Your inbox in August looks different than it does the rest of the year. Class assignments, supply lists, sports fees, lunch account reminders, portal login prompts. It’s a lot of legitimate email arriving in a short window, and that’s exactly the cover scammers wait for.
Fraud that hides inside routine paperwork works because the routine paperwork is real. A parent scanning ten school emails before dinner isn’t reading each one closely. Scammers know this, and every August they build phishing emails that look like they came from the front office, the district payment portal, or the PTA.
Why this scam pattern shows up every August
Phishing works best when a message matches something the reader already expects. Tax season brings fake IRS emails. Shipping season brings fake delivery notices. Back-to-school season brings fake tuition invoices, fake supply lists, and fake portal alerts, because those are the exact things a parent is anticipating.
The volume matters too. Schools really do send a wave of email in the first few weeks: registration confirmations, fee reminders, teacher intro notes, permission slips. A scam email dropped into that stream doesn’t need to be perfect. It just needs to blend in long enough for someone to click before thinking.
Common back-to-school scam formats to watch for
These scams tend to follow a handful of patterns. Knowing the shape helps you spot the next one, even in a version you haven’t seen yet.
Fake tuition or fee invoices. An email claims a balance is due immediately, sometimes with a late fee already attached, and links to a payment page that looks like your school’s portal but isn’t. The urgency is the tell. Real tuition offices rarely demand payment within hours of an email landing in your inbox.
Fraudulent supply list links. A message claims to include the “official class supply list,” often with a link to a shared document or a shopping site. Some versions push you toward a fake retailer that takes payment and ships nothing. Others use the document link itself to deliver malware.
Spoofed school portal login requests. You get an email that looks like it’s from your district’s student information system, warning that your account needs “reverification” or that a document is waiting for you. The link goes to a convincing fake login page built to capture your username and password.
PTA or fundraiser impersonation. Early in the year, PTAs and booster clubs send a lot of legitimate requests for volunteers and donations. Scammers copy that tone closely, asking for gift cards, wire transfers, or payment through unfamiliar apps.
Fake “your child’s account is locked” alerts. These lean on parental worry rather than money. The email claims a school app or learning platform has locked your child’s account and needs a parent to log in and confirm identity, again through a fake link.
Red flags that apply across all of them
You don’t need to memorize every scam format currently circulating. A shorter list of warning signs covers most of them.
- Urgency with a deadline measured in hours, not days. Real schools plan ahead; scammers don’t want you to have time to check.
- A payment or login link that doesn’t match your school’s actual domain. Hover over the link (or press and hold on mobile) to see the real destination before tapping.
- A request to pay by gift card, wire transfer, or an unfamiliar payment app. Schools bill through known channels, not gift cards.
- Generic greetings on something that claims to be personal, like “Dear Parent” on an email about your specific child’s account.
- Small misspellings in the sender’s domain, such as a district name spelled slightly differently than usual, or a “.net” where the school normally uses “.org” or “.edu”.
- Attachments you weren’t expecting, especially ones labeled as invoices, forms, or supply lists from a sender you don’t recognize.
If something feels off, treat it as unsafe until you’ve confirmed otherwise through a channel you already trust, like calling the school office directly rather than using the number listed in the email.
Protecting the accounts these scams target
A lot of back-to-school phishing aims at two things: your money and your login credentials for school-related accounts. Both are worth locking down before the scams start arriving.
Confirm the real portal address once, and bookmark it. Get the actual URL for your school’s payment and student information system directly from a printed handbook, a staff member, or the school’s official website, then use that bookmark instead of clicking links in email going forward.
Use a unique password for school accounts. If your child’s school portal password matches one you use elsewhere, a breach of one account can expose the other. A password manager makes unique passwords painless to maintain.
Turn on multi-factor authentication where the portal offers it. This makes a stolen password far less useful to whoever obtained it.
Verify unexpected fee or payment requests by phone. A quick call to the school office confirms in under a minute whether that “urgent balance due” email is real.
Be cautious with attachments from unfamiliar senders, even ones styled as school forms. If you’re unsure how to evaluate a suspicious file before opening it, this guide on malicious email attachments walks through what to check first.
When kids get pulled into it directly
Scam attempts aren’t limited to parent-facing email. Kids increasingly get their own school-issued accounts, class chat apps, and learning platforms, and phishing attempts sometimes target those directly with fake “your assignment didn’t submit” or “click to join your class” messages.
This is worth a conversation early in the year, not after something goes wrong. If your child got a new device for school, setting it up with the right protections from day one matters more than trying to fix things later. A back-to-school device checklist and a walkthrough of parental controls on a school-issued laptop or tablet are both good starting points if this is new territory for your family this year.
If your child is joining new class group chats this year, it’s worth knowing what those apps actually show and share; this guide to class chat apps covers what parents should look for. And if screen time habits got loose over the summer, resetting limits now tends to go more smoothly before the routine, not after.
A habit worth building this month
The single most useful habit this time of year isn’t a piece of software, it’s a pause. Before paying a fee, clicking a portal link, or opening an attachment tied to your child’s school, take fifteen seconds to check that it matches what you already know to be true: the right domain, the right amount, the right timeline. Scammers are counting on you moving fast through a busy inbox. Moving a little slower costs you almost nothing and closes off most of what they’re trying to do.
A quick safety note
This article is general information, not professional security, legal, or medical advice. No single tool or setting makes anyone completely safe; security works in layers. If you are dealing with a live incident, such as active fraud, ransomware, or a child in danger, contact the appropriate professionals or authorities. For a threat to a child, report it to the NCMEC CyberTipline at report.cybertip.org and to local law enforcement.
