Foreign students attending independent schools in the UK are being targeted by fraudsters to intercept their fee payments, according to new research.
Some families have lost up to £10,000 after being tricked into sending money to the perpetrator’s bank account after receiving a fake email from a school bursar.
A survey of 100 fee-paying independent schools found that all of them had experienced an attempted or successful cyber attack. This happens on average once a year.
Attacks typically focus on diverting fee payments to scammers’ accounts. Software company Iris Education, which carried out the research, said the average amount lost due to fraud was £3,200, although more than three times that amount was lost.
Iris Education Managing Director, Simon Freeman, said parents of overseas students often do not have English as their first language and may miss the warning signs of scam emails.
Often criminals will email parents offering a discount if they pay their fees in advance and then provide their own bank details.
“If you have parents [for] For those for whom English is not their first language, it is easy [criminals] To forge documents and convince non-parents that things are authentic,” Freeman said.
All 100 school bursars polled for the study said they had been targeted. Aimed at an average of five times in five years.
“[Criminals are] Monitoring school communications, time attacks on fee deadlines and repeating official payment instructions with remarkable accuracy,” Freeman said.
“Many schools are doing everything right with traditional processes, but those processes have become vulnerabilities that criminals are trained to exploit.”
This is how it looks
The scam usually starts with a hack, where criminals gain access to parents’ email addresses. This could be by hacking an outside company that has access. In one case, a company that handles visas for foreign students was targeted and data stolen, according to Freeman.
After that, emails are sent from the Bursar to the parents, asking them to make the payment to a different account than usual. This is usually done when term fees are due – usually March, September and December or later.
Parents may be offered discounts – sometimes up to 25% – in an attempt to lure people in, a common tactic used by criminals in many types of scams.
Often foreign students are preyed upon because they pay for tuition and boarding, making them more lucrative targets.
Schools often have multiple ways to communicate with parents — from email to WhatsApp groups to the telephone — so hackers will try to find a weakness in one of the communication channels, Freeman said. Many schools also accept a variety of payment methods — wire transfer, check, cash, debit and credit card — that criminals also try to exploit.
what to do
Parents should be alert to any message that is out of the ordinary or that adds a sense of urgency to the payment. This could be an invoice from a different time of the year when the fee is normally expected to be paid.
If any alarm bells are raised, parents are advised to contact the school through normal channels – not through any number or email address from the email they received – and check if the request is genuine.
Anyone who thinks they have been scammed should contact their bank as soon as possible and then contact Action Fraud, the central hub for reporting fraud and online crime.
