• Skip to main content
  • Skip to secondary menu
  • Skip to primary sidebar
  • Skip to footer
ClassThink

ClassThink

School Technology Guides

  • E-mail
  • Facebook
  • RSS
  • Twitter
  • YouTube
  • HOME
  • LATEST
  • Featured
  • School App Search
    • Search
    • Dashboard
    • Directory Login
  • TEACHER GUIDES
    • Microsoft Teams
      • Microsoft Teams Teacher’s Hub
    • Microsoft OneDrive
    • Microsoft Stream
    • Microsoft Office
    • Microsoft Edge
    • Microsoft OneNote
    • Microsoft Office
    • Microsoft Outlook
    • Microsoft Windows
    • Microsoft SDS
    • Google Classroom
    • Google Meet
    • Zoom
  • REVIEWS
  • NEWSLETTER
  • ABOUT
    • Contact Us
    • About ClassThink
    • Support ClassThink
    • Write for ClassThink
    • Advertising and Sponsorship
You are here: Home / News / The scam emails targeting schools – “Are you on your computer at the moment ?”

The scam emails targeting schools – “Are you on your computer at the moment ?”

19 May 2020 by Karl Rivers Leave a Comment

An email phishing scam targeting schools is currently being reported. This email phishing scam has been around for a number of years, but appears to becoming more common during lockdown.

What is so engaging about these emails is that not only do they purport to be sent by someone in authority, but also they sound entirely reasonable. In particular, the phase “Today if possible but if not then we can wait till Monday morning” suggests urgency, but also that the Head is being entirely reasonable.

While staff are working remotely, and may be more isolated and under greater pressure than usual, they may be more susceptible this this type of phishing scam. It is worth reminding all school email users, particularly where there is a financial or data transaction involved, to always check verbally via a known contact number, before sending anything of value.

There are reports of this email phishing scam back to 2018, but in recent weeks there has been an increase in incidents. Whether this is just people paying more attention or the scammers are deliberately targeting schools to take advantage of the current disruption, it’s not clear, but it is worth making staff aware of this as it appears to becoming increasingly common.

In all reported cases an email is sent by the scammer to either a generic school account or someone high up in the organisation or finance department. While this appears to be highly targeted, the number and variety of replies suggest that there is human interaction at some point in the process.

Are you on your computer at the moment ?

The first email in the chain is sent from a free email service, making the source untraceable. Although many different email addresses have been reported, in all the cases I’ve reviewed it has been sent from a Gmail account with an address formatted in the following way:

headteacher01234@gmail.com

Email format: headteacher + five digit number + @gmail.com.

While the email address is clearly not correct, the name of the headteacher displayed in the email, or an abbreviation of it, usually is correct and it’s very easy to miss this red flag.

The initial phishing email most often takes this format:

“Head Teacher’s Name” <headteacher01234@gmail.com>

Are you on your computer at the moment ?

Kind Regards,

“Head Teacher’s Name”

This initial email is almost certainly automated but if the recipient replies it appears that either a human takes over the response, or one of a variety of responses are selected from a predefined list:

  • We need to make a payment to a supplier . Can you find out from anyone in Finance how we can have this sorted out (BACs or Faster payment)
  • I need you to set up a BACs or faster payment to a supplier. When can you have it done ?
  • Today if possible but if not then we can wait till Monday morning.
  • I’ll send you all the necessary paperwork for your records. I need you to set the payment up as a faster payment for today. 

It also appears that following the initial email the scammers has a way to spoof the email address of the real contact. In some cases, the visible email address is switched from headteacher01234@gmail.com to the actual Headteacher’s email address. If you check the email header information, however, the headteacher01234@gmail.com address is shown.

In cases where the recipient has continued the conversation, it eventually results in the scammer sending banking information for a payment to be made. In the cases I’ve seen the company Norish Ltd is used, which appears to be a legitimate UK based company, but I assume is unrelated to this scam.

Norish Ltd

Bank: Monzo 

Sort Code: 04-**-**
Account Number: 2223
****

Amount:£*,****.**

Send me the payment confirmation once its done. I’ll send you the invoice later. 

Reporting Phishing Email Scams

Uk schools should report all phishing attempts to ActionFraud..Make sure your school has an account set up ready in case you need to make a report. When you make a report ActionFraud will pass the information on to the National Cyber Security Centre (NCSC), who will analyse the suspect email and any websites it links to. They’ll use any additional information you’ve provided to look for and monitor suspicious activity.

If they discover activity that they believe is malicious, they may:

  • Seek to block the address the email came from, so it can no longer send emails
  • Work with hosting companies to remove links to malicious websites
  • Raise awareness of commonly reported suspicious emails and methods used (via partners)

Have you or someone in your school received this email? If so, I’d be interested in finding out more and creating a list of potential responses from the scammer to create a searchable list. Share your experiences in the comments.

You might also like...

Filed Under: News, Security

This page contains references to products from one or more of our advertisers. We may receive compensation when you click on the links to these products. For an explanation of our Affiliate Policy, please visit this page.

About Karl Rivers

Karl Rivers is a Director of IT who has worked in education for more than twenty years. He won the Naace Impact Award for Supporting School Services.

Reader Interactions

Leave a Reply Cancel reply

You must be logged in to post a comment.

Primary Sidebar

  • E-mail
  • Facebook
  • RSS
  • Twitter
  • YouTube

You might also like...

Popular School Apps

  • Bromcom Computers Plc

    Bromcom Computers Plc

    MIS/SIS System

  • CleverTouch

    CleverTouch

    Classroom Screens & Projectors

  • Capita SIMS

    Capita SIMS

    MIS/SIS System +3 Parent Communications, Parent Portal, Parents Evenings,

  • Wakelet

    Wakelet

    Learning Platform +1 Social Bookmarking,

  • BKSK

    BKSK

    Assessments +1 Educational Games & Quizzes,

Latest Edtech News

Virtual breakout rooms for Microsoft Teams – everything you need to know

Download the free OneNote for Team Collaboration eBook

New Surface Laptop Go Announced

Featured

Best Chromebooks for students in 2021

Create beautiful infographics for your classroom

Record online lessons with Camtasia

Naace Impact Awards Winner

Footer

Recent

  • Best Chromebooks for students in 2021
  • Create beautiful infographics for your classroom
  • Virtual breakout rooms for Microsoft Teams – everything you need to know
  • Record online lessons with Camtasia
  • Download the free OneNote for Team Collaboration eBook
  • New Surface Laptop Go Announced
  • Managing Windows 10 in schools with Intune and Autopilot
  • How to stop students unmuting themselves in Microsoft Teams
  • How to spotlight students & demonstrations in Microsoft Teams meetings
  • How to record a PowerPoint presentation as a video
Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.
To find out more, including how to control cookies, see here: Cookie Policy

Recent Forum Topics

  • Using VPN App in Apple or not? Not a big deal!
  • JvFHf5vfJ HyVSv2mpZ
  • Use VPN Security
  • How less is more with application development
  • How Much Does it Cost to Make an App like Uber
  • Microsoft Team class not appearing for teacher but is correct in Teams admin
  • FCM Test Notification!!! message in Microsoft Teams
  • FAQ: Can students begin a meeting in a private channel in Microsoft Teams
  • Microsoft Lists for Education
  • Benefits of hiring a ghostwriter

Most Popular Posts

  • How to turn off chat for students in Microsoft Teams
  • How to delete a video from Microsoft Teams
  • How to stop students muting and kicking others in Microsoft Teams video meetings
  • How to restore a deleted team in Microsoft Teams
  • How to record a PowerPoint presentation as a video
  • Best webcams for schools, classrooms, and assemblies in 2020
  • How to annotate and share a screenshot in Microsoft Teams
  • How to enable Large Gallery view and Together Mode in Microsoft Teams
  • How to repair a smashed Chromebook screen in 3 minutes
  • Where are assignment files stored in Microsoft Teams?
  • E-mail
  • Facebook
  • RSS
  • Twitter
  • YouTube

Copyright © 2021 · ClassThink.com · Affiliate Disclaimer · Privacy Policy · Here's the secret · Log in