The New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) has reported an increase in scams targeting New Jersey organizations. Schools and Municipalities are common targets because attackers can use publicly available information to make fraudulent messages look convincing.
Two scams to watch for:
Payment-change messages
A criminal may pretend to be a vendor, contractor, or public agency and claim that an invoice is due or that payment instructions have changed. The message may ask the district to wire money or mail a check. Once the money reaches the criminal’s account, recovering it can be difficult.
Fake document invitations
An email may say that an invitation or document is available through an Adobe link because the file was too large to attach. The message may be vague about who sent it or what the document is about. The link may lead to a fake sign-in page, request unsafe permissions, or prompt you to download something.
What to do
- Verify every new or changed payment instruction by calling a known, trusted phone number already on file. Do not use the phone number or email reply provided in the message.
- Treat unexpected document links with caution, even when the message looks formal or mentions a trusted brand such as Adobe.
- Do not enter your Microsoft 365 or Google password after following an unexpected link. Do not approve unusual browser prompts or downloads to view a document.
- Report suspicious messages to your district’s IT team using your established process.
- If you entered credentials, notify IT immediately and change the affected password from a trusted device. If money was sent, contact your bank immediately and notify district leadership.
A familiar sender name, professional tone, or vendor logo does not confirm that an email is legitimate. Verify first, then act.
