There is no better week to run a scam against a school community than the first one. Families are expecting a flood of email. Staff are onboarding, resetting passwords, and learning new systems. Forms, fees, supply lists, and portal invitations are all landing at once — every single one of them asking someone to click a link or enter a payment. Attackers don't need to be clever in that environment. They just need to blend in.
What makes schools distinctly vulnerable is that your attack surface includes people who don't work for you. A parent tricked into paying a fake tuition invoice lost their money to a scam wearing your school's name — and the trust damage lands on you regardless of where the fault sits.
The four that show up every August
- The fee or tuition invoice. A convincing message about registration fees, lunch accounts, or activity payments, pointing to a payment page that isn't yours.
- The head of school request. An urgent note that appears to come from your principal or business manager, asking a staff member to buy gift cards or move a payment quietly and quickly.
- The vendor banking change. A "new remittance details" email from a real supplier — bus company, food service, technology vendor — arriving right as invoices start flowing.
- The portal login page. A pixel-perfect copy of your student information system or email login, harvesting credentials from staff and parents who type them without a second thought.
What to do before the flood — and during it
Most of the defense is communication, not technology:
- Tell parents in advance what you will and won't do. One clear note before school starts — "we will never email you a link asking for immediate payment; here is the only portal address; here is the number to call to verify" — makes every imitation obvious.
- Publish one payment path and stick to it. Consistency is a security control: when families always pay the same way, anything different is a signal.
- Require verbal verification for money movement. Any request to change banking details or send funds gets confirmed by phone on a known number — no exceptions for urgency, especially when it appears to come from leadership.
- Brief staff before the first institute day, while attention is high and the year hasn't buried them. Ten minutes and four real examples beats an annual training module nobody remembers in October.
- Make reporting frictionless and blameless. A staff member or parent who forwards something suspicious in five minutes turns an incident into a non-event.
The technical backstop
Communication reduces clicks; it never eliminates them. Advanced email filtering that catches impersonation before it reaches an inbox, MFA on every staff account so a harvested password isn't enough, and correct email authentication records so attackers can't easily spoof your own domain — those are what stand between a click and a bad week. They also pair with the account reconciliation we covered in July: old accounts are exactly what attackers use to send convincing mail from inside your community.
Send the "here's what we'll never ask you to do" note to families this week, and give staff ten minutes on the four scams above at your next meeting. Both are free and both work. Our free school IT assessment also reviews your email protections and domain authentication — findings are yours either way.
Your community is at its most trusting and most distracted in the same seven days. Spend a little of that week telling them exactly what to expect from you, and the imitations stop working.
Andrew — Founder, NextGen Strategy Partners
Veteran-owned managed IT for the nonprofits, schools, behavioral health providers, and medical & dental practices of McHenry & Lake Counties. Request a free security assessment →