C3. Confirm Authenticity
Verify before you trust. Four questions that hold up under pressure.
In plain language.
The most effective attacks on a school are not technically sophisticated. They are emotionally precise.
The grandchild in trouble. The agency with a warrant. The vendor with an updated invoice. The leader you’d never question, asking for gift cards before a meeting starts. Every one of them runs the same play: manufacture urgency so that checking feels rude, slow, or insubordinate.
Four questions, and they work across email, text, and a phone call:
- Was I expecting this?
- Does the sender look right?
- Is there urgency or pressure?
- What’s the ask?
Then hang up and call back on a number you already had. Most attempts fail right there. Almost all of them succeed when someone is rushed.
What’s different in a school.
Schools run on trust and speed — people doing favors quickly for people they recognize. That is a genuine strength and it should not be trained out of a building. But it is exactly what this category of attack is built to exploit.
Which is why the organizational version of C3 is a culture question rather than a training question. The real test is whether someone on your staff can say “let me verify that” to a senior leader without it costing them anything. If they can’t, the four questions won’t save you — the pressure that makes the attack work is already inside the building.
What this looks like in practice.
The same practice, told three ways — so a champion can pick the version they need this week.
The invoice that arrives at the right moment
A message about updated banking details for a known vendor, timed to the week that vendor really does invoice. It’s convincing because it’s true about everything except the account number. The control is procedural, not perceptual: any change to payment details gets confirmed on a phone number you already had.
Build the phishing test, don’t just take one
Students write the convincing message rather than spotting one. Understanding how urgency and authority are constructed is far stickier than reviewing a checklist — and it’s honest about how the attack actually works.
The call that sounds like family
This is where identity theft actually lands. Print the four questions. Tape them by the phone. Send them to the people who raised you. Then hang up and call back on a number you already had — never the one you were just given.
Print the four questions
Thirty minutes, and most of it is the conversation afterward.
- Print the four-question card and post it in the front office and the workroom.
- Agree one verification rule out loud: payment or banking changes get a callback, always.
- Say plainly, in a staff meeting, that verifying a request from leadership is expected — not rude.
- Name where to report something odd, and make sure it’s a person, not a form.
- Send the card home with students.
Activities by grade band.
Each fits a single class period and needs no lab, no licence, and no prior technical background from the teacher.
Spot the pressure. Students read five messages and mark only the urgency cues — not whether it’s fake. Naming the emotional mechanism transfers to messages they’ve never seen; memorizing red flags does not.
Write the attack, then the defense. Students draft a convincing pretext against a fictional school, then design the procedural control that would defeat it. The second half is the assessment — and it teaches that the durable fix is a process, not sharper eyes.
Training changes reporting, not clicking
This is the finding most awareness vendors leave out, and it should shape what you expect. Verizon’s 2025 report found click rates were largely unaffected by training — but user reporting of suspicious messages rose roughly fourfold. Aim the human layer at reporting, and put the controls where judgment isn’t required.
Source: Verizon, 2025 Data Breach Investigations Report. Full reference list on the 4C overview.