Stay alert to email scams: Sophisticated fraud scams targeting schools

March 2026

In today’s digital landscape, fraudsters are using more sophisticated tactics than ever before to exploit schools through email-based scams. Many of these scams arrive by email and are designed to look like genuine messages from trusted contacts. They often appear convincing, which makes them difficult to detect and can lead to significant financial loss.  

Below are three real-life examples that show how scammers infiltrate active communications, impersonate trusted contacts, and manipulate payment processes. These cases serve as a reminder why robust payment verification procedures, staff training, and cybersecurity measures are so important to protect schools from falling victim to such schemes.

Over the summer, a school completed construction works and had been liaising with their architect via email throughout the process. As part of this communication, the school received a payment link for the architect's fees, which appeared to come from the architect’s genuine email address. Acting on this, the school proceeded to pay a large sum of money via the provided link. Unfortunately, it was later discovered that a fraudulent email had intercepted the correspondence and redirected the payment to the fraudster’s account. Despite efforts, the funds couldn’t be recovered.

The school bursar received an email that appeared to come from the chairperson of the school.   The email requested that funds be transferred to two separate bank accounts in Dublin using internet banking. The bursar acted on what they believed to be a legitimate request, only to realise shortly after the email was fraudulent. The bursar immediately contacted the bank and filed a report with the Gardaí. 

The fraud squad attempted to recover the payments, but the accounts had already been emptied and unfortunately, no funds were recovered. The fraud squad has since closed the case.

A school principal was in ongoing email communication with a furniture company about an order. During this process, the principal’s email account was compromised. The scammer replicated the original email thread, including email signatures, invoice formats, and continued to exchange with the principal using a fraudulent email address. The believable responses made it appear as though the school was still communicating with the legitimate company. 

The principal received an invoice from the fraudulent email, which included an IBAN and BIC for a UK bank account. The principal questioned the UK account details via email, unknowingly corresponding with the scammer. The scammer replied with a convincing explanation that the company’s Irish accounts were under audit and that their UK sister account was being used temporarily. Convinced by the explanation, the principal transferred funds to the UK account. 

Over the following two weeks, the principal continued to correspond with the fraudulent email, believing it to be the furniture company. Additional monies were transferred. When the principal contacted the furniture company directly to confirm delivery,  it became clear that the company have no record of the order or payments  It became clear that the school had been the victim of a sophisticated email scam  The bank issued a callback request for the funds, but no money was recovered.  

All three incident demonstrate how convincing and sophisticated email-based fraud can be.  Scammers use real conversations and convincingly replicate legitimate correspondence using familiar names and professional-looking documents to gain trust.  

It highlights how important it is to:  

1. Implement robust payment verification protocols: always verify payment details through independent channels, especially when changes to account information are requested.  
2. Prioritise staff training on recognising phishing and fraud attempts  
3. Implement clear internal controls, such as dual authorisation for payments  
4. Strengthen cybersecurity measures, such as secure email practices, to mitigate the risk of such incidents.