Most parents read their inbox the way they read the mail. Quickly, between other things, with half an eye on the clock. That is exactly what scammers count on.
A message lands saying your child’s field trip payment failed. Or the office needs an updated emergency contact form today. Or the sports club is collecting for new uniforms and the deadline is tonight. The logo looks right. The sender name says the school. The tone is polite and a little urgent, and there is a link.
This is not a rare problem. The FBI’s Internet Crime Complaint Center took 191,561 phishing and spoofing reports in 2025, more than any other kind of cybercrime it tracks. Schools are squarely in that mix, and the reason is simple. The subject line involves your child, so you open it.
Why the school’s name is worth stealing
Parents are used to being asked for money and documents by schools. Registration fees, lunch accounts, permission slips, photo orders, fundraising drives, medical forms. One more request does not feel strange, because it is normal.
Schools are also a soft target. Research published by the Center for Internet Security with the Consortium for School Networking found that 82 percent of K-12 schools studied had a cyber incident between July 2023 and December 2024, and that attackers are increasingly going after people rather than systems. Impersonating a trusted staff member is cheaper than breaking into anything.
The goal is usually one of three things. A payment sent to the wrong account. A password typed into a fake login page. Or details about a child that get used later.
What a fake usually looks like
The best fakes are boring. They do not shout. A few patterns come up again and again.
The sender name reads correctly but the real address does not match the school’s domain. Something like “Lincoln Elementary Office” sitting on top of an address at a free mail provider, or a domain with one extra letter in it. When a message arrives from what looks like the exact school address, one common reason is that the school has not set up the protection that would have blocked it, which is worth checking and easy to fix.
There is a deadline. Today, by end of day, before your child loses their spot. Pressure is the tool that stops people from checking.
The request is off procedure. Your school has never asked for a bank transfer by email before. The nurse has never emailed asking for your child’s date of birth and home address in a reply.
The link text and the destination do not match. The words say the school portal. The real address, visible when you hover on a computer or press and hold on a phone, goes somewhere else.
Attachments arrive that should not exist. A permission slip that asks you to sign in before you can read it is not a permission slip.
Checks that take five seconds
You do not need technical skill to catch most of these.
Read the full email address, not the display name. On a phone, tap the sender to expand it.
Hover over links before you tap. If the destination looks nothing like the organization, stop there.
Do not use the contact details inside the message. If it tells you to call the office, look the number up yourself from a bookmark or an old newsletter.
Ask your child. They usually know whether a trip, a fee or an event is real before you do.
When money is involved, verify through a second channel every single time. One phone call to a number you already had ends almost every version of this scam.
Check whether your school’s name can be faked
Now the part most families never hear about. Organizations can stop criminals from sending email that appears to come from their own address. The protection is called DMARC. It tells receiving mail providers what to do with messages that fail authentication, and set up properly it means a fake note from the school’s domain gets rejected or dropped into spam before it reaches anyone.
Plenty of schools, clubs and small charities either never set it up or left it in a monitoring mode that blocks nothing.
You can check any organization yourself in a few seconds. Run its domain through a free DMARC Lookup and read what comes back. No record at all means the domain has no policy and anyone can imitate it. A policy set to none means it is watching but not blocking. Quarantine or reject means fakes are actively being stopped.
That is useful to know as a parent and more useful still at a PTA meeting. The fix costs nothing and takes an administrator an afternoon, which makes it one of the few school safety issues a parent can raise and see solved quickly.
What to teach children
Kids get their own school accounts younger every year, and those accounts get targeted too. Free game currency, a message from an address that looks like a teacher’s, a shared document from someone they do not know.
Keep the rules short enough to remember.
Nobody real will ever ask for your password.
Free things that need a login are not free.
If a message makes you feel rushed or scared, that is the signal to show an adult.
Links and attachments from strangers stay unopened.
Showing a parent a suspicious message is never getting in trouble.
That last one matters most. Children hide mistakes when they expect a reaction. The answer you want is thank you for telling me.
If someone already clicked
It happens, and speed matters more than blame.
Change the password on that account, and anywhere else the same password was used. Turn on two step verification wherever it is offered. If bank or card details were entered, call the bank directly. If a school account was involved, tell the school so other families can be warned, because these campaigns are almost never sent to one person.
Then check the account’s forwarding and recovery settings. Attackers often add a forwarding rule so they keep getting copies of your mail long after the password changes.
In the United States, suspicious messages can be reported to the FTC at reportfraud.ftc.gov, and phishing emails can be forwarded to reportphishing@apwg.org.
Three questions worth asking your school
Bring these to the next parent meeting.
Does the school have an email authentication policy in place, and is it set to block rather than only monitor?
What is the official channel for payments, and can the school confirm in writing that it will never request bank transfers by email?
Who do parents contact when something suspicious arrives, and will all families be notified when a campaign is going around?
None of this is about being suspicious of the people who teach your children. It is about making the school’s name harder to steal. A family that pauses for one phone call, and a school with its email properly locked down, closes almost every door these scams try to open.
