Damian Brooks, Arbor’s Chief Technology Officer
Did you know nearly three in four secondary schools (73%) identified a cybersecurity breach or attack in 2025/26? That’s up from 60% the year before. For the vast majority of schools that were hit, phishing was part of the picture: 90% of primary schools and 96% of secondary schools that identified an attack reported phishing attacks [1].
Phishing rarely looks dangerous. It might be a payment reminder on a Friday afternoon, an incomplete attendance register, a “security alert” from your Management Information System (MIS), or a message that seems to come from the Department for Education (DfE) or Ofsted. On a busy school day, it’s easy to click first and think later.
Knowing the warning signs makes a real difference, so we’ve put together this guide to help you and your colleagues spot phishing, check whether a message is genuine and know what to do next.
What is phishing?
Phishing is when criminals use fake emails, texts, calls or messages to trick you. Usually, they want you to visit a website that tries to:
- Install malware on your device
- Steal your login details or sensitive pupil and staff data
- Trick you into sending money
To seem genuine, they often pretend to be people or organisations you trust.
How to spot a phishing attack
Phishing isn’t limited to email. It can arrive by text, phone call or messaging app, through a fake search result, or even through physical items like QR codes and letters. Artificial intelligence (AI) now lets criminals write polished messages, clone voices and copy real websites, so spelling mistakes are no longer a reliable giveaway. Instead, look out for these warning signs.
How the message tries to pressure you
The National Cyber Security Centre (NCSC) groups the most common tactics into five:
- It claims authority. It seems to come from your headteacher, the DfE, Ofsted or your MIS provider. Criminals borrow authority so you won’t question them.
- It’s urgent. “Your account will be locked in 24 hours.” A tight deadline is designed to stop you thinking.
- It plays on your emotions. It makes you panicked, worried, hopeful or curious, for example an “urgent safeguarding concern” attachment or a “staff bonus” notice.
- It offers something in short supply. “Only three free places left on this training course.” Fear of missing out makes people click quickly.
- It’s perfectly timed. Census, admissions, exam season and the start of term are when you’re expecting admin emails, and criminals know it
What the message asks you to do
- The sender doesn’t quite match. Check the full email address, not just the display name. Criminals swap letters or add extra words so addresses look genuine.
- The link goes somewhere unexpected. Hover over links without clicking to check the web address. Bookmark your Arbor login rather than searching for it, because sponsored search results can lead to fake login pages.
- It asks for a password, code or remote access. This includes calls or Teams messages claiming to be from your information technology (IT) helpdesk, asking you to install software or read out a code. If you get a two-factor authentication (2FA) prompt you didn’t request, don’t approve it.
- It asks you to change bank details or keep something quiet. For example, a supplier with “new bank details”, or a senior leader asking for gift cards and discretion.
- It arrives in an unusual way. Texts, WhatsApp messages, voice notes and video calls can all be faked, including with AI-cloned voices. If a request feels out of character, check it through a separate, trusted route.
If something feels off, trust your instincts and report it to your IT or security team straight away.
Phishing in the real world
Not all phishing arrives in your inbox. Criminals also use physical items, because people tend to trust things they can see and hold.
- QR codes. Be cautious of QR codes in emails, especially ones asking you to sign in. They’re often used to get past email filters and onto your personal phone, which may have fewer protections than your school device. On posters, letters or car park signs, check that a sticker hasn’t been placed over the original code. When you scan, use your phone’s built-in camera and check the web address before opening it.
- Letters and invoices. Got a letter from a “supplier” with new bank details, or an invoice for something you didn’t order? Always check it by phone using contact details you already have.
How to check if a message is genuine
Not sure? Pause and check. Contact the organisation directly using details from its official website or ones you already have. Don’t use the phone number or email address in the suspicious message. Anyone genuine will be glad you checked.
How will Arbor contact you?
Genuine emails from Arbor products always come from an arbor-education.com, arbor.education or timetabler.com domain. We’ll never ask for your password or a 2FA code, and we’ll never ask you to install remote access software on your device.
Not sure whether a message is really from us? Contact us at myteam@arbor-education.com or call us on 020 3835 4025. We’re always happy to check.
Protect your accounts with two-factor authentication
2FA is one of the best ways to limit the damage from phishing. Even if a criminal gets your password, the second layer of security means they’d also need your phone or code, which is much harder to get.
Some criminals use fake sign-in pages to capture passwords and one-time codes as you type them, so where your systems support it, choose phishing-resistant options such as passkeys or security keys. To set up 2FA in Arbor, see our Help Centre article: Setting up two-factor authentication for School and MAT MIS users.
What to do when you receive a phishing message
Think you’ve received a phishing message? Here’s what to do:
1. Avoid clicking links or downloading attachments
Opening a link could be enough to compromise your device or take over an active login session. Attachments may contain malware that can spread across your school network.
2. Don’t reply or engage
Replying confirms your address or number is active, which makes you a target for future attacks.
3. Report it, then delete it
Tell your IT or security team straight away using your school’s reporting process, so they can investigate and warn colleagues. If you’ve already clicked a link or replied, don’t worry. It happens, and the sooner they know, the easier it is to fix. Once they’ve confirmed it’s phishing, delete the message and empty your deleted items folder. If it relates to Arbor, please let us know at security@arbor-education.com.
You can also forward suspicious emails to the NCSC at report@phishing.gov.uk, and suspicious texts to 7726. Find out more on the NCSC website.
If you’ve lost money or think you’ve been hacked after responding to a message, report it to Report Fraud at reportfraud.police.uk, which has replaced Action Fraud in England and Wales. You can also call 0300 123 2040.
4. Strengthen your security
If you think your password has been exposed, change it straight away, and update it anywhere else you’ve used it. It’s also a good idea to use a strong, different password for every account. If criminals get hold of one password, they’ll often try it on your other accounts too, so reusing passwords means one phishing email could unlock several accounts at once.
Finally, turn on two-factor authentication wherever it’s available, and use passkeys or security keys if you can.
Final ask
Phishing isn’t going away, but a few seconds of checking can save hours of disruption. Remember, it’s always better to verify than to assume. If you report anything that feels off and encourage colleagues to do the same, you’ll help your school stress a little less and focus on what matters most.
Spotted a suspicious message using Arbor’s name? Let us know at security@arbor-education.com.
Sources
[1] Department for Science, Innovation and Technology and Home Office, “Cyber security breaches survey 2025/2026: education institutions findings,” GOV.UK, Apr. 30, 2026. [Online]. Available: https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026-education-institutions-findings. [Accessed: Nov. 11, 2026].
