Home / Blog / Cyber fraud alert: CEO Fraud – schools targeted

Cyber fraud alert: CEO Fraud – schools targeted

I do hope this finds you all well.

We have been given the heads up by Action Fraud to an emerging trend of CEO fraud reports, whereby schools are the targeted victim.  This has resulted in substantial financial loss for several schools.  We are not aware of specific cases in Hampshire and the Isle of Wight at this time but by sharing this awareness we can hopefully prevent others from falling victim.

We would be very grateful if you could share with all educational contacts.

How the scam works:

A school is targeted by a fraudster who purports to be the head teacher/principal. The fraudster contacts a member of staff with responsibility for authorising financial transfers and requests for a one off, often urgent, bank transfer to be made. The amounts requested have been between £8,000 and £10,000.

Contact is made by e-mail and from a spoofed / similar email address to the one the head teacher / principal would use.

Protection/Prevention advice:

  • Ensure that you have robust processes in place to verify and corroborate all requests to change any supplier or payment details. Get in touch with the supplier (or internal colleague) directly, using contact details you know to be correct, to confirm that a request you have received is legitimate.
  • All employees should be aware of these procedures and encouraged to challenge requests they think may be suspicious, particularly urgent sounding requests from senior employees.
  • Sensitive information you post publicly, or dispose of incorrectly, can be used by fraudsters to perpetrate fraud against you. The more information they have about you, the more convincingly they can purport to be one of your legitimate suppliers or employees. Always shred confidential documents before throwing them away.
  • Email addresses can be spoofed to appear as though an email is from someone you know. If an email is unexpected or unusual, then don’t click on the links or open the attachments. Staff should not be allowed to check emails from administrator accounts.
Translate »