Phishing and bank detail fraud: how to protect the school office

October is European Cybersecurity Month, coordinated in Spain by the National Cybersecurity Institute (INCIBE). The figures explain why it is worth giving it some time in the school office: INCIBE handled 122,223 incidents in 2025, 26% more than the year before. Online fraud was the main threat, with 45,445 cases, four in ten, and phishing the most frequent technique, with 25,133. Its free helpline, 017, answered 142,767 queries, 44.9% more.

A school, a nursery or an academy is an attractive target for a practical reason: money passes through the office every month, in both directions, and messages arrive from many different senders. This article goes through the frauds most often seen in that context and the measures that stop them without needing an IT department.

The frauds that reach a school

• The supplier's change of account. An email arrives from the caterer, the transport company or the publisher saying it has changed banks. Sometimes it comes from a domain almost identical to the real one, and sometimes from the supplier's genuine account, which has been stolen. If the IBAN is updated without checking, the next payment vanishes.
• The fake head. An urgent message that seems to come from the owner or the head asks for a transfer, the purchase of gift cards or a "confidential" payment. It is known as CEO fraud and relies on haste and hierarchy.
• The invoice nobody ordered. Invoices for services never contracted, such as a listing in a supposed directory or a domain renewal, sent in the hope that they will be paid without review.
• Credential theft. A page that imitates the email or platform login asks for a username and password. With that access, the attacker sends the frauds above from a real school account.
• Impersonating the school to families. Text messages that claim to come from the school, warn of a returned receipt and include a link to pay. The family does not suspect anything because it expects receipts from the school.

The rule that stops almost everything: check through another channel

Most of these frauds fall to a single habit: any request that moves money or changes bank details is confirmed through a different channel from the one it came through. In practice:

1. Supplier IBAN changes: confirm them by calling a number already in your records, never the one in the message, and speaking to someone you know.
2. Double approval: two people at the school validate any change of bank details and any unusual payment.
3. Change log: who changed the detail, when and how it was verified. If something goes wrong, that log is the first thing the bank will ask for.
4. No exceptions for urgency: if the head asks for something urgent by email, it is confirmed by phone or in person. Agreeing this in advance means that checking never looks like distrust.

Technical measures any school can take

• Two-factor authentication on email and on the management platform. It is the measure that does most to prevent account theft.
• A protected own domain: ask whoever manages your email to set up SPF, DKIM and DMARC records, which make it harder for others to send email pretending to be your domain.
• External sender warnings: many email services can flag messages from outside the organisation, which helps spot a fake head.
• Different passwords and a password manager, especially for office and administration accounts.
• Short, repeated training: INCIBE offers free materials on phishing, smishing and vishing. Fifteen minutes at a staff meeting is worth more than one course a year.

Families are targets too

Families cannot know how the school collects payments if nobody has told them. A notice at the start of the year, through the official channel, saves a lot of trouble:

• How the school collects payments: by direct debit, through the app or at the office, and never through a link in a text message.
• What it will never ask for: passwords, verification codes or card details by message.
• Where to check: in the school app or by calling the office.

The more payments and notices are concentrated in a single official channel, the easier it is for a family to recognise a message that does not fit. That is why informal messaging groups are an added risk, as we explain in parent WhatsApp groups.

If the fraud has already happened

1. Call the bank immediately. The sooner you ask for a transfer to be held or returned, the better the chance of recovering it.
2. Change the passwords of the affected accounts and close open sessions.
3. Report it to the police and keep the emails and receipts.
4. Ask 017 for guidance, INCIBE's free helpline.
5. Assess whether there is a personal data breach. If the attacker accessed email or the platform with family or student data, the school may have to notify the AEPD within 72 hours. We explain it, with the rest of the response plan, in the incident response plan.

Conclusion

The phishing that reaches a school is rarely sophisticated: it works because it arrives at a busy moment and reaches a person who is allowed to pay. Confirming any change of account through another channel, requiring two approvals, turning on two-factor authentication and telling families how the school collects payments removes most of the risk at no cost.

If you want payments from families to always go through a known channel, with SEPA direct debit and the receipt visible to the family in the app, see Edena's invoicing or book a demo.