Email Safety – MUST U Act?
A simple way to recognise phishing emails and protect your school from cyber criminals
Every day, schools receive hundreds of emails. Most are perfectly legitimate, but hidden among them may be messages designed to deceive staff into revealing confidential information, handing over passwords, transferring money or opening the door to a cyber attack.
Phishing is not new, but the methods used by cyber criminals are becoming increasingly sophisticated. Artificial intelligence (AI) now makes it easier to produce convincing messages, impersonate trusted contacts and create fraudulent communications that look remarkably genuine.
Schools are particularly attractive targets because they hold significant amounts of personal information about pupils, parents, staff and other individuals. Some of this information is highly sensitive, including safeguarding records, medical details and special educational needs information.
A successful phishing attack could result in financial loss, disruption to teaching, compromised accounts, a personal data breach and serious reputational damage.
Fortunately, there is a simple message that everyone can remember.
If an email looks suspicious, ask yourself: MUST U act?
M – Message
What is the message asking you to do?
Does it request personal information, passwords, payment details or access to confidential documents? Does it ask you to open an unexpected attachment or follow a link?
Consider whether the request makes sense and whether it is something you would normally expect to receive.
U – Urgency
Cyber criminals frequently create a false sense of urgency.
You might be told that your account will be suspended, an invoice must be paid immediately or important information will be deleted unless you act.
Urgency is a common tactic intended to stop people thinking carefully. Take the time to verify unexpected requests using a trusted communication channel.
S – Sender
Check who the message is really from.
A familiar name or organisation does not necessarily mean an email is genuine. Criminals can impersonate legitimate senders or use addresses that look almost identical to genuine ones.
For example, an email from accounts@insightmsig.co.uk may be genuine, but one using a misleading variation of the domain name should immediately raise suspicion.
Remember that even an email from a genuine account could be malicious if that account has been compromised.
T – Tone
Does the message sound right?
An unusually formal or friendly greeting, unexpected language, unusual demands or changes in someone's normal writing style may indicate a problem.
However, spelling and grammatical errors are no longer reliable indicators of fraud. AI-generated phishing messages can be extremely well written and convincing.
U – URLs
Check website addresses and links before selecting them.
A link may appear to take you to a familiar website but actually lead somewhere completely different.
Be particularly careful with shortened links, unexpected login pages, QR codes and messages asking you to verify Microsoft 365 or other school accounts.
Where possible, access services through your existing bookmarks or by entering the known website address yourself.
Phishing is not just about email
The same techniques are used through text messages, messaging applications, telephone calls and QR codes.
Criminals may impersonate senior leaders, IT support teams, suppliers, government departments or even parents.
A message apparently from the headteacher asking for an urgent payment or confidential pupil information should be independently verified, particularly if it is unusual.
What should school staff do?
If you receive a suspicious message:
Do not follow links, open unexpected attachments or reply with confidential information.
Verify unusual requests independently using contact details you already know to be genuine.
Report the message promptly to your school's IT support or designated reporting contact.
Follow the school's procedures for dealing with suspected cyber security incidents.
If you have already clicked a link, entered a password or disclosed information, report this immediately rather than waiting to see what happens.
Where a suspicious message has resulted in the unauthorised disclosure of personal information, the school must assess whether a personal data breach has occurred.
Under UK GDPR, a breach must be reported to the Information Commissioner's Office within 72 hours of becoming aware of it, where feasible, if it is likely to result in a risk to individuals' rights and freedoms. Higher-risk breaches may also require notification to affected individuals.
Not every suspicious email is a personal data breach, but every suspected incident deserves appropriate attention.
Prevention is everyone's responsibility
Technical security measures, including spam filtering, multi-factor authentication, access controls and software updates, are essential. However, technology alone cannot eliminate the risk.
Schools should ensure that staff receive regular cyber security awareness training, understand how to report concerns and know what action to take when something goes wrong.
A culture in which staff feel comfortable reporting mistakes and near misses promptly is far more effective than one in which people are afraid of being blamed.
The most important message is simple:
Before you click, reply, download or disclose information, ask yourself:
MUST U act?
A few moments spent checking a suspicious message could prevent a serious cyber security incident, protect confidential information and save your school considerable time, expense and disruption.
Insight Management Services and Information Governance Ltd (Insight MSIG) provides independent data protection, information governance and related guidance to schools, academies and multi-academy trusts.
Further guidance: Information Commissioner's Office (ICO), Department for Education (DfE) and National Cyber Security Centre (NCSC).
Comments