Almost every cyber attack on a nursery starts the same way: a message designed to trick a human. Not a clever hack, not someone breaking through your defences, just an email that looks real enough to make a busy member of staff click before they think. That is phishing, and it is the single most common way nurseries get compromised.
The good news is that phishing relies on you not looking closely, and once you know what to look for, most of it falls apart. This guide shows you the giveaways, the ones that matter most in a nursery, and what to do when one lands.
Attackers do not hand-pick nurseries off a list. They fire millions of phishing emails at every kind of business and see who bites. Nurseries bite more often than they should, for reasons that are nobody’s fault.
Staff are busy and constantly interrupted. Email gets checked between rooms, on a phone, in a snatched moment, exactly the conditions where people click without scrutinising. Nurseries also handle things that make a fake message believable: invoices from suppliers, messages from parents, requests that look like they come from the manager. And the sector is not flush with IT support, so there is rarely someone to ask “does this look right to you?” before the click happens.
None of that means your staff are careless. It means the attack is designed to beat exactly the conditions nurseries work in.
Most phishing emails carry at least one of these tells. Train your eye on them and you will catch the overwhelming majority.
The address behind the name. The display name says “Microsoft” or “Sarah from Tots Supplies” but the actual email address, which you can see by tapping or hovering on the sender, is a string of nonsense or a domain that is almost-but-not-quite right. The name is free to fake. The address is harder to.
Urgency and threat. “Your account will be closed in 24 hours.” “Action required immediately.” “Your mailbox is full.” Phishing manufactures panic because a panicked person clicks before they think. Real organisations rarely threaten you into instant action.
The link that isn’t what it says. The email says microsoftonline.com but hovering over the link shows somewhere else entirely. On a phone, press and hold the link to preview where it actually goes before tapping.
A login page that arrives by surprise. You clicked a link and now something is asking for your Microsoft password. Stop. Legitimate sign-in prompts come from you going to a site, not from a link in an email pushing you to one. This is the moment the whole attack hangs on.
Slightly-off everything. A logo that is a bit fuzzy, English that is a touch wrong, a greeting that says “Dear Customer” instead of your name, a tone that doesn’t sound like the person it claims to be. Individually small, together a strong signal.
The unexpected attachment. An invoice you weren’t expecting, a “delivery note”, a document you need to “enable content” to read. Attachments are a classic way to deliver the actual nasty payload.
Two specific scams are worth singling out because they are aimed squarely at settings like yours.
The fake supplier. An email arrives, apparently from a supplier you genuinely use, saying their bank details have changed and the next invoice should go to a new account. It looks plausible because you do pay that supplier. The fix is a rule, not a judgement call: never change payment details on the strength of an email. Phone the supplier on a number you already have, never one from the email, and confirm.
The boss who isn’t the boss. A message that looks like it is from the manager or owner, often urgent, often asking someone to buy gift cards, move money, or send over staff details. It plays on the instinct to help the boss quickly. Same fix: a request like that, however urgent it sounds, gets confirmed by voice or in person before anyone acts.
It is worth being straight about this. The old advice was “look for bad spelling and clumsy English”. That advice is fading, because attackers now use AI to write phishing emails that are fluent, well-spelled and convincing. The same tools can clone a voice from a few seconds of audio, so even a phone call that sounds like someone you know is no longer proof.
This does not make spotting phishing hopeless, it just shifts where you put your trust. The fluent wording is no longer the giveaway. The sender address, the unexpected link, the surprise login page and the rule of confirming money and data requests through a separate channel, those still hold. Trust the process, not the polish.
Build a simple, blame-free routine, because the worst outcome is a member of staff who clicked and is too embarrassed to say so.
If something looks suspicious and nobody clicked, don’t engage with it, and report it so others are warned. In Microsoft 365 there is a built-in report button, and your IT supplier can help your team use it.
If someone did click or did enter a password, speed beats embarrassment every time. Change that password immediately, tell whoever handles your IT, and watch the account for anything odd. If it was a banking or payment action, contact the bank straight away. Our What to do if you’ve been hacked guide walks through the full response.
The single most important cultural thing you can do is make it completely safe to own up. A member of staff who says “I think I just clicked something I shouldn’t have” within five minutes is a gift. The same person staying quiet for a day out of fear is how a click becomes a crisis.
Phishing works by catching busy people not looking. You will not spot every fake by its wording any more, especially now AI writes them, so anchor on the things that don’t lie: check the real sender address, never trust a login page that arrived via a link, and confirm any request for money or data through a separate channel you trust. And make absolutely sure your team knows that owning up to a click fast is met with thanks, not a telling-off.
Octopus 365 has supported nurseries since 2011, and James has worked with early years settings since 2009. If you’d like a hand training your team to spot the fakes, or want a second pair of eyes on something suspicious that’s landed, get in touch any time. No hard sell, just a conversation.