The call sounds exactly right. The rabbi’s voice, the cadence, the little verbal habits everyone knows from Shabbat drashot. There is an emergency, the voice says. A family in the congregation needs help tonight. Could you please send gift cards right away? 

Congregants at synagogues in multiple states have received versions of that call over the past year. Every one of them was fake. Voice-cloning tools that once required studio equipment now need 30 seconds of audio pulled from a public sermon recording and a few dollars a month.

Adobe Stock

Illustrative.

I write about AI and cybersecurity from Israel, and the gap I keep running into is this: the technology producing convincing fake voices, faces and emails went mainstream, while the security practices of most Jewish institutions did not move at all. The people running our federations, synagogues, schools and camps are facing adversaries with industrial-grade tools, and they are defending themselves with advice written for a threat that no longer exists.

The threat is not hypothetical. The Secure Community Network documented 190 cyberattacks against synagogues and Jewish organizations across 16 states between January and mid-April of this year alone, a tally cybersecurity experts laid out in these pages. Phishing, fraud, data exposure, doxxing. The criminals are not only after money. Some campaigns harvest membership lists and donor records to map who in the community can be targeted next.

The fakes are getting harder to spot. Israeli security researchers have tracked online campaigns built on fabricated outrage and invented victims for years, and the same machinery now powers scams aimed directly at Jewish donors: fake charity sites after every disaster, AI-written appeals that mirror the language of real organizations, and manipulated video. In May, Israel’s National Cyber Directorate flagged deepfake videos of Chief Rabbi David Yosef apparently endorsing a medical product he had never seen. If the chief rabbi can be convincingly faked from a public clip, so can your executive director from last month’s federation gala.

What actually works? I put that question to security practitioners in Israel, where defending civilian institutions against sophisticated adversaries is a national specialty. Their answers were strikingly unglamorous.

Kill the assumption that voice proves identity

First, no financial request, credential change or sensitive data transfer happens on the strength of a call or video alone, no matter who appears to be asking. Call back on a known number. This costs nothing and defeats most voice-clone scams instantly.

Treat email as hostile until verified

Second, AI writes flawless, personalized phishing now, free of the grammar errors people were trained to spot. An email from your board president asking for a wire transfer gets the same callback treatment as the phone call. Multi-factor authentication on every account, especially email, blocks the majority of account takeovers even when a password is stolen.

Rehearse the human moment

Third, the Israeli approach to institutional security runs on drills, not documents. Run one tabletop exercise: the executive director’s email asks finance staff to move funds Friday afternoon before a deadline. Do staff verify? Who calls whom? A community that has practiced saying no politely is a community a scammer cannot script against.

Small does not mean safe

Fourth, security experts repeatedly note that attackers look for the path of least resistance, and smaller organizations with older systems and thinner training get hit precisely because they assume they are beneath notice. The hostage-taking of a small congregation’s donor database is just as damaging to that congregation as a larger breach would be to a federation.

There is a positive here worth naming: The same country that built a civilian cyber defense ecosystem out of necessity, and whose technology sector now underpins security tools used far beyond its borders, has made much of this expertise publicly accessible. Israeli-developed threat intelligence, training curricula and hardened communications tools are within reach of a mid-sized federation’s budget. A closer look at Israel’s technology sector shows how much of the world’s defensive capability now flows from institutions built to protect a small, persistently targeted society.

Jewish organizations have rewritten their physical security playbooks since Oct. 7, 2023. The digital playbook needs the same urgency, the same budget line and the same assumption that someone is actively planning for the next attempt. Because someone is.

Mark Ginsberg writes about AI, cybersecurity and Israel. His work has appeared in The Times of Israel and WGI World.