Foreign students attending independent schools in the UK are being targeted by fraudsters seeking to intercept their fee payments, according to new research.
Some families have lost up to £10,000 after being duped into sending money to the bank account of a criminal, after receiving a fake email from the school bursar.
A survey of 100 fee-paying independent schools found they had all been hit by an attempted or successful cyber-attack. This happened on average once a year.
The attacks typically focus on diverting fee payments to the scammers’ accounts. The average amount lost to the fraud was £3,200, although there was a loss of more than three times that amount, according to Iris Education, a software company that carried out the research.
The Iris Education managing director, Simon Freeman, said parents of foreign students are often the most susceptible as English may not be their first language and they can miss the warning signs that scam emails have.
Often the criminals send emails offering parents a discount if they pay their fees early, and then give their own bank details.
“If you’ve got parents [for] who English is not their first language, it’s easier for [criminals] to duplicate documents and convince parents things are authentic that aren’t,” Freeman said.
The 100 school bursars polled for the study all said they had been targeted. The average had been targeted five times over five years.
“[Criminals are] monitoring school communications, timing attacks around fee deadlines, and replicating official payment instructions with remarkable accuracy,” Freeman said.
“Many schools are doing everything right with traditional processes, but those very processes have become the vulnerabilities that criminals are trained to exploit.”
What it looks like
The scam typically starts with a hack where the criminals get access to the email addresses of parents. This could be by hacking an outside company that has access. In one case, according to Freeman, a company that managed the visas for foreign students was targeted and data stolen.
After that, emails are sent to parents, supposedly from the bursar, asking for payment to be made to a different account than usual. This will typically be done when term fees have to be paid – usually in March, September and December or thereabouts.
Scam emails are sent to parents of private school pupils offering a discount if fees – usually paid in March, September and December – are paid early. Photograph: Ben Birchall/PA Archive/PA Images
Parents may be offered discounts – sometimes as much as 25% – in an effort to lure people in. This is a common tactic used by criminals across many types of scam.
Often foreign students are preyed upon because they pay for tuition and boarding, making them more lucrative targets.
Freeman said schools often have a number of ways to communicate with parents – from email to WhatsApp groups to telephone – so hackers will try to find a weakness in one of the communication channels. Many schools also accept payment in different ways – wire transfer, cheque, cash, debit and credit card – which criminals also try to exploit.
What to do
Parents should be alert to any message that is out of the ordinary or attaches a sense of urgency to payment. This could be an invoice that comes at a different time of year to when fees are normally expected to be paid.
If anything raises alarm bells, parents are advised to contact the school through the normal channels – not by any number or email address from the email they have received – and check whether the request is genuine.
Anyone who thinks that they have been defrauded should contact their bank immediately and after that Action Fraud, the central hub for reporting fraud and online crime.
