Education Sector Phishing Prevention Guide

Educational institutions, from K-12 districts to research universities, combine open networks, large and constantly changing user populations, valuable personal and research data, and thin security resources. CISA treats education facilities, from pre-kindergarten through higher education and trade schools, as a subsector of the Government Services and Facilities critical infrastructure sector. Its K-12 cybersecurity page describes schools as “target rich, cyber poor” and says most districts lack the resources for a comprehensive cybersecurity program.

Phishing is a common way in. In a May 2022 notice, the FBI warned that US college and university credentials, often harvested through spear phishing and other intrusions, were being advertised for sale on criminal marketplaces and posted on public forums.

Why Education Is Uniquely Vulnerable

Open Access Culture

Academic institutions prioritize accessibility and collaboration. Open Wi-Fi, bring-your-own-device policies, shared computer labs, and flat networks create broad attack surfaces. The FBI’s notice recommends that academic institutions segment their networks to help prevent unauthorized access and the spread of malware.

Diverse User Population

A university network serves faculty, staff, undergraduates, graduate researchers, IT administrators, and visiting scholars, each with different security awareness, access needs, and technology habits. K-12 districts add parents and minors. Each academic year brings a wave of new accounts, so training has to reach every group, every year, not just employees.

High-Value Targets

Student records: Names, Social Security numbers, financial aid data, and transcripts, all useful for identity theft
Research data: Intellectual property, grant-funded work, and sensitive or export-controlled projects
Financial systems: Tuition payments, financial aid disbursements, and payroll
.edu credentials: The FBI reported that, as of January 2022, Russian criminal forums were selling or posting network credentials and VPN access for many US colleges and universities, at prices from a few dollars to several thousand. In May 2021, more than 36,000 email-and-password combinations for .edu accounts (some possibly duplicates) turned up on a public messaging platform. Attackers use stolen accounts for credential stuffing against other sites and for follow-on attacks against the institution and its partners.

Resource Constraints

CISA’s January 2023 report, Protecting Our Future: Partnering to Safeguard K-12 Organizations from Cybersecurity Threats, and its companion toolkit offer recommendations and resources to help schools and districts address systemic cybersecurity risk. For small teams, the practical lesson is to switch on the protections already included in existing licenses before buying new tools, and to spend staff time on high-impact controls such as MFA and email authentication.

Common Education Phishing Tactics

Tuition and Financial Aid Scams

Students receive emails about financial aid updates, scholarship offers, or tuition payment problems that link to fake versions of the student portal. Expect them around enrollment, aid disbursement, and tax season, when such messages are most plausible.

Faculty and Administrator Impersonation

Attackers impersonate department chairs, deans, or IT administrators. Faculty and staff receive “urgent” requests to share research data, buy gift cards, or update direct deposit details. Students and junior staff may hesitate to question a message that appears to come from someone senior, which is exactly what the attacker counts on.

IT Department Pretexts

“Your email storage is full: click here to expand.” “Your account will be deactivated: verify your identity.” Students and faculty receive frequent legitimate IT notices, so these lures blend in. The FBI notice describes a 2017 campaign in which criminals cloned university login pages and embedded credential-harvesting links in phishing emails, with the stolen credentials emailed automatically to the attackers.

W-2 and Payroll Fraud

During tax season, payroll and HR staff receive BEC emails, spoofed to look like they come from an executive, asking for a list of all employees and their W-2 forms. The IRS warned in IR-2017-20 that this scam had spread from corporations to school districts, healthcare providers, tribal organizations, and nonprofits, and that some versions followed up with a request for a wire transfer. Stolen W-2 data enables tax-refund fraud and identity theft.

Research-Targeted Spear Phishing

State-sponsored groups target academics for their research and their contacts. A May 2024 joint advisory from the FBI, the State Department, and NSA described North Korea’s Kimsuky group posing as journalists, academics, and other experts, impersonating people at think tanks and higher education institutions, and exploiting domains with missing or “p=none” DMARC policies so that spoofed messages reached inboxes. In one sample, a message impersonating a think tank passed SPF and DKIM because it was apparently sent through a university’s legitimate email service; it failed DMARC but was still delivered, because the think tank’s domain had a “p=none” policy. See our spear phishing comparison for how targeted attacks differ from bulk campaigns.

Defense Strategies for Education

Technical Controls (Budget-Conscious)

Control	Cost	Impact
DMARC/SPF/DKIM	No license cost (DNS records), plus staff time to review reports	Stops exact-domain spoofing of your domains once the policy is p=quarantine or p=reject
Built-in Google/Microsoft protections	Included with education licenses	Baseline spam and phishing filtering; confirm advanced anti-phishing settings are on where your plan includes them
MFA for all accounts	Authenticator apps are free; security keys cost extra	Stops attacks that rely on a stolen password alone; phishing-resistant methods also stop real-time phishing proxies
DNS filtering	Free and paid options	Blocks connections to known malicious domains
Phishing report button	Built into Outlook and Gmail	Enables rapid user reporting

Two points deserve emphasis. First, the FBI/State/NSA advisory recommends moving DMARC to “p=quarantine” or “p=reject” and setting the “rua” tag to receive aggregate reports; a “p=none” policy only monitors. Second, the FBI recommends MFA “preferably using phishing-resistant authenticators” for as many services as possible, particularly webmail, VPN, critical systems, and privileged accounts that manage backups.

Awareness Programs

Education-specific awareness must account for annual turnover and very different audiences. The FBI recommends training programs and phishing exercises for both students and faculty.

Orientation integration: Include phishing awareness in student and new employee orientation
Seasonal reminders: Send warnings before enrollment, financial aid disbursement, and tax season
Phishing simulations: Run regular simulations with education-specific lures
Student ambassadors: Train student IT ambassadors as peer educators
Gamification: Phishing-spotting competitions can make training feel less like a compliance chore

Administrative Policies

Require out-of-band verification for any W-2, payroll, or direct deposit change
Send IT notifications only from specific, published accounts, and tell users which ones they are
Build a “verify before you comply” culture for any request involving money, credentials, or data
Practice data minimization: reduce the amount of personal data stored in email systems
Require unique passwords and lockout rules for failed logins, as the FBI recommends
See our social engineering defense guide for building verification habits

Incident Response

Educational institutions should maintain a phishing-specific incident response plan adapted to their environment:

Give students a simple reporting path (email, web form, or mobile app)
Equip IT staff with automated triage tools to handle high report volumes
Disable or reset compromised .edu accounts quickly to prevent follow-on phishing
Check state data breach notification laws for deadlines, and involve legal counsel early to determine obligations under FERPA and other federal rules
Share threat intelligence through REN-ISAC (higher education) or K12 SIX (K-12), and build a relationship with your regional FBI field office before an incident, as the FBI recommends

Reporting Education Phishing

Internal: Forward to your institution’s IT security or phishing inbox
REN-ISAC or K12 SIX: Share indicators with the Research and Education Networking ISAC or the K12 Security Information eXchange
FBI: File at ic3.gov or contact your local field office; see our reporting guide
FTC: Report scams targeting students at reportfraud.ftc.gov
State attorney general: Notify as required by state breach notification laws

Key Takeaways

Education combines open networks, high user turnover, valuable data, and limited security resources; CISA calls schools “target rich, cyber poor”
Stolen .edu credentials are sold on criminal forums and reused for credential stuffing and follow-on attacks
DMARC at quarantine or reject, phishing-resistant MFA, and the protections already in education licenses are low-cost, high-impact starting points
Awareness programs must account for annual student turnover and very different audiences
W-2 fraud, tuition and aid scams, IT-themed credential harvesting, and research-targeted spear phishing are recurring threats
Share intelligence through REN-ISAC or K12 SIX

For the complete phishing defense framework, see our phishing recognition and reporting guide.

Sources

This content is for educational purposes only. Institutions should consult qualified cybersecurity professionals and legal counsel for compliance with FERPA, state data breach notification laws, and institutional policies.