Threat Intelligence Directory
Social Engineering

Fake Disaster Relief Charity Scam

Attack Trigger

Exploits genuine compassion following high-profile natural disasters or tragedies

What Attackers Want

$50–$500 per donation, aggregated across many victims

How This Attack Works

Scammers register lookalike charity domains and send solicitation emails immediately after major disasters or news events. Donations go directly to criminals, not victims. Some campaigns impersonate well-known charities like the Red Cross.

Red Flags to Watch For

  • Charity name is a slight variation of a well-known organization
  • Donation link goes to a non-charity.org domain
  • Requests payment via wire transfer, Zelle, or cryptocurrency
  • No EIN or charity registration number is provided

Known Malicious Domains

These domains have been associated with this attack. Never click links going to these addresses.

  • disaster-relief-fund.comMALICIOUS
  • emergency-charity-donate.netMALICIOUS
  • relief-fund-now.comMALICIOUS

Glance automatically blocks emails from domains on this list. Domain list is not exhaustive — attackers register new domains continuously.

How Glance Stops This

  • Domain similarity analysis catches lookalike sender addresses at millisecond speed
  • SPF / DKIM / DMARC validation flags authentication failures before you ever see the email
  • VirusTotal + Google Safe Browsing checks every link in real time
  • Urgency language detection scores the email higher for manual review
  • Known malicious domain blocklist updated continuously from live scan data

Don't wait to get hit.

Glance scans every incoming email against 12 detection layers — including the exact tactics described above — before it reaches your inbox.

Protect My Inbox — Free