Securing Your University Email

A university email address looks like a minor account. In practice it is one of the most connected logins a student holds. It receives messages from lecturers, financial aid, housing and the library. It is often used to claim student discounts, sign in to software, join clubs and reset other passwords. For attackers, a compromised student account is also a launching pad: messages from a real university address are more likely to be trusted by classmates and staff. Protecting it takes a short setup and a few habits.

Systems and policies differ between institutions, so follow your university's current security guidance. This guide is general information and names no products.

Why attackers want it

• It unlocks other things. Password resets, cloud files, financial aid portals and library access often depend on it.
• It carries sensitive information: grades, bills, personal details and sometimes medical or disability notes.
• It is trusted. Messages from a university address pass many filters and look credible.
• It can be abused at scale. Attackers use hacked accounts to send phishing to hundreds of contacts.
• Students are busy. Fake IT warnings and urgent deadlines are easy to believe.

Set up strong sign-in

1. Use a long, unique password, generated by a manager.
2. Turn on two-factor authentication. Many universities require it, and it is the single most effective protection. Prefer an authenticator app, passkey or security key over text messages. Our two-factor authentication guide explains each option.
3. Save backup codes or register a second method.
4. Check your recovery options: make sure the phone number and alternative email on file are yours and secure.
5. Sign out of old devices and sessions.
6. Learn how your university handles password resets, and keep their help desk contact in a safe place.

Recognize fake IT and university messages

Phishing aimed at students often imitates:

• IT help desks: "Your mailbox is almost full," "Password expires today," "Verify your account."
• Registrars and finance offices: "Fees unpaid," "Refund pending," "Registration hold."
• Libraries: "Access suspended."
• Professors and advisers: "Please open the attached grades," "Urgent request."
• Scholarship and job offers sent to student addresses.
• Mass messages about emergency alerts or campus news.

Habits that protect you:

• Never use the link or phone number in the message. Visit the official portal directly or search for the IT help page.
• Check sender addresses carefully, noting that display names can be faked.
• Be wary of attachments and requests to enter your credentials to view a document.
• Report suspicious messages using the report button or the address your university provides.
• Do not share verification codes with anyone, including people claiming to be IT. Real staff never need them.

Check forwarding rules, filters and connected apps

Attackers who gain access often hide their tracks.

• Look for forwarding rules that send your mail to another address.
• Check filters that delete or move security alerts and replies.
• Review connected apps and add-ins with access to your mailbox, and remove those you do not recognize.
• Check delegates and shared access and remove anyone who should not have it.
• Review sign-in history and devices.
• Check your signature and auto-reply for changes.

If you find something unfamiliar, change your password, sign out everywhere and tell IT.

Forwarding to a personal account

Some students forward university email to a personal address for convenience. Consider the trade-offs.

• Policy: some universities prohibit or restrict forwarding, especially for staff and research roles.
• Security: your messages become as safe as the destination account. Secure it with a strong password and two-factor authentication.
• Missed messages: forwarding rules can fail, and replies come from the wrong address.
• Alternatives: use the university's mobile app or add the account to your phone's mail app with proper security.

If you must forward, avoid sensitive categories and check regularly that it works.

Use email on phones and shared devices

• Lock your phone with a passcode, and keep it updated.
• Use official apps or properly configured accounts.
• Do not leave your account signed in on shared computers. Sign out fully, and close the browser.
• Avoid public Wi-Fi for sensitive tasks where you can. See our public Wi-Fi safety guide.
• Be careful with notifications that show previews on a locked screen.
• Remove accounts from old phones and laptops before selling or recycling.

What to keep out of email

Email is not a safe vault.

• Do not store passwords, recovery codes or bank details in messages or drafts.
• Avoid emailing scans of identity documents unless necessary, and delete them after.
• Remove old sensitive attachments and empty the trash.
• Use secure portals or encrypted sharing for confidential documents when your university provides them.
• Do not use university email for unrelated sign-ups that could expose it to spam and breaches. Use a separate personal address for shopping and newsletters.

Protect your contacts and reputation

If your account sends spam or scams, classmates and staff may trust it. Warning signs include replies from people about messages you did not send, sent items you do not recognize or unexpected bounce messages. Act quickly if you notice them, and tell friends to ignore suspicious messages from you.

If your account is compromised

1. Contact your university IT service immediately. They may be able to lock the account and help with recovery.
2. Change the password and enable two-factor authentication if not already on.
3. Sign out all sessions and remove unknown devices.
4. Remove forwarding rules, filters, delegates and connected apps you did not create.
5. Change passwords on other accounts that use the same or related passwords, and on accounts that use this email for resets.
6. Check for follow-up damage: financial aid, bank accounts and cloud storage.
7. Warn contacts that phishing may have been sent from your address.
8. Scan your devices for malware.
9. Report it and keep screenshots as evidence.

Plan for graduation

Policies differ, but many universities end or change student email after you leave.

• Find out the policy on alumni email, deactivation dates and data deletion.
• Move important accounts that use your university address to a personal one, such as banks, software licenses, scholarships and professional memberships.
• Download important emails and documents you may need later, including transcripts, receipts and references.
• Update your contact details with employers, graduate schools and loan providers. Our after-college section covers other transitions.
• Unsubscribe from services you will not use.
• Be careful with alumni scams, such as fake career opportunities or donation requests.
• Remove forwarding when the account closes.

Do this a few months before leaving, not the week after.

International students

If you are studying abroad:

• Keep access to your account even when traveling. Make sure verification methods work across countries. Authenticator apps and keys do not depend on a local mobile signal.
• Watch for visa and immigration scams sent by email.
• Keep a separate personal email for visas, immigration and long-term accounts.
• Know your university's rules on using email while abroad.

Keeping different roles separate

Use your university email for study and official business, and keep another address for shopping, newsletters and personal sign-ups. That way, a breach at an online shop does not reveal your university identity, and your inbox stays focused. Set up filters and folders for important messages, such as deadlines, finance and housing. Turn on notifications only for those. A clean inbox makes fake messages easier to spot, because you know what you are expecting.

Common mistakes

• Using a weak or reused password.
• Skipping two-factor authentication.
• Clicking links in IT-looking messages.
• Forgetting to check forwarding rules.
• Leaving the account open on shared computers.
• Using university email for everything.
• Waiting until after graduation to move accounts.

A quick checklist

• Do I have a unique password and two-factor authentication?
• Are my recovery details up to date?
• Have I checked forwarding rules, filters and connected apps?
• Do I know how to report suspicious messages?
• Have I planned for graduation?

Final thoughts

Your university email is more important than it looks. Protect it with a strong password and two-factor authentication, check for hidden rules, learn how fake IT messages look and keep sensitive items out of your inbox. Plan for graduation before the account disappears. A few careful habits protect your studies, your money and your classmates.