01
Vendor email compromise on AP
An email that looks like Pearson, an athletics vendor, or a transportation contractor lands in your AP inbox asking to update banking details on a 'past-due' invoice. The sender domain looks right at a glance, the cadence matches the real vendor, and the dollar amount is small enough to feel routine.
- Watch the language: 'urgent', 'past due', 'updated remittance' on a familiar vendor name.
- Banking changes should always be confirmed by phone on a number you already have on file.
- If the AP staffer is new, attackers know it. Pair newer staff with a verification routine they can lean on.
02
Edtech impersonation
Fake quotes, license renewals, and proposal requests that mimic the curriculum or platform vendors your district already pays. The attacker wants either an outbound payment or an attached file opened.
- Attachments and links from 'known vendors' deserve the same scrutiny as cold outreach.
- Procurement should confirm contract numbers with the vendor's account team directly, not via reply.
03
Manufactured urgency on the superintendent's name
A 'forwarded' message from the superintendent or business officer landing on someone with authority and visibility. The attacker has read the district's website, picked the right names, and timed the email to a window when verification is hard (Friday afternoon, board-meeting day).
- Display names are not authentication. Hover-and-check the actual sender address.
- If anyone you don't normally hear from is asking for a wire or gift cards, that is the signal.
04
Student-facing scams that pull staff in
FAFSA phishing, fake scholarships, housing-deposit fraud — these target students, but they often turn into staff workload (counseling, IT, financial-aid recovery). Protecting students is protecting the institution's time.
- A surge of 'aid status' emails in the same week is the signal of an active scam campaign hitting your students.
- Counselor and registrar inboxes are the early-warning system; brief them every term.