Fraud and the collection plate: the new 'failure to prevent fraud' offence and what it means for faith charities

Faith-based charities run on trust — and on a lot of money that passes through many hands. Friday and Sunday collections, Zakat and sadaqah, Gift Aid, legacies, and funds sent to projects overseas all make faith charities a target for fraud, and fraudsters now have AI to help them — convincing phishing emails, fake invoices and even cloned voices. At the same time, a new law has raised the bar on prevention: the corporate "failure to prevent fraud" offence. This article explains who the offence actually catches, who it doesn't, and the fraud-prevention basics that matter for every faith charity. It is general information, not advice.

Who the new offence actually catches

The offence, under the Economic Crime and Corporate Transparency Act 2023, has been in force since 1 September 2025. It makes a large organisation criminally liable — with an unlimited fine — if someone associated with it (an employee, agent or subsidiary) commits fraud intended to benefit the organisation, and the organisation did not have reasonable fraud prevention procedures in place. Senior managers don't need to have known.

The crucial word is large. An organisation is only directly in scope if it meets at least two of these three tests (counting subsidiaries): turnover over £36 million, total assets over £18 million, or more than 250 employees. The honest position for most faith charities is therefore simple: you are almost certainly below the threshold and not directly liable. The offence bites large incorporated bodies — a handful of big national faith charities and federations, not a typical parish, mosque, gurdwara or temple.

So why mention it at all? Two reasons:

• A few faith charities are large enough — and if that's you (including across a group), you need reasonable procedures and a documented risk assessment now.
• The "reasonable procedures" the law expects are just good fraud prevention — and preventing fraud, and protecting the charity's funds, is already a core trustee duty for charities of every size.

The bigger risk for most charities: being defrauded

For the great majority, the real issue isn't prosecution — it's being the victim. The Charity Commission's own casework on fraud and financial abuse has been rising. The common threats faith charities face:

• Impersonation and invoice fraud — a fake email (or now an AI-cloned voice) from a "supplier," "trustee" or "CEO" asking for a payment or a change of bank details.
• Mandate fraud — a request to change the bank details you pay into; pay out, and the money is gone.
• Phishing and cyber — stolen logins leading to diverted funds (this connects to protecting your data and the ICO).
• Insider fraud and cash skimming — the reason cash collections need more than one trusted pair of hands.

The six principles, in plain English

The Home Office guidance sets out six principles for reasonable procedures. They scale down neatly for a small charity:

1. Top-level commitment — trustees take fraud seriously and say so.
2. Risk assessment — know where your money is most exposed.
3. Proportionate procedures — controls that match the risk, not a 50-page manual.
4. Due diligence — on suppliers and partners, especially overseas ones.
5. Communication and training — so staff and volunteers know the warning signs.
6. Monitoring and review — check it's working. And document any decision not to do something — including who made it.

What this means at the collection plate

A few faith-specific basics prevent most of the harm:

• Cash collections: count with two people, record the amount, and bank it promptly. Never let one person handle a collection start to finish alone. (See managing cash collections.)
• Zakat, sadaqah and restricted funds: keep clear records that the money reached its proper purpose — good stewardship and good fraud control at once.
• Overseas transfers: use traceable channels and proper due diligence before money moves.
• The AI twist — verify, don't trust: if you get a request to change bank details or make an urgent payment, confirm it by a second channel (a phone call to a known number), even if the email or voice sounds exactly right. A convincing message is no longer proof of anything. Keep a human check on anything that moves money.

What to do now

• Check whether you're a "large" organisation (two of the three tests, including subsidiaries). If so, take advice and document a fraud risk assessment.
• Whatever your size, write down your fraud risks and the simple controls that address them.
• Put a "second channel" rule in place for any payment or bank-detail change.
• Brief trustees, staff and volunteers on impersonation and AI-enabled scams.

Fraud prevention isn't about distrust — it's about protecting the people's money you hold in trust, so it reaches the cause it was given for.

---

This article is general information, not advice. Whether the offence applies to your charity depends on its structure and size, and fraud prevention depends on your circumstances. Check the legislation and the Home Office guidance, and if you'd like help with a proportionate fraud risk assessment and controls, talk to us.