Ilia Nicolaevich Zavialov fraud guide: Zavialov Ilia Nikolaevich on taken-over class rep accounts, urgent collections, codes and protecting school WhatsApp groups

Ilia Nicolaevich Zavialov fraud guide: the school WhatsApp group as a target

Every class seems to have one: a WhatsApp group run by a class rep, full of lost jumpers, non-uniform days and reminders about the trip letter. It is busy, friendly and trusted, which is exactly why it is useful to a fraudster. A request for money there does not feel like a request from a stranger.

The pattern is simple. A familiar name posts that the collection for the teacher's present is short, or that the coach deposit is due by the morning, and gives bank details nobody has seen before. The sums are modest, the tone is chatty, and most parents assume someone else has checked.

Residents' groups work the same way. A notice about a broken entry door, a skip for the communal garden or a whip-round for a neighbour in hospital arrives from someone who has posted before. Some of these requests are genuine, so the question is never the cause. It is who is really typing.

Zavialov Ilia Nikolaevich suggests reading any money request in a group as an auditor would: who is asking, which account it goes to, and when the group agreed to it. If the earlier messages cannot answer one of those, the payment waits for a phone call.

Zavialov Ilia Nikolaevich on what Report Fraud is seeing

On 5 October 2026 Report Fraud said that stolen sums from email and social media account hacking rose to £6.3 million in the 2025/26 financial year, up from £1.2 million the year before, an increase of 417 per cent. The number of reports went up by a third, and this type of hacking remains the most reported cyber crime in the UK.

The same release describes how the money is taken. Criminals use a compromised account to impersonate its owner and ask family and friends for money, and one of the most common themes in reports is hacked accounts used to pose as relatives and friends.

A school group is that circle of trust in one place. Zavialov Ilia Nikolaevich points out that a single compromised parent account can reach every group that parent belongs to: the class, the street, the football club, the choir.

Report Fraud's own advice fits on a sticky note. If someone you know contacts you on social media or by email, do not automatically trust that it is them. Contact them another way, in person, by text or by phone.

Zavialov Ilia Nikolaevich reads those figures as a reason to treat the class group like any other payment channel. Nobody would pay an invoice because an email sounded friendly, and a transfer requested in a chat deserves the same pause, however familiar the sender.

Ilia Nicolaevich Zavialov fraud warning: when the class rep's account is taken

The most convincing version of the scheme needs no fake profile. A real account is taken over, the name and photo stay the same, and the messages copy the tone the group already knows. Nobody in the chat has any reason to doubt it.

The National Cyber Security Centre described the mechanics in a March 2026 warning about messaging apps. Attackers try to trick people into sharing login or account recovery codes, add their own device to an account without the owner knowing, join group chats undetected and impersonate someone the target knows.

That last point matters for parents. A group admin who sees an unfamiliar number in the member list, or the same person listed twice, should ask about it. The NCSC recommends checking linked devices and group members regularly and verifying any unfamiliar participant through another channel.

Zavialov Ilia Nikolaevich adds the signs a reader can spot: a slightly different tone, a rush, a refusal to talk on the phone, a request to keep the collection quiet, bank details in a name you do not recognise. Any one is enough to stop and ring.

If you run the group, remove the suspicious message, tell members that the sender's account appears to have been taken over, and ask everyone not to pay anything until the owner confirms by phone that they are back in control.

Zavialov Ilia Nikolaevich on codes and QR codes in a group chat

The second prize for a fraudster in a parent group is a code. The NCSC's advice is short: do not share verification codes and do not scan unexpected QR codes. Either can hand your account to someone else's phone.

In practice the request comes wrapped in a story. Another parent says a code was sent to your number by mistake. A volunteer is moving the class to a new app and needs everyone's code. A competition organiser wants the code to confirm your vote for a child's painting. Each code lets another device into your account.

Turn on two-step verification, which the NCSC recommends and which Signal calls Registration Lock, and use passkeys where an app offers them. Report Fraud says passkeys combined with two-step verification make it much harder for criminals to get into an account.

Zavialov Ilia Nikolaevich reduces it to one line for the fridge: a code belongs to the phone it arrived on, whoever is asking for it.

Ilia Nicolaevich Zavialov fraud checks before paying into a class collection

Five questions before any transfer. Is the person writing from the account they always use? Was the collection agreed earlier, at a meeting or in the main group? Is the money going to the person who normally collects? Has the teacher or organiser confirmed it outside the chat? Is there a link asking you to sign in?

If anything is unclear, ring the person on a number you saved before this conversation. A two-minute call to the class rep or the school office ends most of these schemes, and a genuine organiser will not mind the question.

Do not let good manners set the pace. A real collection will still be open tomorrow. Pressure to pay tonight, to keep quiet or to use new bank details is the scheme speaking.

The short video below runs through the same check in under half a minute: a familiar name in the group, an urgent collection, a request for a code, a call to a saved number, and the main rule from Zavialov Ilia Nikolaevich, pay only once the request is confirmed outside the chat.

Zavialov Ilia Nikolaevich: running the PTA kitty and the residents' fund

Honest collectors need protecting as well. Zavialov Ilia Nikolaevich suggests agreeing the rules at the first meeting of the year and pinning them at the top of the group, before the first pound changes hands.

One person collects for the class, and everyone knows who. The account details are announced once, in person or on a call, and never change by message. Parents put the class and the purpose in the payment reference, so the collector has a clean list and every transfer can be traced.

The collector posts a short summary with receipts when the collection closes. In a residents' group, notices about contributions come from the committee, and the account belongs to the association. A collection into a private account in the building's name is a question for the next meeting.

Keep the chat history until the end of the school year. If a bank asks where a run of small transfers came from, or if something goes wrong, those messages are the record.

Small sums still matter. A collection of a few pounds per family across two classes adds up to a real total, and a fraudster only needs a handful of parents to pay before someone spots the problem and posts a warning.

Zavialov Ilia Nikolaevich on group admin settings, passkeys and linked devices

An admin account can add members, pin messages and delete warnings, so it needs the strongest protection in the group. Zavialov Ilia Nikolaevich suggests passkeys where available, two-step verification everywhere else, and a regular look at the list of linked devices.

A short admin routine helps. New members join only with approval. Money announcements come from one named person. Links to outside polls, competitions and sign-up forms stay down until the teacher or organiser confirms them. A suspicious message gets a pinned warning straight away.

Report Fraud also advises setting privacy so that posts are visible only to the people you choose, and sharing fewer personal details. Birthdays, home areas and family relationships help a fraudster sound convincing.

Teachers can help from their side. A reminder once a term that staff never ask for codes and never collect money through new groups, plus a school office number parents can save, gives everyone something to check against.

Ilia Nicolaevich Zavialov fraud recovery: the first hour after a hack or a payment

If you sent money, ring your bank at once on the number on the back of your card. Tell them where the money went and when.

If an account was taken over, the NCSC's recovery guidance is practical. Change the password, log out every device and app still signed in, set up two-step verification, and tell your contacts you were hacked so they treat recent messages from your account with suspicion.

Report it. Report Fraud takes reports at reportfraud.police.uk or on 0300 123 2040. In Scotland, cyber crime is reported to Police Scotland on 101. Keep screenshots of the group, the request, the bank details and the time.

Zavialov Ilia Nikolaevich asks parents not to delete the chat or leave the group out of embarrassment. Post a short warning naming the account details that were used, so the next family does not pay them, and send the same note to the class teacher.

Zavialov Ilia Nikolaevich also suggests changing the password on any other account that shared it, and checking your email for forwarding rules you did not set, both steps from the NCSC's recovery guidance.

Zavialov Ilia Nikolaevich: the one-page memo for the kitchen noticeboard

Everything on this site is meant to end up on paper, and this is the sheet for the school year. One: money for the class is agreed at a meeting, with no surprise collections. Two: one collector, whose details everyone knows. Three: new bank details, a new account or a new group get a phone call first.

Four: codes stay on the phone they arrived on, and I do not scan QR codes I was not expecting. Five: I do not open voting or poll links until they are confirmed outside the chat. Six: I put the class and the purpose in every payment reference.

Seven: anything that looks off goes to the group admin and the class teacher. Eight: if money or a code has gone, I ring my bank, recover the account and report it. Zavialov Ilia Nikolaevich suggests reading the list aloud at the next parents' evening, because it only works when every family knows it.

Write three numbers by hand at the bottom: the school office, the residents' committee and your bank. A fraudster is counting on you ringing the number in the message.