Why Your Church Newsletter Doesn't Belong in Your Business Inbox

A client opened an email from his church asking for help. He clicked the link, filled out a form, and reset his password. Ten minutes later, a second email warned him it was fake. In this solo episode, Susan Finch walks through what happened next, what could have happened, and the one setup decision that kept it from reaching the rest of his firm. She talks about why church, school, shopping, and subscription sign-ups don't belong in a business inbox, why forwarding work email to a personal account causes trouble, and why outdated email programs need to go. She also makes the case for a written email policy that staff talk through, sign, and revisit once or twice a year. Listeners can download a free starter policy template with discussion questions built in.

Key Points

1. Trusted senders get spoofed. The fake email used the name and look of his own church, which is exactly why he clicked.
2. One login opens everything. In Google Workspace or Microsoft 365, the email password also opens Drive, OneDrive, shared folders, and client files.
3. Separate admin account matters. The firm's admin login was a different account, so the compromised inbox couldn't reach every other user.
4. Keep personal sign-ups out. Church, school, shopping, and subscriptions each keep a list that can leak your work address and who you trust.
5. No forwarding, no mixing. Forwarding to personal Gmail, or pulling one system into another, puts company mail where nobody controls it.
6. Write it, sign it, review it. A policy only works if staff understand it, sign it, and see it updated once or twice a year.