Parents at Ibstock Place School in Roehampton have been warned to remain vigilant after a convincing phishing scam targeted the school’s parent community—posing as a message from the head of finance and preying on fears over looming VAT rises on private school fees.
The scam email, which some parents received this week, claimed to offer an extended deadline to participate in the school’s “Fees in Advance” scheme. It urged recipients to deposit £25,000—a move designed to trick families into transferring large sums of money to fraudsters.
In a message sent to parents on Wednesday morning, Headmaster Christopher Wolsey confirmed the scam and urged caution. “We have become aware of an email… purporting to be from our Head of Finance,” he wrote. “It is not authentic and it does not come from the School.”
Fake domain, real damage
The scam was made more convincing by the use of a fake domain name that closely mimicked the school’s official email address. The attackers used “ibstocksplaceschool.co.uk” — inserting an extra ‘s’ — rather than the legitimate “ibstockplaceschool.co.uk”.
This type of deception, known as typosquatting, is a common tactic in phishing campaigns. Fraudsters register domains that differ from trusted names by just a single character, exploiting the likelihood that a recipient won’t notice the subtle change.
Wolsey advised parents: “As a general rule of thumb, please be very cautious of unsolicited email correspondence which seems to come from School, and which asks for large sums of money on very restricted time frames.”
What is phishing—and why it’s getting worse
Phishing is a form of cybercrime where criminals pose as trusted institutions or individuals to trick people into giving away sensitive data or money. These scams often rely on urgency, impersonation, and realistic-looking emails to bypass suspicion.
Experts warn that phishing has become increasingly sophisticated in recent years, fuelled by the availability of cheap domain names, data leaks, and AI-driven tools that make scam emails harder to distinguish from legitimate ones.
The attack on Ibstock Place fits into a growing trend of DNS abuse, where domain name systems are manipulated to carry out fraud, malware distribution, or data theft. Internet governance bodies like ICANN and registries such as Nominet have flagged the issue as a major concern, with thousands of fake domains registered each year for criminal purposes.
The domain name in question has been suspended after it was reported through abuse mechanisms.
A timely target
This scam comes at a moment of heightened anxiety for many families at fee-paying schools, following the new Labour government’s confirmation that it will apply 20% VAT to private school fees. Some parents have been rushing to pre-pay fees under advance schemes in an attempt to shield themselves from the additional cost—creating fertile ground for fraud.
Just this week, Falcons School in West Putney confirmed that it was shutting down after 70 years of schooling in part because of the financial pressure from the tax increase.
The school has urged any parent who received or responded to the scam to immediately contact the school’s Bursar.
A reminder to double-check
The school is now investigating how the phishing email was distributed and reiterated best practices for confirming suspicious requests. “If in doubt,” Wolsey advised, “please always check with us – a phone call is often a good means to do so.”
As digital threats evolve, schools, parents, and businesses alike are being reminded that even the smallest details—like a single stray letter—can open the door to large-scale fraud.
