask for once you are on text
The requests are simple and all involve money moving somewhere that cannot be reversed. At Charitybuzz they tend to look like these:
Executive assistants & anyone close to leadership
Gift cards "for a client"
A text that appears to be from a leader says they are stuck in a meeting and need you to buy gift cards for a client or a partner, then send them photos of the codes. They promise to pay you back.
The tell
Gift cards are the scammer's favorite because they are instant and untraceable. No one at Charitybuzz will ever ask you to buy gift cards or send card codes.The right move
Do not buy anything. Message the leader on Slack, in a channel you already use, and tell John.Finance & Operations
A "quick" wire or ACH
A leader's name asks you to send a wire or ACH payment today to a new account, with a reason that cannot be discussed over the phone.
The tell
Real payments go through our normal approval process, with more than one person involved. Anything that asks you to skip it is the scam.The right move
Do nothing until you have confirmed with the leader by Slack or a phone number you already had, and with Finance.HR, Finance & Partnerships
A change to where money is sent
Someone asks you to change direct-deposit details for a person, or the bank details a nonprofit partner is paid to, "because the old account is closing".
The tell
Changes to payment details are one of the most common ways companies lose money. The request arrives by email or text, never through the normal secure process.The right move
Always confirm any change to payment details with the real person, using contact details you already had, before anything is updated.Red flags to watch for
Quick check: for each sender address, decide whether it is a red flag or looks fine. Remember, real Charitybuzz email only comes from @charitybuzz.com.
0 of 6 answered
[email protected]The domain is exactly charitybuzz.com.
Lauren Werner <[email protected]>A leader's name on a free Gmail address. The name is typed in by the sender; the address is what matters.
[email protected]One letter is missing: charitybuz.com, not charitybuzz.com. Look-alike domains rely on you not reading every letter.
[email protected]Extra words after the company name make a different domain. Only @charitybuzz.com is ours.
[email protected]This matches our domain. (Even then, if the request is unusual, confirm on Slack: accounts can be compromised.)
Text from an unknown number: "Hey, are you free? I need a quick favor."A leader does not need to ask if you are free by text from a number you do not recognize. Verify on Slack first.
A free email address (Gmail, Outlook.com, etc.)
Leaders and colleagues write from @charitybuzz.com. Always.
The yellow External label
It is Gmail telling you the sender is outside Charitybuzz.
"Which number should I text you on?"
No legitimate colleague needs to ask this. They have your number or can look it up.
A request to move to text or another app
Moving off company systems is the whole point of the scam.
Urgency and "keep this between us"
Real leaders do not need secrecy to buy something for a client.
Money, gift cards, or payment changes
No one here will ever ask you to buy gift cards or move money over text.
No name, title or normal signature
Phone-app taglines ("Sent from my iPhone", "Get Outlook for iOS") replace a real signature.
Odd formatting and wording
Strange subject lines, random codes, and fake legal footers that have nothing to do with the request.
A real message from a leader
- Comes from @charitybuzz.com
- Has no External label
- References something specific you both know
- Is typically sent by Slack or email you can verify
- Never involves gift cards or unplanned payments
An impersonation
- Comes from a free or look-alike address
- Carries the External label
- Is vague: "a quick favor", "today's duty"
- Wants to move to text, from a "secondary number"
- Ends in gift cards, a wire, or a payment change
What to do instead
Check the address
Real Charitybuzz email only comes from @charitybuzz.com. Look for tiny misspellings or extra words, like charitybuz.com or charitybuzz-team.com.
Verify on Slack
If someone from the team asks for anything by text or email, DM them on Slack to confirm before you do anything.
Do not act until it is confirmed
No replying, no clicking links, no sharing your number. No one here will ever ask you to buy gift cards or move money over text.
Not sure? Send it to John
Take a screenshot and DM John on Slack, or email [email protected]. You are never bothering anyone. It is much better to get twenty "is this legit?" messages than for one person to be scammed.
Report it
In Gmail, open the message, click ⋮ and choose Report phishing, or mark it as spam.
If you clicked — or entered something
Replied or shared your number? Stop replying and tell John
Do not respond to any more messages from that number. Take screenshots of everything, then tell John on Slack. You will not be in trouble.
Bought gift cards or sent money? Act within the hour
Tell John and Finance immediately. Contact the gift-card company or your bank right away: if you move fast, some payments can be stopped or recalled.
Report it — even if you think you got away with it
In Gmail, open the message, click the ⋮ menu and choose Report phishing. Then email [email protected] with a one-line summary of what you did (clicked, opened a file, typed a password, approved a prompt). Fast reports let IT block the sender for everyone.
Typed your password? Change it now
From a device you trust, go to myaccount.google.com by typing it yourself, change your password, and review Security → Your devices. If you reuse that password anywhere else, change it there too.
Approved a sign-in prompt or read out a code? Call IT immediately
This is the most urgent case: the attacker may already be in your account. Contact Charitybuzz IT ([email protected]) right away so they can end every session and reset access.
Opened an attachment or installed something? Stop and tell IT
Don't keep working on that device and don't try to "clean it up" yourself. Leave it on, disconnect it from Wi‑Fi if you can, and contact IT.
Key takeaways
- Real Charitybuzz email only comes from @charitybuzz.com. Check for tiny misspellings and extra words.
- A leader's name on a free Gmail address, or any message with the External label, is not them.
- No one here will ever ask you to buy gift cards, or move money or change payment details over text.
- If someone asks for something by text or email, DM them on Slack to confirm before you act.
- Not sure? Screenshot it and send it to John. You are never bothering anyone.
Knowledge check
Confirm your training record
This creates the completion record Charitybuzz keeps for compliance. Please use your work details.
Training complete
Your completion has been recorded. Thank you for helping keep Charitybuzz, our nonprofit partners, and our bidders safe.
Certificate ID: —
View & print certificateKeep this handy
- Real Charitybuzz email only comes from @charitybuzz.com. Check for tiny misspellings and extra words.
- A leader's name on a free Gmail address, or any message with the External label, is not them.
- No one here will ever ask you to buy gift cards, or move money or change payment details over text.
- If someone asks for something by text or email, DM them on Slack to confirm before you act.
- Not sure? Screenshot it and send it to John. You are never bothering anyone.