The Grow Education Partners Data Protection Team would like to make schools aware of a fake invoice scam.

“We have lost a substantial amount of money to a scammer who has pretended to be our cleaning contractor and has send false invoices to the school that are exactly the same as the normal ones which detail the companies account number for our school and exactly how many cleaners and hours we pay for each fortnight etc.   The invoices are identical to the ones the company send us”.    

The scammer has called the school and advised that the cleaning company account details have changed, they were able to provide the last 4 digits of the schools account number in order for the school to verify the company’s authenticity.

The fake company also sent chase invoices to be settled and the school has also settled the genuine invoices to the scammer.

This was fairly sophisticated operation as they had nigh identical copies of the cleaning contractors invoices which are normally sent through electronically.

This would suggest that there has been a breach at the cleaning contractor and copies of their invoices and accounts has been extracted. The investigation to this is still pending.

in a similar event, a school in Barnet narrowly avoided in December paying a fake Grow invoice to scammers. School staff noticed at the last minute that the bank details were not the usual ones. The security breach in this case appears to have been somewhere in the school’s own email system, as the scammers’ request arrived part way through an email chain starting with what appeared to be a genuine invoice email from Grow/LDBS Finance Team, and when our IT support checked, there didn’t seem to be any issue at the Grow/LDBS end.

Please be vigilant.