Student and University Cyber Safety Guide

Students are targeted by scammers precisely because they are easy to find, often short of money, and receive large loan payments on predictable dates. This guide is for university and college students, and for the parents and student support staff who help them. It covers the scams aimed at students (fake student finance messages, accommodation and job scams, money mule recruitment), how to protect your university and personal accounts, staying safe on shared house and campus Wi-Fi, and looking after your laptop and phone. It is written in plain English and focuses on UK student life, though most of it applies anywhere. University IT and security teams will find the institutional side in the Cybersecurity for Higher Education Guide and the Education Identity Security Guide.

Key takeaways

Loan payment weeks are scam weeks. The Student Loans Company warns that scammers time messages around payments, and says it will never ask for personal or financial information by email or text, or contact you through WhatsApp or social media about your entitlement.
Your university login is valuable. It opens email, the learning platform, library resources, cloud storage and often Wi-Fi. Use a unique password and turn on the multi-factor sign-in your university offers.
Never let anyone use your bank account. Passing money through your account for someone else is money muling: it can lead to a criminal record, a closed bank account and being asked to leave your course.
Treat shared house Wi-Fi like public Wi-Fi. Change the router's default passwords if you control it, keep devices updated, and use your phone's data for banking if you are unsure.
Back up coursework in two places. A stolen laptop or a spilled drink the night before a deadline should cost you an evening, not a degree.

Why students are a target

Students combine several things criminals like: a new life with lots of unfamiliar organisations sending messages (university, student finance, landlords, banks, societies), a public social media presence that reveals course, university and birthday, and money arriving on known dates. In its warning at the start of the 2025/26 academic year, the Student Loans Company said it expected to pay about £2.2 billion in maintenance payments to almost one million students in September, and that in the previous year it had stopped £45.5 million from being stolen from students. Its earlier guidance notes loan payments are made in three instalments each year, in September, January and April, and these are the times to be most alert.

Scam	What it looks like	How to check
Fake student finance messages	Text, email or WhatsApp saying your payment is suspended, you must "update your details" or your account closes in 24 hours	Do not click. Log in to your student finance account directly or use the official phone number
Accommodation scams	A cheap room advertised online, a "landlord" who cannot show it in person and wants a deposit by bank transfer	View in person or by a live video tour you control, use university or accredited housing lists, never pay before seeing a contract. See the Rental and Holiday Booking Scams Guide
Job and task scams	Easy online work rating products or "boosting" apps, paid at first then asking you to pay in to unlock earnings	Real jobs do not ask you to pay. See the Job and Task Scams Guide
Money mule recruitment	"Quick cash" for receiving money into your account and passing it on, often via social media	Refuse, block, tell your bank. See the money mule section below
Fake tax refund or fines	Messages claiming a tax rebate, a parking fine or a parcel fee	Go to the official website yourself, not through the link. See the Parcel Delivery and Toll Text Scams Guide
Ticket and marketplace scams	Festival tickets, textbooks or electronics sold by bank transfer at a bargain price	Use platform payment protection or card payments. See the Online Marketplace Buying and Selling Safely Guide
Impersonation of a friend or family member	"Hi Mum, this is my new number" or a message from a hacked friend's account asking for money urgently	Call the person on the number you already have. See the Impersonation Scams Guide

Spotting student finance and phishing scams

The Student Loans Company's own advice lists the signs to look for. Text message scams ("smishing") are currently the most common, alongside phone calls, emails and impersonation of the company or of other students.

Generic greetings: "Dear Student" rather than your name.
Urgency and threats: deadlines such as closing your account within 24 hours.
Odd channels: contact through WhatsApp or social media, which the company says it does not use for your application or entitlement.
Poor spelling and grammar, and messages that are clearly sent in bulk.
Bank detail change texts: in England, Student Finance England may text to confirm a change to your bank details. If you get one and did not change anything, log in and check your account straight away.
Your own details used against you: scammers use your name, date of birth and course, often taken from social media, to sound convincing. Think about what is public on your profiles. See the Social Media Privacy Settings Guide.

Forward suspicious emails to [email protected], the UK's suspicious email reporting service run by the NCSC, and forward scam texts to 7726. University-themed phishing (fake "password expiry", fake library fines, fake shared documents from a lecturer) should also be reported to your university IT service desk, because other students will be receiving the same message. The How to Spot a Phishing Email Guide goes into more detail.

Money mules: the scam that makes you the criminal

A money mule is someone who lets another person use their bank account to move money. Criminals use mules to make stolen money look legitimate, and they deliberately target students. Banks warn that the consequences apply even if you did not realise what was happening. Lloyds Bank lists them as:

prison for up to 14 years and a criminal record;
your bank account closed, money taken, and difficulty opening another account;
being made to leave your university or college course;
being refused credit, including mobile phone contracts, loans and mortgages.

Warning signs: being asked to receive money and pass it on, offers from outside the UK, everything happening online with no one met in person, large payments for very little work, requests for your card or account details, and adverts promising "quick cash" aimed at students. If you are approached, do not share details, report the post to the platform, tell your bank, and report it to the police. If you have already let someone use your account, tell your bank now: it is far better than waiting for them to find out.

Protect your university and personal accounts

Your university account is a single sign-in to a lot of things, so it is worth more to an attacker than it looks. It may also be the account you use to submit assessed work.

Account	Why it matters	What to do
University login	Email, learning platform, coursework submission, cloud storage, often Wi-Fi	Unique password, turn on the university's multi-factor authentication, never enter it on a page you reached from an email link
Personal email	Resets every other account you own	Unique password and 2-step verification (2SV)
Banking app	Your loan, wages and savings	Biometric login, payment notifications on, never share one-time codes with anyone, including someone claiming to be your bank
Student finance account	Controls where your loan is paid	Unique password, check bank details after each instalment
Social media	Used to impersonate you to friends and family	2SV on, review login alerts, keep birthday and phone number private

Passwords: NCSC advises building passwords from three random words, avoiding things found on your social media such as pets, teams and birthdays, and notes that swapping letters for numbers does not really help. A password manager can create and remember a different one for every account. See the Password Managers Explained for Everyone Guide.
2-step verification: NCSC recommends turning on 2SV for email, banking, social media and shopping accounts, even if your passwords are strong, because passwords get stolen in data breaches and phishing. An authenticator app or passkey is stronger than a text code. See the Passkeys for Everyone Guide.
Never share codes: no university, bank or student finance team will ask you to read out a sign-in code or approve a sign-in prompt you did not start.
Shared computers: in libraries and labs, always sign out fully and do not let the browser save your password.
When you graduate: your university account will usually be closed. Move important files and change the email address on accounts (banking, LinkedIn, student finance) that use it for password resets before you leave.

Wi-Fi in halls, shared houses and on campus

Most universities use eduroam, the worldwide Wi-Fi roaming service for education. According to Jisc, you do not join eduroam separately: you use your university login, and the same credentials work at other participating sites. Set it up with your university's instructions or the geteduroam app (Android, iPhone/iPad and Windows), which configures the connection correctly and checks your username format. Jisc advises keeping the app installed, because deleting it removes the settings, and configuring an anonymous outer identity so that, when roaming, only your university rather than you personally is identified.

Do not connect to lookalike networks: a network named "eduroam-free" or "Campus WiFi" that asks for your university password on a web page is a red flag. Proper eduroam setup does not need you to type your password into a web page.
Shared houses: if the router is in the house, someone should change the default admin password and the Wi-Fi password from the sticker, and turn on automatic updates. Everyone in the house shares the network, so keep your own devices updated and their firewalls on. See the Securing Your Home Router Guide.
Landlord-provided Wi-Fi: you may not control it at all. Treat it like public Wi-Fi: rely on secure websites and apps and use your phone's data for banking if unsure. See the Public Wi-Fi Safety Guide.
VPNs: not usually needed for everyday security on modern websites, and free VPN apps can be a privacy risk themselves. Your university may provide one for accessing internal services. See the Choosing a VPN Safely Guide.

Look after your laptop, phone and coursework

Lock screens: a PIN or password with fingerprint or face unlock on phone and laptop, set to lock automatically.
Turn on encryption: on by default on modern phones once a lock is set; turn on device encryption or BitLocker on Windows and FileVault on Mac.
Updates: automatic updates on for the operating system and apps. Restart when asked.
Find my device: switch it on so you can locate, lock or erase a lost device.
Backups: keep coursework in the university's cloud storage and a second place (another cloud service or an external drive). Check you can open a restored file.
Software from official sources: cracked software and "free" versions of paid apps are a common route for malware that steals passwords. Many universities provide office and specialist software free to students.
Physical security: do not leave laptops unattended in libraries or cafés; in halls, lock your room.

A first-week checklist and how to tell it is working

The best time to sort this out is freshers' week, before the first loan payment and before deadlines pile up.

Do this in week one	Sign it is working
Turn on multi-factor sign-in for your university account	You get a prompt on new devices and never approve one you did not start
Set up a password manager and 2SV on email, bank and social media	No two important accounts share a password
Set up eduroam with the official app or instructions	You connect automatically and never type your password into a Wi-Fi web page
Turn on banking notifications	You see every payment in and out, and would spot one you did not make
Set up two coursework backups	A restore test works and files are no more than a day old
Save the reporting contacts	You know where to forward a scam message without searching for it

For parents and student support staff

Parents are often targeted too, with "Hi Mum" messages from a supposed new number or a call claiming a son or daughter is in trouble and needs money. Agree a simple check in advance, such as calling back on the old number or a family question only the real student would know. Welfare, residence life and IT teams get the most value from short, timely reminders: a scam warning in the week before each loan instalment, a mule warning when part-time job adverts peak, and a reminder before graduation to move files and recovery details off university accounts. Make the reporting route easy and blame-free, because students who fear getting into trouble delay telling anyone, and that delay is what turns a near miss into a loss.

If something goes wrong

You clicked a link or entered your password: change the password at once from the real site, turn on 2SV if it was off, and tell your university IT service desk if it was your university account.
Money has gone: call your bank immediately using the number on your card. Then report to Report Fraud (reportfraud.police.uk or 0300 123 2040) in England, Wales and Northern Ireland, or Police Scotland on 101.
Your social media or email was hacked: follow the platform's recovery steps and warn friends not to send money. See the Hacked Social Media or Email Account Recovery Guide.
Someone is threatening to share intimate images: do not pay, stop replying, keep the evidence and report it to the platform and the police. Universities have support services that can help.
You are worried about identity theft: check your credit file and consider protective registration. See the Credit Freezes and Fraud Alerts Guide.

Common failure patterns

Clicking a "student finance" link in a text during payment week and entering bank details on a fake site.
Reusing the university password on a gaming or shopping site that later leaks.
Approving an unexpected sign-in prompt because it kept appearing.
Paying a deposit for a room that was never seen, to someone who could not meet in person.
Accepting "easy money" for receiving and forwarding payments, not realising it is money laundering.
Losing coursework because the only copy was on a stolen or broken laptop.

Practitioner checklist

For students, and for welfare and IT staff running freshers' sessions:

University account has a unique password and multi-factor sign-in turned on.
Personal email, banking, student finance and social media have unique passwords and 2SV.
A password manager is set up, or a three-random-words approach is used for the most important accounts.
Student finance messages are only acted on after logging in directly, never from a link.
Bank details are never shared for anyone else's payments; mule approaches are refused and reported.
Eduroam is set up through the official app or university instructions with an anonymous outer identity.
Phone and laptop have screen lock, encryption, automatic updates and find-my-device on.
Coursework is backed up in two places and a restore has been tested.
Reporting contacts are saved: [email protected], 7726, your bank, Report Fraud and the university IT desk.
Files and account recovery details are moved off the university account before graduation.

Student and University Cyber Safety: Protect Your Accounts, Money and Data