Donor safety
We take the security of our donors seriously. This page sets out how we communicate with you, what we will and won’t ask for, and how to report anything that doesn’t look right.
If you take one thing from this page
If something feels off, write to [email protected] before acting on it. We would much rather answer a question that turns out to be nothing than have a donor lose money or data to someone impersonating us.
How we will contact you
All legitimate email from EAA comes from one of the domains we own. Watch for addresses that look almost identical but aren’t ours.
We will never send you a link to another company’s website asking you to enter donation details, payment information, login details or personal information.
Email addresses we commonly use
- [email protected]Receipts and donation queries
- [email protected]General correspondence
- [email protected]Security notifications and reports
- [email protected]Direct emails from our staff
How we will never contact you
If someone contacting you does any of the following, please assume they aren’t from EAA and report it to [email protected].
Pressure you into a last-minute or “urgent” donation in a one-on-one conversation, whether by email, phone, video call or text. Legitimate giving decisions are never so time-critical that you should skip your usual care.
Ask for your credit card number, online banking login, password or verification codes over email, phone or text message.
Ask you to pay us in gift cards, cryptocurrency or by wire transfer to an individual.
Ask for donations over WhatsApp, Telegram, Signal or direct messages on social media. Our fundraising happens through our website and our official email channels.
Threaten you, claim you owe us money or warn that your “donor account” will be closed unless you act immediately.
A note on card details
The one place we collect card information is the donation form on our website. Before entering card details anywhere, check that your browser’s address bar shows one of these:
Checking a message is really from us
Four quick checks catch most impersonation attempts. If something still feels off, write to [email protected]. We will reply within 2 business days, and usually much faster.
-
Look at the full sender address
Not just the display name. Display names are easy to fake; the part after the @ is much harder to fake convincingly.
-
Hover over links before clicking
On a computer, hover; on a phone, press and hold. This shows where a link actually leads, because the visible text and the real destination can differ.
-
Watch for urgency, secrecy or unusual payment methods
These are the most common signs of a scam.
-
When in doubt, type our address yourself
Enter eaa.org.au or effectivealtruism.org.au into your browser rather than clicking a link in a message.
Reporting a suspicious message
If you receive an email, call, text or social media message you believe is impersonating EAA, forward it or describe it to [email protected].
You won’t be wasting our time. Reports from donors are one of the main ways we learn about scams targeting our community, and they help us warn others.
Helpful details to include
The sender’s name, email address, phone number or username: whatever you have.
The date and time you received it.
The full message, including any links. Please don’t click them.
Whether the message had any attachments. Please mention them, but don’t open them.
Payments, privacy and how we reach you
Donations and payment processing
Donations through our website are processed by Stripe, a well-established payment provider. We do not store full credit card numbers on our own systems. Tax-deductible receipts are issued from an @eaa.org.au address.
If you ever see a charge you don’t recognise, or your bank flags a transaction, contact [email protected] promptly so we can investigate.
Your personal information
We collect only the information needed to process your donation, issue receipts, comply with Australian tax law and, with your permission, keep you updated on our work. We do not sell or rent donor information to third parties.
Read our full privacy policy.
Phone calls, texts and social media
If we phone you, it will generally be in response to something you’ve raised, or as a courtesy to a major donor. We won’t cold-call asking for donations, and we won’t ask for payment details over the phone.
Our official social media accounts are linked from our website. Accounts that look similar but aren’t linked from our website are not ours, even if they use our name and logo.
AI-generated voices and videos
It is now possible to convincingly mimic a person’s voice or appearance using AI. If you receive a voicemail, video or live call that sounds like our staff but asks for something unusual, such as money, gift cards or login details, hang up and reach us through a channel you already trust.
If you think you’ve been scammed
If you’ve shared payment details, login details or money with someone impersonating EAA, take these steps as soon as you can.
-
Contact your bank immediately to flag the transaction and protect your accounts.
-
Change any passwords that may have been exposed, and turn on two-factor authentication where you can. This extra login step, usually a code sent to your phone, makes it much harder for anyone to get into your accounts.
-
Report it to Scamwatch and, if money has been lost, to ReportCyber.
-
Let us know at [email protected] so we can investigate and warn other donors.
We won’t judge. This happens to careful, thoughtful people every day, and the sooner you act, the more options you have.
Reporting a vulnerability
For security researchers and anyone who spots a problem with our website or systems.
If you believe you’ve found a vulnerability in our website or systems, we’d like to hear from you. Send details to [email protected]. We’ll acknowledge your report within a few business days and work with you in good faith to address the issue.
We ask that you don’t access donor data, disrupt our services or publicly disclose the issue before we’ve had a reasonable chance to respond. As a charity with limited operational funds, we are not able to offer rewards for vulnerability reports.
Still not sure about a message?
Ask us first. A quick email is the surest way to know a request is real, and we’d genuinely rather hear from you.