Fraud can have serious consequences for charities, affecting finances, operations, reputation and public trust. Risks can arise internally, through the misuse of funds or weaknesses in financial controls, and externally through scams, cyber-enabled fraud, impersonation and other criminal activity.
Fraud remains an important governance risk for charities, particularly where organisations handle donations, grants, sensitive information or significant financial transactions. Strong financial controls, appropriate oversight and a culture in which concerns can be raised and investigated are important parts of reducing both the likelihood and potential impact of fraud.
The failure to prevent fraud offence under the Economic Crime and Corporate Transparency Act 2023 came into force on 1 September 2025. It applies to large organisations, including charities that meet the relevant size criteria, where an associated person commits a specified fraud offence intending to benefit the organisation or, in certain circumstances, a person to whom it provides services. An organisation may have a defence if it had reasonable fraud prevention procedures in place, or if it was reasonable in the circumstances not to have such procedures.
This guide looks at some of the key internal and external fraud risks facing charities, the controls that can help reduce those risks, and the governance arrangements that support effective fraud prevention and response.
Key internal fraud risks facing charities
Internal fraud can arise where individuals are able to misuse their position, access or authority for personal or other improper benefit. Weaknesses in oversight, segregation of duties or financial controls can increase the opportunity for fraud to occur or remain undetected.
The nature of the risk will depend on the charity’s activities, structure and financial arrangements, but some areas commonly requiring consideration include:
Unauthorised payments
Unauthorised or fraudulent payments can occur where an individual is able to initiate, approve or release funds without appropriate oversight. The risk can be greater where access rights are poorly controlled, authorisation arrangements are unclear or the same person controls several stages of the payment process.
Financial control breaches
Fraud can involve deliberately circumventing established financial controls, falsifying or altering records, or exploiting weaknesses in procedures. Risks can also arise where individuals are able to override controls without appropriate review, or where exceptions to normal procedures are not properly authorised and documented.
Misappropriation of funds
Misappropriation can involve charity funds or other assets being diverted, used for unauthorised purposes or taken for personal benefit. Appropriate authorisation, supporting documentation, reconciliations and independent review can help reduce the opportunity for misuse and increase the likelihood that irregular transactions are identified.
Employee and volunteer-related risks
Fraud risks can arise in roles held by employees, volunteers or others who have access to the charity’s money, assets, systems or financial information. Appropriate controls should apply regardless of an individual’s seniority or length of service, particularly where a role involves handling cash, submitting or approving expenses, making payments or maintaining financial records.
Internal financial controls to reduce fraud risk
Appropriate internal financial controls can help prevent and detect fraud, protect charity funds and provide oversight of how money is received, held and spent. The controls adopted should reflect the charity’s size, structure, activities and particular risks, with arrangements reviewed periodically to ensure they remain appropriate.
Dual authorisation of payments
Requiring more than one person to authorise certain payments can reduce the risk of an individual being able to make or release transactions without appropriate oversight. The level at which dual authorisation applies should reflect the charity’s financial arrangements, delegated authorities and assessment of risk.
Financial approval matrices
A documented approval matrix can set out who has authority to approve different types and levels of expenditure. Approval limits should reflect delegated responsibilities and provide clarity about when additional or higher-level authorisation is required, helping to prevent expenditure being approved outside agreed authority.
Segregation of duties
Where practicable, different stages of a financial process should be divided between different people so that one individual does not control a transaction from beginning to end. This might include separating responsibility for initiating payments, authorising them, recording transactions and completing reconciliations. Where full segregation is not practical, particularly in smaller charities, alternative oversight or review arrangements should be considered.
Cash handling procedures
Where a charity receives or handles cash, documented procedures should cover how it is collected, counted, recorded, stored and banked. Appropriate controls might include involving more than one person in counting cash, retaining records of amounts received, completing reconciliations and limiting access to cash before it is banked. The arrangements should reflect the amount of cash handled and the circumstances in which it is received.
Payment verification and records
Payment processes should provide a clear record of what is being paid, why the payment is being made and who has authorised it. Supporting documentation, such as invoices or approved expense claims, should be retained where appropriate, with changes to supplier or payee details independently verified before payment is made.
Internal financial controls should also be reviewed periodically to confirm that they remain appropriate and are operating as intended. Changes in staffing, systems, banking arrangements, fundraising methods or the charity’s activities can create new risks or make existing controls less effective. Where weaknesses are identified, responsibilities and actions to address them should be clearly recorded and followed through.
External fraud risks facing charities
External fraud can take many forms, including attempts to divert payments, exploit online systems, impersonate a charity or obtain funds through false representations. The risks will vary according to the charity’s activities, fundraising methods, systems and relationships with donors, suppliers, grant applicants and other third parties.
Suspicious or unusual donations
Charities may receive donations that raise concerns because of their size, source, conditions or the circumstances in which they are offered. Appropriate due diligence can help a charity understand who a donor is, identify potential risks and make an informed decision about whether further enquiries or action are required. Unusual patterns, requests to return or redirect funds, or transactions that do not appear consistent with the charity’s activities may warrant closer scrutiny.
Cyber-enabled fraud
Fraudsters may use email, compromised accounts, fake websites or other digital methods to obtain money, credentials or sensitive information from a charity. Strong access controls, multi-factor authentication, secure systems and clear procedures for verifying unusual or unexpected requests can help reduce the risk of cyber-enabled fraud.
Fraudulent grant applications
Charities that award grants may be targeted through applications containing false or misleading information, including misrepresentation of an applicant’s identity, activities or intended use of funds. Proportionate checks before funding is approved, together with appropriate monitoring of how grants are used, can help identify inconsistencies and reduce the risk of charitable funds being obtained or used fraudulently.
Identity theft and charity impersonation
Criminals may impersonate a charity, its employees or representatives by copying branding, creating fake websites or social media accounts, or contacting donors and other organisations using false credentials. Clear arrangements for reporting suspected impersonation, monitoring the charity’s public-facing identity and responding promptly when concerns are identified can help limit the potential impact on the charity and its supporters.
Common fraud methods
Fraud methods continue to evolve, but many rely on familiar techniques such as impersonation, deception, compromised accounts or attempts to create a false sense of urgency. Understanding how these methods work can help staff, volunteers and trustees recognise warning signs and respond appropriately.
Phishing and social engineering
Phishing and social engineering attacks are designed to persuade people to disclose information, provide access, make payments or take other actions that benefit the fraudster. Messages may appear to come from a colleague, trustee, supplier or other trusted contact and often use urgency or authority to encourage the recipient to act without completing normal checks.
Ransomware attacks
Ransomware is a form of cyberattack in which criminals may encrypt systems or data and demand payment, sometimes alongside threats to publish or misuse information they have obtained. Although ransomware is a wider cyber-security risk rather than simply a form of fraud, charities should consider how measures such as secure backups, access controls, system updates and incident response arrangements form part of their wider resilience to financial crime and cyber threats.
Payment diversion fraud
Payment diversion fraud can occur when criminals impersonate suppliers, employees or other trusted contacts and provide false payment instructions or request changes to bank details. Requests to create or amend payment details should be independently verified using trusted contact information rather than relying solely on the information contained in the request itself.
Fraudulent fundraising
Fraudulent fundraising can involve individuals or organisations falsely claiming to collect money on behalf of a charity or using its name, branding or cause without authority. Charities should have clear arrangements for authorising fundraising activity and for responding to concerns about people or organisations claiming to fundraise on their behalf.
Awareness is an important part of fraud prevention, but it needs to be supported by appropriate procedures and controls. Staff, volunteers and trustees should understand the warning signs relevant to their roles, know how to verify unusual requests and know how and where to report concerns. Fraud risks and controls should also be reviewed as the charity’s activities, systems and external relationships change.
Implementing robust anti-fraud measures
An effective approach to fraud prevention starts with understanding the fraud risks relevant to the charity. A fraud risk assessment can consider where and how fraud might occur, who could be involved, the potential impact, and the controls already in place to prevent or detect it. The findings can then inform proportionate policies, procedures and further actions where weaknesses or gaps are identified.
Fraud awareness and training should be appropriate to the roles people perform and the risks they may encounter. Staff, volunteers and trustees should understand the fraud risks relevant to their responsibilities, recognise potential warning signs and know how to raise concerns through the charity’s reporting or whistleblowing arrangements.
Fraud controls should be reviewed and, where appropriate, tested to assess whether they are operating as intended and remain appropriate to the risks identified. Charities should also have arrangements for responding to suspected or actual fraud, including how concerns are escalated, who is responsible for coordinating the response, how evidence and records are preserved, and how any reporting obligations will be considered.
Responsibility for overseeing fraud risk and anti-fraud arrangements should be clearly allocated, with appropriate reporting and oversight by trustees or the relevant committee. Depending on the charity’s size and structure, operational responsibility may sit with an individual, a team or within an existing finance, risk or governance function. Policies, controls, reported concerns and agreed actions should be reviewed periodically so that weaknesses can be identified and improvements followed through.
Technology and fraud prevention
Technology can support fraud prevention, but the controls required will depend on the charity’s systems, activities and particular risks. Measures may include multi-factor authentication, appropriate access controls, secure payment arrangements, system updates and other cyber-security protections. Technical controls should form part of a wider approach that also includes appropriate procedures, oversight and staff awareness.
Depending on the charity’s systems and level of risk, monitoring tools may also help identify unusual activity or potential security incidents. The nature and sophistication of any monitoring should be proportionate to the organisation’s needs, with specialist technical advice obtained where appropriate.
Access to financial and other sensitive systems should be restricted according to role and reviewed when responsibilities change or individuals leave the organisation. Secure backups and appropriate recovery arrangements can also support organisational resilience if systems or data are compromised. The design and implementation of technical cyber-security controls should be supported by appropriately qualified specialists where necessary.
Money laundering and due diligence
Charities can be exposed to money laundering and other financial crime risks through donations, grants, investments, partnerships and other financial relationships. The nature and level of risk will vary between organisations, making proportionate due diligence and appropriate financial controls important parts of protecting charitable funds and assets.
Trustees should consider the risks associated with donations and other financial relationships and carry out proportionate due diligence where appropriate. This may include understanding who a donor or other party is, considering the source and circumstances of funds, and making further enquiries where something appears unusual or inconsistent with the charity’s activities. The level of due diligence required will depend on the circumstances and the risks identified.
Charities should have clear arrangements for escalating concerns about suspicious transactions or activity so that they can be considered by the appropriate person. Depending on the circumstances and the activities undertaken by the charity, specialist advice may be needed to determine whether a report to law enforcement, a regulator or another relevant body is required.
A proportionate, risk-based approach to due diligence can help charities identify concerns while avoiding unnecessary processes where the level of risk does not justify them. Clear responsibilities, documented procedures and appropriate escalation arrangements can also help ensure that concerns are considered consistently.
The failure to prevent fraud offence
The failure to prevent fraud offence under the Economic Crime and Corporate Transparency Act 2023 came into force on 1 September 2025. It applies to large organisations, including charities that meet the relevant size criteria, where an associated person commits a specified fraud offence intending to benefit the organisation or a person to whom the associated person provides services on the organisation’s behalf.
An organisation is generally within scope if it meets at least two of the following three criteria: more than 250 employees, more than £36 million turnover and more than £18 million in total assets. Specific rules also apply to parent undertakings and groups, so organisations forming part of a group structure should consider the relevant criteria on that basis. Smaller charities that do not meet the applicable criteria are not automatically subject to the offence, although the fraud prevention principles may still provide a useful framework when reviewing their own arrangements.
An organisation can have a defence where it had reasonable fraud prevention procedures in place to prevent the relevant fraud, or where it was reasonable in the circumstances not to have such procedures. What is reasonable will depend on the organisation’s particular circumstances and fraud risks, making a documented and proportionate approach to fraud prevention important.
Government guidance sets out six principles intended to inform an organisation’s approach to reasonable fraud prevention procedures:
Top-level commitment
Risk assessment
Proportionate risk-based prevention procedures
Due diligence
Communication (including training)
Monitoring and review
Charities within scope should consider the government guidance in the context of their own fraud risks and existing arrangements. This may involve reviewing the fraud risk assessment, identifying any gaps in existing policies and procedures, clarifying responsibilities, strengthening controls where appropriate, providing relevant training and establishing arrangements for monitoring and review.
Maintaining appropriate records can help an organisation evidence the approach it has taken to fraud prevention. This might include the fraud risk assessment, relevant policies and procedures, decisions about controls, due diligence undertaken where appropriate, training records, monitoring activity and actions arising from reviews. The nature and extent of the documentation should be proportionate to the organisation’s circumstances and the fraud risks identified.
How to instil a strong anti-fraud culture
A strong anti-fraud culture starts with leadership. Trustees and senior management should set clear expectations about ethical conduct, the proper use of charitable funds and the importance of raising concerns. Those expectations should be supported by appropriate policies, controls and consistent responses when concerns or weaknesses are identified.
Clear policies, procedures and codes of conduct can support this culture by setting expectations and explaining how concerns should be handled. These arrangements need to be communicated effectively and applied consistently so that staff, volunteers and trustees understand both the standards expected of them and the processes to follow when something does not appear right.
Training and awareness can help ensure that staff, volunteers and trustees understand the fraud risks relevant to their roles and know how to respond to concerns. This should include clear information about internal reporting and whistleblowing arrangements, supported by practical examples where appropriate and refreshed when risks, responsibilities or procedures change.
Charities should provide clear and accessible routes for raising concerns, with appropriate arrangements for confidentiality and, where available, anonymous reporting. Those raising concerns should understand how reports will be handled and escalated, and trustees and senior management should receive sufficient information to provide appropriate oversight of significant issues and emerging themes.
Practical support with fraud governance
Strengthening fraud governance can involve contributions from trustees, senior management, Finance, Risk, Compliance, IT and other specialist advisers. The practical challenge is often bringing that work together, maintaining clear documentation and ensuring that agreed actions are followed through.
Effective fraud governance brings together appropriate policies and procedures, financial and operational controls, training and awareness, reporting arrangements, clearly allocated responsibilities and ongoing monitoring and review. These arrangements should be proportionate to the charity’s activities and risks and kept under review as the organisation, its systems and the external threat environment change.
Corporate Assist's Compliance & Risk Support can provide practical additional capacity alongside your existing teams and specialist advisers. This might include coordinating fraud-risk and control reviews, bringing together information from different teams, supporting policy and procedure reviews, maintaining supporting records and action trackers, and following up agreed actions. Responsibility for determining the charity’s fraud risks, required controls and legal or regulatory obligations remains with the charity and its relevant risk owners and specialist advisers.
If your charity needs additional capacity to support fraud-risk, compliance or governance work, please get in touch to discuss your requirements.
Share this post: