Fraudsters don’t miss a trick. In recent months they’ve even taken advantage of the Labour party’s proposed VAT addition on private school fees, hooking parents by offering to reduce fees by 20% if they pay in advance (they research the school so know what to charge).

“It’s very topical, very sophisticated, and the focus is on private schools,” explains our fraud specialist.

Fee-paying schools are particularly vulnerable. Once a school system is breached, hackers can pretend to be the school and send parents emails offering discounted/’early bird’ rates but, in reality, money will be transferred into bogus bank accounts.

An example of how an attacker gains access to a school’s server

  • The fraudster emails the school’s finance department while pretending to be an existing or new parent.
  • This alone wouldn’t prompt suspicion, so an employee responds to the email by requesting additional information.
  • In return, the fraudster emails a link or attachment that relates to the initial query and the employee downloads this.
  • This link works to steal information, allowing the fraudster to access personal contact details.

“If you work in a school, you could get an email from absolutely anybody. There may be a separate attachment disguised as a CV or a Word doc that, if downloaded, allows malware  to infiltrate your system. With the use of AI tools such as ChatGPT red flags are very hard to spot,” he adds.

“If parents are asked by a criminal to pay school fees, remember it’s the victim that needs to report it, not the school.”

Ransomware is a real risk for businesses with large amounts of personal data

ransomware attack  occurs when a system is hacked and access is restricted to your own systems until a ransom is paid. Because of the amount of student data, places of education are more susceptible to ransomware attacks, and a school is more likely to pay because there’s so much personal data. Criminals know that although many schools are in deficit, many have put capital aside for future plans so paying up may seem like a realistic option for some.

Best ways to protect your school and parents from fraud

  • Multi-factor authentication: even if fraudsters manage to get past the first layer of security, this might prevent access to that second system or database where student details and personal data are kept.
  • Educate staff on what to look out for, including emails and phone calls.
  • Alert parents to any contact requesting payment details – even if they seem genuine. Ask them to check with the school before paying.
  • Remind parents that, as victims, it’s their responsibility, not the school’s, to report the crime to the police.

Places of higher education are vulnerable to fraud

Student finance: The Public Accounts Committee warns of a lack of oversight of institutions running courses on behalf of universities. Two thirds of these commercial partnerships or franchises are not registered with the Office for Students, and fraud was detected.

Money mules are individuals who allow their bank accounts to be used to transfer money. Students studying abroad might be targeted/recruited through social media channels such as TikTok and Instagram. They don’t realise they could be complicit in a crime because it’s a way to make easy money, and it feels like a genuine job.

Identity theft: Overseas students are convinced to sell their bank account before returning to their home country (a fraudster might claim they’re having trouble opening an account of their own). Once sold, it’s hard for banks to detect that it’s in fact being used  by criminals.

Educate students and other individuals on what to watch out for to avoid these kinds of scams, and the consequences of being part of organised crime. If you suspect you’re a victim of identity fraud, contact Action Fraud.


Visit our Fraud Hub for upcoming webinars and further insight.

This material is published by NatWest Group plc (“NatWest Group”), for information purposes only and should not be regarded as providing any specific advice. Recipients should make their own independent evaluation of this information and no action should be taken, solely relying on it. This material should not be reproduced or disclosed without our consent. It is not intended for distribution in any jurisdiction in which this would be prohibited. Whilst this information is believed to be reliable, it has not been independently verified by NatWest Group and NatWest Group makes no representation or warranty (express or implied) of any kind, as regards the accuracy or completeness of this information, nor does it accept any responsibility or liability for any loss or damage arising in any way from any use made of or reliance placed on, this information. Unless otherwise stated, any views, forecasts, or estimates are solely those of NatWest Group, as of this date and are subject to change without notice. Copyright © NatWest Group. All rights reserved.

scroll to top