Phishing used to be easy to spot. Strange email addresses, spelling mistakes, urgent messages from “HMRC” or “Royal Mail” asking for payment.
Today, the signs are harder to see – especially when the message seems to come from someone you know and trust.
Modern phishing isn’t about random spam. It’s about trust.
When a trusted colleague has been compromised
The most dangerous phishing emails no longer come from strangers. They come from genuine accounts that have already been breached.
That could be a teacher’s inbox in a school, a nursery manager’s account, a supplier, or even a friend from another setting.
The message might look completely normal. It may refer to something recent, use the right tone, and even include your real name.
But the goal is the same: to get you to click, download or share information.
Some signs that a trusted account has been compromised include:
Messages sent at odd times of day
Replies that don’t quite match the previous conversation
Sudden changes in tone or urgency
Attachments or links where none were expected
Requests to forward something on quickly
Shared OneDrive or Google links that ask you to log in again
If something feels off, it probably is.
Business Email Compromise (BEC): a growing problem
In Business Email Compromise attacks, criminals use hacked or spoofed accounts to request payments, invoices or sensitive data.
They study how your organisation communicates and then blend in.
You might get a message from your headteacher, nursery owner or finance officer saying:
“Can you process this payment today?”
“Please send me the staff details we discussed.”
“I’m in a meeting – can you buy some vouchers for me?”
It looks routine, but it isn’t.
Once funds or information are sent, recovery can be difficult.
BEC is one of the fastest-growing cyber threats in education, care and small business., not because the attackers are technical geniuses, but because they’re good at pretending to be us.
Pause, verify, protect
Phishing works when we’re rushed. The fix is simple: slow down.
Before clicking or responding:
Pause. Read carefully. Does the message fit the usual pattern?
Verify. Use another channel, phone or in person, to check the request is genuine.
Protect. Report it to whoever manages your security or IT, so others don’t get caught.
Never feel embarrassed for asking. Cyber criminals rely on polite people who don’t want to “bother” anyone. A thirty-second call can prevent hours of clean-up.
Creating a culture of calm checking
In every setting, school, nursery, care provider or business, staff need to feel confident raising concerns.
Mistakes happen. What matters is noticing and sharing them early.
If someone clicks on a bad link or enters their details, reassure them first. Then move quickly to secure accounts and reset passwords.
Blame doesn’t help; calm communication does.
How we help
At Black Swan Cyber Security Solutions, we work with schools, nurseries, MATs, care providers and small businesses to build safer habits through simple awareness sessions and tools that reduce risk.
Email protection, DNS filtering and practical training all play a part, but culture is where safety starts.
