The Email That Looked Real

The price of freedom is eternal vigilance.

— Often attributed to Thomas Jefferson

Some risks are impossible to miss.

A storm. A broken pipe. A door left open. A student injury. A crisis that forces immediate action.

Others are easy to overlook.

They do not disrupt the building. They do not trigger alarms. They do not demand attention in the moment.

They arrive quietly—in an inbox.

They look routine. Polite. Professional. Urgent. Familiar. A message that feels like it belongs.

A vendor invoice. A request to update banking details. A shared file link. A data request. A “quick” approval. A message that appears to come from leadership asking for something confidential.

Nothing about it feels like a crisis.

That is exactly the point.

In school operations, some of the most serious threats do not begin with disruption. They begin with trust—placed in the wrong place at the wrong time.

An invoice that looks legitimate. A payment instruction that seems routine. A request that feels familiar enough to act on without hesitation.

It does not look like danger.

It looks like work.

That is why awareness matters.

As a CFO/COO, I have learned that the most dangerous financial and operational risks often do not arrive looking suspicious. They arrive looking ordinary. They come in through the normal rhythm of the day, when people are busy, calendars are full, deadlines are pressing, and everyone is trying to be helpful.

That is exactly when mistakes happen.

Schools are built on relationships. We trust our colleagues. We trust our families. We trust our vendors. We trust the people we work with every day. That trust is part of what makes a school community strong.

But trust without verification is not stewardship.

In finance and operations, you learn that good people can still make costly mistakes when the process is weak. A rushed approval, a skipped confirmation, an assumed identity, or a “this looks fine” moment can expose the school to financial loss, data compromise, reputational damage, and hours of recovery work that could have been prevented by one extra question.

That is not paranoia.

That is discipline.

The Army taught me that discipline saves lives. Around aircraft, you do not skip a step because you are busy. You do not ignore a checklist because you have done it a hundred times. You do not assume someone else checked the panel, the connection, the gauge, or the sound that did not seem quite right.

You check.

Not because you distrust the person before you. Not because you lack confidence. You check because the mission matters and people are counting on you.

That same mindset belongs in school operations.

Verification is not an insult. It is protection.

Calling a vendor to confirm a banking change is not being difficult. It is protecting the school. Questioning an unusual email is not slowing people down. It is protecting the community. Refusing to send confidential information through the wrong channel is not being unhelpful. It is honoring the trust families and employees have placed in us.

One of the hardest parts of cybersecurity and fraud prevention is that the threat often uses our best instincts against us. We want to respond quickly. We want to help. We want to serve. We want to solve problems. We do not want to be the person who holds things up.

But urgency is one of the oldest tricks in the book.

When a message pressures you to hurry, that is usually the moment to slow down.

The person trying to steal money, access data, or compromise a system is counting on speed. They are counting on distraction. They are counting on the fact that school employees carry a lot at once. They only need one person to click, approve, forward, or respond before thinking it through.

That is why small habits matter.

Look carefully at the sender. Question the tone. Be cautious with links and attachments. Verify payment changes using known contact information, not the number or email provided in the suspicious message. Pick up the phone. Ask the business office. Ask the technology team. Ask the extra question before the mistake becomes expensive.

A few minutes of verification can protect years of trust.

The prudent see danger and take refuge, but the simple keep going and pay the penalty.

— Proverbs 22:3

That scripture is direct because wisdom often has to be direct. Prudence is not fear. Prudence is not negativity. Prudence is seeing the danger early enough to act before the damage is done.

In a school, cybersecurity is not only a technology issue. It is a people issue.

Technology teams can provide filters, systems, training, alerts, and protections. Business offices can build approval processes and internal controls. Leaders can set expectations. But the daily protection of financial resources and confidential information depends on the judgment of every person who opens email, handles records, communicates with families, approves expenses, or responds to requests.

Every adult has a role.

The teacher who pauses before opening a strange attachment is protecting the school. The assistant who questions an unusual request is protecting the school. The business office employee who verifies a vendor change is protecting the school. The administrator who refuses to rush confidential information is protecting the school. The technology team member who reminds us one more time to slow down is protecting the school.

That work is not glamorous.

Most people will never know when a mistake was prevented.

But that is often what good risk management looks like. Quiet. Disciplined. Unnoticed. Effective.

Schools hold deeply personal information. Student records. Health information. Family contact information. Employee data. Payroll. Banking details. Donor records. Contracts. Confidential conversations. That information is not just data. It represents people.

Protecting it is part of protecting the mission.

An ounce of prevention is worth a pound of cure.

— Benjamin Franklin

The email that looked real is dangerous because it asks us to trust before we think. It invites us to move quickly when wisdom is telling us to slow down. It uses routine work to hide real risk.

That is where culture matters.

A healthy risk culture gives people permission to pause. It rewards the person who asks the extra question. It does not shame someone for reporting a suspicious email. It does not treat verification as inconvenience. It understands that prevention often looks like a small interruption before it becomes a major recovery effort.

This week, pay attention to the emails that ask you to hurry.

The unexpected attachment. The changed payment instructions. The urgent request. The strange link. The message that sounds almost right but not quite. The request for information that should not be handled casually.

You do not have to be a cybersecurity expert to protect the school.

You just have to be disciplined enough to pause, verify, and ask for help before one small click becomes a much larger problem.

Be the reason someone checks twice.

The mission is protected when awareness is stronger than urgency.