A message that pretends to be from a trusted source to trick you into revealing information, clicking a link or sending money.

What should I do if I clicked a suspicious link?

Disconnect from untrusted sites, do not enter details, change passwords from a safe device, run security checks and report it to your university IT and the affected service.

Why are students targeted?

Students handle new systems, deadlines, money and housing for the first time, and attackers exploit urgency and unfamiliarity.

How can I check whether a message is real?

Do not use links or phone numbers in the message. Go to the official site or app yourself, or contact the organization through details you already trust.

Where do I report scams?

Report to your university IT or security team, the platform involved, your bank if money was lost and the relevant consumer or police fraud service in your country.

Spotting Phishing and Student Scams: Warning Signs

Scammers do not need to be clever to catch students. They only need to arrive at the wrong moment: the week fees are due, the day a visa letter is expected, the night a ticket sale opens. Students handle many new systems and many first-time transactions, and attackers use that to create pressure and confusion. The good news is that most scams share a handful of tricks. Learning to spot them takes an afternoon, and it protects your money, your identity and your accounts.

Scams change quickly and laws differ by country. This guide is general information, not legal advice. Check your university's security pages and your national fraud reporting service for current alerts.

How phishing works

Phishing messages try to make you act without thinking. They typically:

Pretend to be someone you trust, such as your university, bank, a professor, a landlord, a delivery firm or a friend.
Create urgency or fear: "Your account will be closed," "Payment overdue," "Unusual sign-in."
Offer something attractive: a refund, scholarship, job or prize.
Ask for action: click a link, open an attachment, log in, scan a code, send money or share a verification code.
Arrive by many channels: email, text, messaging apps, social media, phone calls and QR codes.

The goal is to steal passwords, payment details, personal information or direct payments.

Warning signs

No single sign proves a scam, but several together are a strong signal.

Unexpected contact about something you did not request.
Pressure to act quickly or secretly.
Generic greetings or odd wording, though modern scams can be well written.
Mismatched sender addresses or domains that look similar but not identical.
Links that hide their destination. Hover over a link on a computer to preview it, and be cautious on phones.
Requests for passwords, codes or full card details. Real organizations do not ask for these by message.
Unusual payment methods such as gift cards, cryptocurrency or transfers to individuals.
Too-good-to-be-true offers.
Attachments you did not expect.
Requests to move the conversation to another app.

If something feels off, pause. Scammers rely on speed.

Common student scams

Fake university messages

Emails or texts claiming to be from the IT desk, registrar, finance office or library. They say your mailbox is full, your account will be suspended, your fees are unpaid or a refund is waiting. The link leads to a fake login page. Check your university's official security page, and go to the portal directly.

Financial aid, grant and scholarship traps

Offers that ask for fees to apply, guarantee awards or ask for your bank login to "process" a grant. Genuine aid does not require you to pay to receive it, and official processes use official websites. Our financial aid sections explain how real applications work, and

Rental and housing fraud

Fake listings with low rent, owners who are "abroad," requests to pay a deposit before viewing or by unusual methods. Never pay before seeing the property and verifying the landlord. Our housing guide to avoiding rental scams goes deeper.

Fake jobs, internships and tutoring

Offers that appear quickly, ask you to buy equipment, cash a check and send back part of it, or move payments through your account. These are covered in

Ticket, textbook and marketplace scams

Fake sellers of tickets, textbooks, electronics or sublets. Use platforms with buyer protection, pay with protected methods and be suspicious of pressure.

Impersonation of friends or family

Messages from a hacked account of a friend asking for money, codes or urgent help. Verify by calling or contacting them another way. Voice and video can be faked, so agree a family or friend code word for emergencies.

Fake support calls and messages

Callers claiming to be from your bank, the tax authority, immigration services, the police or tech support. They threaten consequences or promise refunds. Hang up, and call the organization using a number from its official site.

Romance and investment scams

Online friends or partners who build trust and then ask for money, often for investment or emergencies. Never send money to someone you have not met.

Fake delivery and parcel notices

Texts about missed deliveries with a link to pay a fee. Go to the carrier's official app or site instead.

QR code and public Wi-Fi traps

Malicious QR codes pasted over legitimate ones, or fake Wi-Fi networks that mimic campus names. Do not scan codes in unusual places without checking, and use trusted networks. Our public Wi-Fi safety guide explains more.

How to check a message

Stop and breathe.
Do not click, call or reply using details in the message.
Go to the official site or app by typing the address yourself or using a saved bookmark.
Check your account for notices.
Contact the organization using details from its official website.
Check with someone you trust, such as a classmate, adviser or IT desk.
Search for the scam with key phrases and the organization name.
If it is a friend, verify via another channel.

If in doubt, delete it.

Protect yourself in advance

Use a password manager and unique passwords.
Turn on two-factor authentication.
Keep devices updated and use security tools provided by your university.
Limit what you share publicly. Scammers use social media details to craft convincing messages.
Use separate email addresses for important accounts and for sign-ups.
Check bank and card statements regularly.
Set up alerts for large transactions.
Be careful with attachments and macros.
Learn your university's real contact channels so that you can recognize fakes.

If you clicked or shared something

Act quickly but calmly.

Disconnect from the page. Do not enter anything more.
If you entered a password, change it on the real site from a safe device, and anywhere you reused it. Turn on two-factor authentication.
If you entered card details, contact your bank immediately to block or replace the card.
If you installed something, disconnect from the internet, run a security scan, and seek help from your university IT service. A device reset may be needed.
If you shared codes or paid money, tell your bank straight away. Speed improves your chances of recovery.
Take screenshots and save messages as evidence.
Report it to your university, the platform, and the relevant authorities.
Warn friends if your account was used to contact them.
Monitor your accounts and credit for unusual activity.

Do not be embarrassed. Scams catch people of all ages and backgrounds, and reporting helps others.

Where to report

University IT or security team.
The platform or service where the scam appeared, using report tools.
Your bank or card provider.
National fraud and consumer protection agencies, which operate reporting portals in many countries.
The police, especially for threats, blackmail or significant losses.
Your mobile provider for spam texts, often by forwarding them to a reporting number.

If you feel unsafe, contact campus security or emergency services.

Helping friends

Share what you learn. Talk about scams in group chats and societies, and encourage friends to enable two-factor authentication. If someone falls for a scam, respond with support, not blame. Help them take the steps above.

Common mistakes

Trusting a message because it looks official.
Clicking links before checking.
Reusing passwords.
Sharing verification codes.
Paying in unusual ways.
Hiding a mistake out of embarrassment.
Ignoring reports from friends about hacked accounts.

A quick checklist

Do I check the sender and the address before acting?
Do I use official sites and apps instead of message links?
Is two-factor authentication on for important accounts?
Do I know how to report a scam at my university?
Do I have a plan if I click something wrong?

Final thoughts

Phishing and scams succeed on speed, pressure and trust. Slow down, check through channels you already know and never share codes or pay in unusual ways. Protect your accounts with unique passwords and two-factor authentication, and report problems early. If you do get caught, act quickly, and remember that reporting protects you and others.