UtilForge.org is a digital inclusion organisation offering free cybersecurity and online safety tools and guides. A 2026 Champion of Cybersecurity Awareness Month. What you check stays on your phone or computer.

For charities, non-governmental organisations and civil society

Protect the people you serve, and the trust they give you.

For charities, non-governmental organisations (NGOs), community groups, faith groups, mutual aid networks, and the staff and volunteers who run them. Free checks for donations, payments, and documents about the people you work with.

See the free toolsWho it’s for: every guide

Who this is for

Charities and community organisations hold some of the most personal details anyone keeps: the names, addresses, case notes, health details and identity documents of beneficiaries and the communities they serve, alongside donors’ trust and grant money. Much of the work happens on volunteers’ own phones. This guide covers the risks that come with that trust, and the free checks for each.

The risks you meet most, and the check for each.

  1. Lookalike donation pages that use your name

    An appeal is copied, given a lookalike web address and shared in messages. Publish one real donation address on your own website, list your official accounts, and tell supporters you will never ask for gift cards, cryptocurrency or a transfer to a new account.

    After Hurricane Melissa in October 2025, the Jamaica Cyber Incident Response Team flagged eight lookalike donation websites and told donors that the only government portal is supportjamaica.gov.jm, to be typed directly (Office of the Prime Minister, Jamaica, 31 October 2025).

    Source: Office of the Prime Minister, Jamaica: Jamaica Cyber Incident Response Team warning, 31 October 2025

    The check: show supporters Shop check, which looks for lookalike addresses on their own phone.

  2. Grant and supplier payments redirected by email

    A message from a familiar supplier or partner gives new bank details, or a “director” asks finance to make an urgent transfer. Confirm any change of bank details by phone, on a number you already have.

    The Federal Bureau of Investigation’s Internet Crime Complaint Center counted 24,768 complaints of business email compromise in 2025, with reported losses of about US$3.05 billion. It describes the crime as targeting businesses and people who work with suppliers and make wire transfers.

    Source: Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 Internet Crime Report

    The check: one rule for any request for money and the Gift card request check.

  3. Beneficiary details pasted into artificial intelligence

    A caseworker asks a chatbot to tidy a referral letter, a funding report or a case summary, and the beneficiary’s name, address and story go with it to the company that runs the chatbot.

    The check: Hide Names from artificial intelligence swaps names and numbers for labels first, and puts them back into the reply on your device.

  4. Photos that carry the exact location

    A photo from a project, a shelter or a family’s home can carry the exact place it was taken, hidden inside the file. Take the location out before a photo goes on social media or into a report.

    The check: Remove photo location.

  5. Reports and case files shared with more inside them

    A report to a funder, a response to a records request or a case file sent to a partner can carry tracked changes, comments, hidden sheets and words still readable under black boxes.

    The check: Release Check and Redaction Studio.

  6. Volunteers’ own phones and shared logins

    One shared password for the organisation’s social media or email, used on many personal phones, is the easiest door in. Give each person their own login where the service allows it, and turn on two-step login.

    In February 2022 Google reported that accounts it had switched to two-step sign-in by default, more than 150 million of them, saw 50 per cent fewer hijackings.

    Source: TechTarget, report on Google’s two-step sign-in results, February 2022

    The check: turn on two-step login and the Password Habits Check.

The free tools that fit.

Every one is free, runs on your own phone or computer, and keeps working with the internet off once the page has loaded.

Guides to read next.

Free help for small teams · checked 26 October 2026

Strong protection without an enterprise budget.

The Cybersecurity and Infrastructure Security Agency, the United States government’s cyber defence agency, names civil society, non-profit organisations, journalists and human rights defenders as groups at higher risk of being targeted because of who they are or the work they do. These free resources come from that agency and the organisations it lists:

  • Cybersecurity resources for high-risk communities. The agency’s own list of free tools, helplines and guides for civil society, including Mitigating Cyber Threats with Limited Resources. cisa.gov
  • Practice for a bad day. The agency’s free Tabletop Exercise Packages let a team talk through an attack, step by step, before one happens. cisa.gov
  • Free weekly scanning of your internet-facing systems. The agency’s Cyber Hygiene Services are open to United States public bodies and critical infrastructure organisations, and organisations elsewhere can ask its international affairs team. cisa.gov
  • Help when something has already gone wrong. Access Now’s Digital Security Helpline and the Digital First Aid Kit from CiviCERT, a network of rapid-response teams, both appear on the agency’s list.
  • Protection for your website. Cloudflare’s free Project Galileo protects public-interest websites from attacks.

Giving season

Before supporters give, tell them where to give.

In 2025 people in the United States gave US$4.0 billion on GivingTuesday, from 19.1 million donors (GivingTuesday, 2025 results). Supporters can find a charity on its country’s official register, such as the Charity Commission’s register for England and Wales or the Australian Charities and Not-for-profits Commission’s register, and give from the register’s link. A line on your own website that says “we only take donations here” makes that check possible.

What the tools cannot do.

  • Taking out the names does not always make a person anonymous. A rare situation, a date and a town can still point to one person, so read what you paste.
  • The tools do not make an organisation compliant with data protection law. They make specific mistakes less likely.
  • No tool can take down a copy of your appeal. Report a lookalike page to the company the address is registered with, and to the platform where it is shared.

The pack that fits

Artificial Intelligence Tools for Work. $119, one payment.

Artificial Intelligence Tools for Work

$119

One payment · a team of up to ten in one organisation

An artificial intelligence use policy in United Kingdom, European Union and United States versions, staff training with a quiz and a training record, Release Check (full version), Redaction Studio and 21 more tools arranged by team. Twelve months of updates and a fourteen-day refund.

See Artificial Intelligence Tools for Work

Prices are in United States dollars, paid once, with no subscription. Gumroad, the shop that handles payment, shows the total, including any tax, before you pay. Registered charities and non-profit organisations with up to ten people can ask for it at half price or less: write to support@utilforge.org, and see reduced prices. Every purchase can be refunded in full within fourteen days.

Sources and dates.

Facts on this page were checked against these sources on 24 October 2026. Reported losses count only what people reported, so real harm is larger.