This week, three different phishing emails pretending to be from BUSD staff were sent to hundreds of student accounts. Our technology team works quickly to identify and remove suspicious messages, but some may appear in inboxes before they are removed. Families can help by talking with students about how to recognize common warning signs and what to do if something looks suspicious.
Email hoaxes are on the rise nationwide and recent attacks have specifically targeted school district staff and students. These “phishing” emails are designed to capture information or login credentials from their target. This week, three different emails pretending to be from staff were sent to hundreds of student accounts. These emails had the subject lines of:
- Mrs. Traci – Items Available for Sale
- New Internship_Job_Description for Stu & Staff
- Exciting Online Summer Part-Time Opportunity for High School Students!
Our diligent technology team are always monitoring for this activity and generally are able to remove these emails from student inboxes within 30 minutes. However, some students may receive and read these emails before this happens, so it’s important to talk with your student about email safety and recognizing scams. Here are some tips you can use:
The Red Flags: Know Their Tactics
- Urgency & Secrecy: Be wary of any message demanding immediate action (e.g., “Are you available? I need a favor right away”) or asking you to keep a request private.
- Unsolicited Opportunities: Emails designed to target students often take the form of fake job opportunities or great deals on items for sale. If students have not asked to receive these types of communications, they should always be wary.
- The “From” Address: Attackers often use the name of someone you know but with a generic @gmail.com address. Always check that the address matches the name. However, these fake emails can sometimes come from a legitimate staff email address.
- QR Code Scams (Quishing): Never scan a QR code sent via email to “verify your account” or “view a document.” This is a common tactic to bypass security filters.
- Fake Event Invitations: These look exactly like an invitation email from a standard invitation service, but will usually come from a personal account rather than the service’s account. If you’re not expecting it, verify with the sender before clicking.
Email Safety Essentials
- Stop and Talk: If a request feels unusual, verify it with their teacher. Do not reply to the suspicious message.
- Inspect Links: Hover over links to see the real destination. If it looks complex or unfamiliar, don’t click.
- Password Integrity: No legitimate organization—including our IT department—will ever ask for your password.
- Google Doc Traps: If a document link asks you to “log in again” to view it, close the window immediately.
If You Make a Mistake
If you suspect a message is fraudulent and you accidentally clicked a link or entered your credentials:
- Reset: Change your password immediately if you entered it into a suspicious site.
- Report it: Forward the email to technologyhelpdesk@berkeley.net. Note: If a hacker gains access to your account, they will often block incoming emails, so we can’t reach you on that account. Provide an alternative contact mechanism besides the compromised account.
Test Your Skills: Think you can spot a fake? Take Google’s Phishing Quiz to practice.
