When people imagine a cyber attack, they picture a hacker breaking through defences. In schools, the reality is usually simpler: someone clicks a convincing link, types a password into a fake page, or uses the same password everywhere. These three habits cause most problems, and all three can be fixed with awareness.
1. Phishing: the message that looks real
Phishing is a fake message designed to make you act quickly: click a link, open an attachment, share a code or send money. Common versions aimed at schools include:
- An “urgent” email that appears to come from the principal asking for a payment or gift cards.
- A message claiming your email storage is full, with a link to “log in and fix it”.
- A fake fee payment confirmation sent to parents, pointing to a look-alike website.
- A phone call or chat message asking for a one-time code (OTP) that was “sent by mistake”.
How to spot it
- Urgency or fear: “within one hour”, “account will be closed”.
- A slightly wrong sender or website address.
- Requests for passwords, OTPs or payments by email or chat.
- Unexpected attachments, even from people you know.
No real bank, payment service or software provider will ever ask you for your password or OTP. If someone does, it is a scam.
2. Weak and reused passwords
When one website leaks its passwords, attackers try the same email and password on other services. If a staff member uses the same password for social media and the school system, one leak opens both.
- Use a long passphrase: four random words are stronger and easier to remember than “School@123”.
- Never reuse the school system password anywhere else.
- Use a password manager if staff manage many accounts.
- Turn on two-step verification wherever it is offered.
3. Shared logins
Shared accounts feel convenient, especially in a busy office, but they remove accountability. If three people use the “accounts” login, nobody can tell who changed a fee record, and nobody can remove one person's access without locking out the others.
Give every staff member their own login and set what each can see through roles. It is the single most effective change most schools can make.
Training that actually works
- Keep it short: fifteen minutes at a staff meeting beats a long annual lecture.
- Use real examples of messages your school or neighbouring schools have received.
- Make reporting easy and blame-free. A staff member who reports a mistake quickly is helping, not failing.
- Repeat each term, and include new staff from their first week.
What to do if someone clicks
- Change the affected password immediately, and anywhere else it was used.
- Tell the person responsible for IT, even if nothing seems wrong.
- Check recent activity in the account and the school system.
- Warn colleagues if the message may have gone to others.
Security is a team habit. With individual logins, sensible passwords and a little regular training, a school removes most of its risk.
