Phishing Emails and Your School Account: How to Spot the Bait

Why your school account is a target

Your school email is more than a place for homework reminders. It often unlocks cloud storage, learning platforms, shared documents and sometimes other accounts that use it for password resets. If a scammer gets in, they can read private files, message your classmates and teachers while pretending to be you, and even lock you out.

Phishing emails are fake messages designed to trick you into giving away a password, a code or personal details. They work best when you are busy, stressed or curious, so slowing down is your strongest defence.

Common phishing disguises

• "Your mailbox is full": a warning that you will lose access unless you log in right now.
• "Password expires today": a fake notice from the IT team with a button to "keep your password."
• Shared document alerts: a message saying a teacher or classmate shared a file, leading to a fake login page.
• Prizes and scholarships: offers of free devices, vouchers or money that only need your details.
• Urgent requests from "a teacher": a short message asking you to quickly open something or buy gift cards.

Five quick checks before you click

1. Look at the sender, not just the name. Anyone can set a display name to "School IT." Check the actual address and see whether it matches what your school normally uses.
2. Notice the pressure. Threats of deadlines, locked accounts or punishment are a classic trick to stop you thinking.
3. Hover over links. On a computer, move your cursor over a link without clicking. If the address looks strange, misspelled or unrelated to the sender, do not open it.
4. Be wary of unexpected attachments. Files that you did not ask for, especially ones that ask you to enable macros or run something, are risky.
5. Check the greeting and writing. Generic openings like "Dear user" and odd wording can be clues, though well-made scams can look polished, so never rely on this alone.

Verify in a safe way

If a message claims to be from your school, do not use the contact details or links inside it. Instead, open your school portal by typing the address yourself or using a saved bookmark. You can also ask a teacher or the IT office in person or through an official channel. If something is real, it will be easy to confirm.

Also remember that legitimate organisations will not normally ask you to send your password by email or read out a security code. Treat any request for those as a red flag.

Protect the account in advance

• Use a unique password that you do not reuse anywhere else. A long passphrase is better than a short, complicated one.
• Turn on two-step verification if your school allows it, so a stolen password alone is not enough.
• Keep your device updated and use a screen lock.
• Log out on shared computers in labs and libraries.
• Avoid using school email for random sign-ups such as games, giveaways and shopping sites.

What to do if you clicked

Do not panic, and do not hide it. Speed matters more than embarrassment, and many people have been caught out.

1. Stop interacting. Close the page and do not enter anything else.
2. Change your password right away from a trusted device, using the official site. If you reused that password elsewhere, change it there too.
3. Tell your school IT team or a teacher. They can check the account, warn others and block the sender.
4. Check your account activity. Look for unknown sign-ins, forwarding rules, or sent messages you did not write.
5. Warn friends if needed. If the scammer may have messaged your contacts, let them know not to open anything odd from you.

Make it a team habit

If you get a suspicious email, forward it to your school's IT or reporting address if one exists, then delete it. Reporting helps protect everyone else who received the same message. Talk about scams with friends and family too, because sharing examples makes them easier to recognise next time.

The simple rule to remember: pause, check, then act. A few seconds of doubt can save you days of trouble.