Social engineering in K-12 in the age of AI

Dear Sir or Madam:

I am a princess from the beautiful country of Genovia. I recently received news that i am the recipient of my grandmothers inheritance of 100 million dollars but I am in need of kindly assistance from a trustworthy foreign partner for the receiving of said monies. If you will pay the transfer fee, I promis you 30% of my inheritance…

The “Nigerian Prince” or advance-fee scam is a classic, the kind of email your users know to look for. Misspellings, unusual language, grandiose promises and so on — it’s easy enough to identify, right?

Your users probably catch messages like these, if they even get to their inboxes. But sometimes these messages fall through the cracks. For example, in 2025, a Wisconsin school district lost over $67,000 in a phishing scam after attackers impersonated their superintendent. The messages included invoices for a digital curriculum platform, robotics kits, online tutoring, testing software and continuing education for teachers.

While reports don’t mention if attackers used AI in this attack, the fact remains that these threats are relevant, convincing and consequential for schools. How would your staff respond to a social engineering attack like that one?

AI changed what phishing looks like.

Generative AI probably made parts of your job easier; the same is true for attackers. Attackers can use AI to quickly write convincing messages in someone else’s voice. The classic misspellings and phrasing aren’t reliable tells anymore.

More than one in four organizations that experienced a malicious attack reported it was AI‑driven, a 56% increase over last year.

— Cost of a Data Breach Report 2026, IBM

AI-assisted attacks often include:

• Impersonation of familiar people: A message sounds like your superintendent or a known vendor, with the right tone, the right names and a plausible ask. In February 2026, a North Dakota school district sent $4.92 million to bad actors posing as a trusted contractor after the vendor’s email was compromised. A legitimate sender and AI-drafted emails trained on the vendor’s voice can be difficult to spot.
• Delivery outside email: Email isn’t the only place for social engineering attacks. Text messages, messaging apps, QR codes on flyers in the staff lounge, and voice or video deepfakes aren’t protected by your email filters. For example, in 2025 staff members of a Connecticut school district received text messages impersonating their superintendent from a spoofed number. Thankfully, the district cultivated a culture where these messages were reported before any data or money was lost.
• Familiar cloud platforms: Malicious links can live in familiar sources that don’t get caught in your DNS or email filters. In a recent attack, bad actors took over multiple internal Gmail accounts at Canadian public schools. They then sent other students and staff a link to a form requesting information about a job opportunity. Blocking suspicious external emails is one thing; if familiar domains become compromised, this can be harder to catch.

Schools depend on trust — attackers take advantage.

So much of education is built on trust. Students need to trust their teachers. Teachers need to trust their administrators. Schools need to trust their software, textbook and other vendors. And so on and so forth.

Often, speed is of the essence, and it’s easier to assume whoever sent you a message has good intent. After all, your users want to get their focus back on supporting learning.

Around 25% of attacks mimic an organization’s trusted operating environment or someone inside it.

— Microsoft 2026 Digital Defense Report

Attackers use this to their advantage. This need for speed, general trust-based culture, roles that work with personal information or money, and strapped IT teams mean K-12 schools are exposed. This is especially true for new staff members or schools with infrequent phishing training. Closing these gaps means replacing assumed trust with verification: no request gets acted on just because it looks familiar.

How can schools respond? Here’s a place to start:

Takeaway 1: Audit communications outside email.

If your filtering stops at the inbox, every other channel is open. Start by listing every way someone can reach your staff:

• Email
• SMS/messaging apps
• Phone/voicemail
• QR codes
• Shared docs and chat
• Social media

For each one, ask whether any control sits in front of it. You likely won’t have visibility into every channel, especially on personal phones. But identifying potential risks gives you the opportunity to mitigate them.

Takeaway 2: Retrain users on how to respond to messages.

Creating a culture where your users feel comfortable reaching out to their leaders is important — if a new teacher gets an urgent request from someone masquerading as their principal (or even superintendent), will they verify the request?

Any sensitive request, regardless of who it’s from, should be confirmed through a separate channel you already know, like a staff directory. This matters more as AI voice cloning improves — vishing continues to be a growing threat. Requests that involve money, data, credentials or urgent leadership asks are especially important to verify. And if something seems off, users should know exactly where to report it, whether that's a dedicated email address, a ticket form or an IT contact.

Takeaway 3: Check where your filtering stops.

Filtering built for email and the school network leaves gaps when a threat lives on a familiar domain, arrives by text or follows a device home. Ask:

• How do your filters catch malicious content on familiar domains? Do they look at content and behavior, beyond the domain itself?
• What happens when the device leaves the school network? Does protection go with it, across every app?
• What happens when a staff member taps a link in a text message on a school-managed device?

Protect your school from social engineering.

Remember the princess from Genovia? Her email was easy to spot because of her classic mistakes. But these mistakes aren’t so common anymore (and the real Princess Amelia Mignonette Grimaldi Thermopolis Renaldo would never try to scam you!). Social engineering today isn’t so recognizable. But there are ways to protect your school: find every channel that reaches your staff, ensure your users feel comfortable reporting and verifying suspicious messages, and make sure protection follows school devices off the network.