The Voice on the Phone

The first step toward conviction consists in inducing a suspension of disbelief. That is done by establishing an atmosphere in which the illusion will seem plausible.

— Henning Nelms, Magic and Showmanship (Dover, 1969)

This week:

How a South Dakota youth organization lost $200,000 to a cloned voice on the phone and what it got back,
Why Washington State's technology agency went and measured its nonprofits' cyber exposure and handed everyone else the template, and
The free expert help that already exists in twenty-eight states and that almost nobody claims.
Three quick hits on finding the sublimit that decides whether your cyber policy pays, pricing the Windows 10 machines you have quietly kept running, and the four questions to send your donor database vendor in writing.
Three AI prompts to build a callback rule your bookkeeper can actually use, write a data retention schedule, and map the first forty-eight hours after a breach against your own state's law.
Plus a 30-minute board exercise built on a single phone call.

On May 1, a staff member at a youth organization in Yankton, South Dakota noticed a second withdrawal attempt against a reserve account. The first one had already succeeded. Two hundred thousand dollars was gone.

Nobody picked a lock. No firewall failed. There was no ransomware note. Someone had used an AI-cloned voice and a spoofed phone number, and a person doing their job correctly had believed them.

That is the part worth sitting with. Almost every cybersecurity recommendation your organization has ever received is about hardening a system. This attack did not touch the system. It went around it, through the one component no software patch reaches — a human being on the phone, under time pressure, hearing a familiar voice.

I want to be careful here, because there is a version of this story that just makes you afraid, and fear is not useful to you on a Monday morning. This is not supposed to be the Nonprofit Scare You Newsletter. So this issue is built the other way around.

What follows is one organization that lost money and went public about it, one state that decided to go find out how exposed its nonprofits actually are, and a large amount of genuinely free expert help that has been sitting unclaimed. Then three things you can do this week, none of which require an IT budget.

A portion of every dollar you pay for this newsletter goes to Rooted, a Madison, Wisconsin nonprofit growing a community-led food system through urban farms, seventy-plus community gardens, and hands-on education. Rooted's work is the opposite of the story above — slow, patient infrastructure that holds because someone tends it before anything goes wrong. That is more or less the argument of this entire issue.

A Cloned Voice Took $200,000 From a South Dakota Youth Club. Going Public Is What Got Some of It Back.

The Boys & Girls Club of the Northern Plains runs the Yankton Club in Yankton, South Dakota. On May 1, 2026, the organization discovered that $200,000 had been taken in mid-April from a reserve account it used for building maintenance and emergency needs — the account a small organization keeps precisely so that a bad month is survivable.

The theft was discovered because the attackers came back. A second withdrawal attempt was flagged, and the first one unraveled from there.

The method, as the organization's chief executive described it publicly, was AI voice cloning combined with spoofed phone numbers and manipulated transaction details — what she called deepfake fraud. Attackers used it to obtain login credentials. The organization says authorities believe the operation was run from overseas.

Here is what makes this replicable, and it starts with a decision most organizations get wrong.

They called law enforcement immediately, not eventually. The Yankton Police Department opened an investigation and worked the case with the FBI. By August, according to the organization, the department had recovered $80,000 of the $200,000. Speed is the entire variable in these recoveries; the money moves through accounts on a clock measured in hours.

They went public quickly. The unauthorized transfer happened in mid-April, surfaced on May 1, and the organization was on the record with reporters by mid-May. A board member and the chief executive both spoke on the record to local outlets. That is an uncomfortable choice — the reflexive instinct is to fix it quietly and hope nobody notices — and it paid directly. The organization reports that a resident of Vermillion, South Dakota then donated $100,000 toward replacing the lost funds. Between the police recovery and that gift, $180,000 of the $200,000 was accounted for. Both figures come from the organization's own account, reported by a single local outlet in August; treat them as its telling rather than as independently confirmed.

They said out loud what their insurance would not tell them. The organization does carry cybersecurity insurance. Its chief executive told reporters it was not clear how much money the organization would receive. Read that sentence again if you have a cyber policy in a drawer somewhere.

The organization's announced remediation was ordinary and correct: updated internal security and policies, a contract with an outside IT firm, and investment in training and process review with outside cyber experts.

The reason this story leads the issue is not the theft. It is that the controls that would have stopped it cost nothing, which in fact is good news for you readers. A rule that says no transfer instruction is executed on the strength of a voice — not the CEO's voice, not the board chair's, not anyone's — until it is confirmed on a number you already had on file. That rule is free. It is also the single highest-value paragraph you could add to your financial procedures this month.

Sources: KYNT — Yankton club loses $200,000 in AI cyberattack; Dakota News Now — Boys & Girls Club lays out next steps; KYNT — cyberattack update, August 13, 2026

Washington's State Technology Agency Went and Measured Its Nonprofits. The Numbers Are the Argument.

In April 2026, the Center for Long-Term Cybersecurity at the University of California, Berkeley published CyberCAN Washington, produced in partnership with Washington Technology Solutions — the state's central technology and cybersecurity agency — and funded by Okta for Good, the philanthropic arm of the identity-security vendor Okta.

(That last detail is worth naming yourself if you cite this: the survey measures multi-factor authentication adoption, and multi-factor authentication is Okta's core business. The report discloses the funding, names no Okta product, and recommends none. But a reader who discovers the connection on their own will trust you less than one you told.)

The researchers surveyed 100 nonprofits across 21 of Washington's 39 counties. It is, as far as I can find, the most useful non-vendor picture of nonprofit cyber exposure available right now, and it is worth your attention mostly because of one number.

Seventy-nine percent of those organizations experienced at least one cyberattack in the previous three years.

Set that against what they had to meet it with. Sixty-four percent had no full-time IT staff at all — an average of one IT person for every ninety-six employees across the sample. Sixty-nine percent had no cybersecurity-specific budget, and average annual cybersecurity and IT spending came to $4,311.

Thirty-three percent had an incident response plan. Fifty-five percent did not, and 12% were unsure. On insurance the split is almost exactly even and considerably more unsettling: 39% carried cyber insurance, 39% did not, and 22% did not know.

Reported card, bank account, and gift card fraud losses ran from $200 to $300,000.

This is where the report stops being a survey and starts being an argument for you specifically. Organizations whose senior leadership was engaged in cybersecurity decisions allocated a cybersecurity budget at a rate of 52.3%. Where leadership was not engaged, that figure was 14.7%.

That is not a technology finding. That is a finding about executive directors and boards, and it says the single variable most associated with an organization funding its own defense is whether the person running it treats the question as theirs.

Here is what makes this replicable, and it is not the survey. It is the partnership. A state technology agency, a university research center, and a corporate funder built a regional baseline that no individual nonprofit could have produced and that every nonprofit in the state can now point to. CyberCAN Washington is the second in a series; the first covered San Francisco, published in November 2024 with the City and County of San Francisco. The methodology is portable by design.

If you are on the board of your state nonprofit association, this is a specific, fundable, unglamorous thing to put in front of your state's chief information officer. Somebody in Washington asked. That is the whole trick.

One honest caveat before you quote these numbers: the report does not state the months in which its survey was fielded. It was published in April 2026, but its publication date is not its collection date, and I could not establish the fieldwork window from the document. Cite it as an April 2026 publication and do not describe the figures as 2026 data.

Sources: CyberCAN Washington, Center for Long-Term Cybersecurity, UC Berkeley, April 2026 (PDF); CyberCAN San Francisco, November 2024

There Are Free Cybersecurity Clinics in Twenty-Eight States. Most Nonprofits Have Never Heard of Them.

In June 2025 UC Berkeley's Center for Long-Term Cybersecurity published The Roadmap to Community Cyber Defense, reporting from an initiative called the Cyber Resilience Corps. Buried in it is an inventory of help that already exists and is very largely unspent.

As of May 2025 there were roughly 3,900 cybersecurity volunteers across some fifty volunteering groups in the United States, collectively serving about 500 community organizations a year. Thirty-three university cybersecurity clinics operate across at least twenty-eight states, having trained more than 1,500 students and assisted more than 150 community organizations. Six states run operational cyber corps between them staffed by more than 900 volunteers: Louisiana, Maryland, Michigan, Ohio, Texas, and Wisconsin. New Jersey and Oklahoma are standing theirs up.

Separately, a foundation now called Protect.ngo — until June 2026 the CyberPeace Institute — runs a program now called The Builders, which delivers vetted expert cybersecurity work to nonprofits. Its core services are free; more resource-intensive work is offered at cost.

The organization reports serving 645 nonprofits in 2025 through more than 1,600 volunteer experts and over 1,500 completed missions. Those are its own figures and I found no independent audit of them. The Cybersecurity and Infrastructure Security Agency does list the program publicly as a service nonprofits can use, under its former name.

The gap between that supply and the demand documented in the Washington survey is the finding.

Two things make this the good-news story rather than a directory listing.

The first is the economics. The roadmap puts managed IT services at roughly $200 per user per month, and roughly $350 per user per month once security is included. It separately estimates $144,000 a year in managed IT and security services for a fifty-person organization. Free expert hours against that number are not a nice extra. For most organizations reading this, they are the difference between having a security posture and not having one.

The second is who these programs are not. The two federal cybersecurity grant programs aimed at this problem — the State and Local Cybersecurity Grant Program and its tribal counterpart — define eligible recipients as states and tribal governments, with most of the money passed through to local governments. Nonprofits are not eligible recipients. Congress reauthorized the state and local program in February 2026, but only through September 30, 2026, and without new funding.

The volunteer clinics and university programs grew up in the space that leaves. And the coverage is thin: at least twenty-two states have no local cybersecurity volunteering infrastructure of any kind — no state corps, no university clinic, nothing.

So this is genuinely good news with an asterisk. The help is real, it is free, and it is unevenly distributed — which means the first question is simply whether it exists where you are.

First steps, in order. Check whether your state runs a cyber corps or hosts a university cybersecurity clinic. Look at the volunteer matching platform at cybervolunteers.us. Then, separately, put your organization in front of The Builders, which is international and does not depend on your state having built anything.

Sources: The Roadmap to Community Cyber Defense, Center for Long-Term Cybersecurity, UC Berkeley, June 2025; The Builders 2025 annual report, Protect.ngo; CyberPeace Builders service listing, CISA

Find the Sublimit That Decides Whether Your Cyber Policy Pays

Most cyber liability policies treat a voluntary transfer — an employee tricked into sending money — very differently from a hacking loss. It is typically covered only by endorsement and capped under a small social engineering or funds transfer fraud sublimit sitting well below your headline limit — brokers report sublimits commonly running from $25,000 to $250,000 against policy limits of $1 million or more. This is why an organization can hold a real policy and still not know what it will collect.

Action: Pull the policy. Search the document for "social engineering," "funds transfer fraud," "fraudulent instruction," and "voluntary parting." Write down the sublimit next to each. Then email your broker one question: if an employee is deceived into authorizing a transfer, which coverage part responds and at what limit? Ask for the answer in writing.

ROI: The gap between a $1 million policy limit and a $25,000 social engineering sublimit is $975,000 of exposure you did not know you were carrying. Regulator data puts the stakes in perspective: in the 2024 data year the National Association of Insurance Commissioners reported 28,555 cyber claims closed without payment against 9,941 paid.

Time: 30 minutes, plus the broker's reply.

One useful piece of context if you are shopping: the NAIC report, citing broker data from Marsh rather than its own filings, notes that "cyber insurance rates in the U.S. declined an average of 5% in the fourth quarter of 2024, marking the first quarterly decrease following seven years of rising rates." Claims volume rose nearly 40% in that year while premium fell 7%. It is a better moment to buy than the last seven years have been.

Sources: NAIC Report on the Cybersecurity Insurance Market, 2025 edition, data year 2024 (PDF)

Count Your Windows 10 Machines and Put a Real Price on Them

Windows 10 reached end of support on October 14, 2025. If your organization still has machines running it — and many do, because replacing working hardware always loses to this year's program budget — you are either paying for extended security updates, or you are running unpatched.

Action: Walk your office and count. For organizations buying commercial Extended Security Updates, Microsoft prices them per device at $61 for year one, $122 for year two, and $244 for year three, with a three-year maximum. The pricing is cumulative — enroll late and you still pay for the earlier year. Year One coverage ends October 13, 2026, eight weeks after this issue lands, so if you are on the commercial track that is when the price doubles. There is also a consumer ESU path running through October 12, 2027, available at no cost by syncing PC settings, for 1,000 Microsoft Rewards points, or for a one-time $30, covering up to 10 devices; whether that route fits your organization is a question for whoever manages your licensing.

ROI: A nonprofit with 25 machines on the commercial track pays $1,525 in year one, $3,050 in year two, $6,100 in year three. That doubling is the actual argument for a replacement plan, and it is the number to put in front of your board rather than a vague warning about risk. Check Microsoft's nonprofit offers and TechSoup before you buy anything.

Time: 60 minutes to count and price.

Sources: Microsoft Learn — Windows 10 Extended Security Updates; Microsoft — Windows 10 ESU consumer program

Send Your Donor Database Vendor Four Questions in Writing

On July 29, 2026, Beacon — a donor CRM whose own materials say more than 1,000 UK charities use it — detected that database backups had been accessed using compromised credentials. Customers were told on August 3 and it became public on August 4. Beacon said it could not rule out that data had been downloaded, and told customers to assume everything in the platform was taken: names, addresses, emails, phone numbers, donation records including Gift Aid declarations, and stored attachments. Dates of birth were exposed at some charities and not others. Worth knowing what was not taken — the affected charities have been consistent that Beacon does not store payment card or bank details, so this was not a payment breach.

Named charities including Macmillan Cancer Support Jersey, Victim Support, UK-Med, and English National Ballet published notices to their supporters. The UK's Charity Commission moved to issue sector guidance.

The transferable lesson has nothing to do with British law. It is that your donor file lives on someone else's server, and when that server is breached your notification obligations start running on a clock you do not control.

Action: Email your CRM, payment processor, and email platform. Four questions. Within how many hours of detecting an incident will you notify us, and is that commitment in our contract? What categories of our data do you store, and for how long after we delete a record? Are backups encrypted, and who can access them? Will you tell us specifically which of our records were affected, or only that an incident occurred? File the answers with your insurance policy.

ROI: Your breach notification duty to your donors is yours regardless of whose system failed. Knowing the notification window in advance is the difference between a controlled disclosure and finding out from a news article.

Time: 45 minutes to write and send.

Sources: The Register — UK charities count the cost of the Beacon CRM cyberattack; Air Cadet Charity — Beacon cyber security incident notice; Civil Society — Commission plans guidance after Beacon breach

Write the Callback Rule That Would Have Stopped the Yankton Theft

The control that defeats a cloned voice is procedural, not technical, and it has to be written down before the call comes. It also has to survive the moment when the person on the phone is annoyed at being asked to verify.

Act as a nonprofit financial controls advisor. My organization is [organization name and URL], a [type] nonprofit with [number] staff and an annual budget of $[amount]. Our finance function is [describe — a full-time bookkeeper, a part-time contractor, the ED plus a treasurer, etc.]. Payments are currently authorized by [describe your current process]. Write a one-page payment verification procedure that our board can adopt at its next meeting, covering: (1) a hard rule that no transfer, banking change, or vendor payment detail change is executed on the basis of a phone call, voicemail, email, or text alone, regardless of who appears to be asking; (2) a callback requirement using contact numbers already on file, never a number supplied in the request itself; (3) a dollar threshold above which two people must approve, with a specific recommended threshold for an organization our size and the reasoning; (4) the exact script a staff member should use to slow down a request from someone claiming to be a senior leader, written so it does not feel insubordinate to say; (5) an explicit statement, signed by the executive director, that no staff member will ever be penalized for delaying a payment to verify it. Keep it to one page in plain language.

The fifth element is the one that actually does the work. Every social engineering attack runs on manufactured urgency and the reluctance of a junior person to question a senior one. A written promise that verification is never punished is what makes the rest of the procedure real.

Build the Data Retention and Deletion Schedule You Do Not Have

Just 45% of the nonprofits in the Washington survey had a formal data retention policy. Deletion is the only security control that reduces the cost of a breach to zero, because records you no longer hold cannot be stolen.

Act as a nonprofit data governance advisor. My organization is [organization name and URL], a [type] nonprofit. We hold the following categories of personal data: [list — e.g., donor names and giving history, client intake records, volunteer applications, employee files, email subscribers, event registrations]. Our main systems are [list your CRM, accounting, email, and file storage]. Some of this data includes sensitive identifiers: [note whether you hold Social Security numbers, financial account details, medical or health information, immigration status, or minors' records]. Build a one-page data retention and deletion schedule with a row for each data category showing: what we keep, the retention period, the legal or operational reason for that period, where it lives, who is responsible for deleting it, and the review frequency. Flag any category where we are likely holding data with no defensible reason. Then give me a prioritized ninety-day deletion plan starting with the highest-risk, lowest-value records, and tell me what to check before deleting anything so we do not destroy records subject to a grant, audit, or legal hold.

Run the output past your auditor and your attorney before you delete anything. The prompt is a drafting tool, not a legal opinion, and grant agreements frequently impose retention periods that override your preferences.

Map Your First Forty-Eight Hours Against Your Own State's Law

Every state has a breach notification statute, and unlike the broad state consumer-privacy laws — which mostly carry consumer-count thresholds high enough to exclude small organizations — breach notification laws generally have no size threshold. Which means they reach you.

Act as a privacy compliance advisor. My organization is [organization name and URL], a [type] nonprofit headquartered in [state], with clients, donors, or staff residing in these states: [list all states where the people in your records live]. We hold [describe the categories of personal information you store]. Produce: (1) a plain-language summary of the breach notification obligations in each state I have listed, including who must be notified, the deadline in days, whether the state attorney general must be told and at what victim threshold, and whether any credit monitoring or content requirements apply; (2) a first-48-hours checklist in chronological order, from discovery through containment, evidence preservation, counsel engagement, insurer notification, and notification drafting; (3) a list of the decisions that must be made by our executive director or board rather than by staff or an IT vendor; (4) a short list of the questions I should take to a licensed attorney in my state, flagging where the law is unsettled or fact-dependent. Note explicitly anywhere your answer may be out of date and tell me which primary source to check.

Treat the output as a map, not as advice. Breach notification law changes frequently and the specifics turn on facts. Point four of the prompt exists so you leave with a short list for a real lawyer rather than false confidence.

The Fifty-Thousand-Dollar Phone Call — A 30-Minute Board Exercise

Overview. Boards approve cybersecurity spending they do not understand and skip the one question they are actually qualified to answer: who in this organization can move money, and what would stop them from moving it to the wrong place? This exercise runs a single concrete scenario end to end. It requires no technical knowledge from anyone in the room, which is exactly why it works.

Materials. A whiteboard or shared screen. Your current check-signing and wire authorization policy, if you have one — and if you cannot find it in under five minutes, note that; it is the first finding. The treasurer or finance chair should be present. Do not invite the IT vendor. This is a governance question, not a technology question.

How to run it (30 minutes).

Read the scenario aloud (2 minutes). Tomorrow at 4:40 p.m. on a Friday, the bookkeeper receives a call. The voice is the executive director's — same cadence, same speech patterns. The caller ID shows the executive director's mobile number. The caller says a closing has moved up, needs $50,000 wired to a title company today, apologizes for the short notice, and says they are about to board a plane and will be unreachable. The wire instructions arrive by email moments later from what appears to be the executive director's address.
Trace the money (8 minutes). Walk the actual path, step by step, with the people who do the work. Who receives the request? Who can initiate a wire at your bank — name the individuals, not the roles. Who approves it? Does your bank require a second approver, and does anyone in the room know for certain? At what dollar amount, if any, does something different happen? Write each step on the board.
Find the stopping point (10 minutes). Go back through the chain and ask at each step: what here would have stopped this? Not what should have. What would have, on a Friday at 4:40, with the executive director apparently unreachable. Be honest about the answer. Most organizations discover the only real control is one person's willingness to be inconvenient.
Write the rule (7 minutes). Draft one sentence the board can adopt at this meeting. Something close to: no transfer, banking change, or payment detail change is executed on the basis of a call, email, or text alone, regardless of the apparent sender, until confirmed by callback to a number already on file. Set a dual-approval dollar threshold. Assign a person and a date for updating the written policy.
Close the loop (3 minutes). Two assignments. Someone confirms with the bank in writing what controls actually exist on your accounts. Someone locates the cyber policy and finds the social engineering sublimit. Both report at the next meeting.

Watch out for: Two failure modes. The first is the board treating this as a test of the bookkeeper's judgment — say clearly at the start that the scenario is designed to defeat good judgment, and that anyone can be taken by it. The second is the room drifting into general IT talk. If someone raises passwords or antivirus, park it. The exercise only produces value if it stays on the money path.

You'll know it worked when: Somebody in your organization delays a payment to make a verification call, and nobody apologizes for it.

This is the finding I keep coming back to: engaged leadership tracked with funding a defense at 52.3% against 14.7%. The gap is not knowledge. It is ownership.

So take the smallest piece. Find the sublimit in your policy, or write the callback rule, or send the four questions to your CRM vendor. Any one of them is thirty to forty-five minutes, and any one of them is more than most organizations will do this month.

The phone is going to ring eventually. The only question is whether anyone has already decided what happens next.

See you next week.

— Ted

P.S. Thanks again for supporting Rooted with your subscription.

P.P.S. You'll note that I've been playing with the graphics. Reader feedback tells me that I should go with the line graphics I have used in the past rather than the alternative forms I used in issues 39 and 40. I would love additional feedback on all elements of this newsletter since it is still a baby in its first year of publication. For instance, do you read a version of the newsletter with the graphics rendered or not? If they are not rendered in your email window, do the titles for the graphics that I provide help you understand what's coming? Of course the most basic one: Do you have any ideas for future topics that I should explore in this newsletter?