Stay ahead of student cyber scams
Students can reduce their risk of falling for common cybersecurity scams by limiting what they share online, learning how scammers operate and verifying unexpected requests before taking action.
By Merrill. Reviewed by Bank of America’s Global Information Security team
Key takeaways
- Scammers continually adapt their tactics and actively target students, particularly during periods of transition and increased financial activity.
- Many scams rely on social engineering, using publicly available information and psychological pressure to build trust and push students to act quickly.
- Limiting what you share online, especially personally identifiable information (PII) such as your address, phone number, class schedule or financial details, is a critical first line of defense against targeted scams.
- Always verify unexpected requests using a known, trusted contact method before sharing information or sending money.
COLLEGE IS A TIME OF TRANSITION, with many students managing money, housing, tuition, jobs, loans and digital accounts on their own for the first time. With so much to keep track of, students may be more vulnerable to scammers who use social engineering tactics to create urgency, build trust and prompt quick action.
Consider this: A student gets a call from someone claiming to be from their college’s financial aid office. The caller says the school has not received the student’s tuition payment and warns they will be dropped from their classes unless they provide payment information right away. The request feels urgent and credible because the caller already knows the student’s full name, age, school within the university and area of study.
It’s a classic social engineering tactic, and the scale of these scams is growing. The Anti-Phishing Working Group (APWG) reported that phishing attacks increased 13.8% in early 2026.
Scammers often use information gathered online, exposed through data breaches or found on social media to make their messages seem legitimate. By understanding the scammers’ tactics, students can take the steps necessary to avoid falling victim to them.
What is social engineering?
Social engineering is a manipulation tactic that tricks people into sending money, sharing personal information or giving access to their accounts. Rather than hacking a device directly, scammers focus on influencing a person’s decisions. They may pose as a school employee, employer, lender, landlord, scholarship organization, friend or government representative to make the request seem legitimate.
Social engineering works because it combines personal details with psychological pressure. A scammer may create urgency, offer a deal that seems too good to miss or pretend to represent a trusted organization. The goal is to get the student to act before they have time to pause, verify and think through the request.
The risk is not limited to email. Verizon’s 2026 Data Breach Investigations Report (DBIR) notes that social engineering is evolving, with attackers increasingly using voice and mobile-focused techniques to catch people off guard.1
Scammers may contact students through:
- Phone calls
- Text messages
- Emails
- Social media
- Messaging apps
- Fake websites
- QR codes
- Online marketplaces
Common scams targeting students
Scammers are always on the lookout for new ways to steal your personal and financial information. The following scams are commonly reported, and criminals are constantly creating new variations:
1. Tuition payment scams
A scammer may pretend to work for a college or university and claim a tuition payment is late, missing or incomplete. They may threaten the student will be dropped from classes unless payment is made immediately.
How to help protect yourself: Contact the school directly using the official website, student portal or verified phone number. Do not rely on contact information provided in the suspicious message.
2. Fake housing, textbook, moving or service listings
These scams often begin with an online ad offering housing, used books, movers or other student services at a low price. After the student sends a deposit or partial payment, the listing turns out to be unavailable, nonexistent or fraudulent.
How to help protect yourself: Be cautious with listings that require payment before receiving service, a contract or verified confirmation. Avoid payment methods that are difficult to reverse.
3. Student loan debt-relief scams
Scammers may promise to reduce, eliminate or forgive student loans for a fee. They may claim to be affiliated with the U.S. Department of Education or ask for account credentials. Federal Student Aid warns that legitimate student loan help is available for free through StudentAid.gov and that the Department of Education and its partners will never ask for a StudentAid.gov username or password.
How to help protect yourself: Do not pay upfront fees for student loan debt relief. Use StudentAid.gov or your official loan servicer for help with student loans.
4. Fake employment offers
A job posting may seem ideal for a student: flexible hours, strong pay and minimal experience required. But after the student responds, the “employer” may ask for an upfront fee, bank details, a Social Security number or other sensitive information before confirming the job is legitimate.
How to help protect yourself: Research the company, verify the recruiter and be cautious if a job asks for money or sensitive information early in the process.
5. Unsolicited scholarships and grants
Students may receive calls, emails or messages saying they have won a grant or scholarship from an organization they do not recognize. The scammer may ask for a Social Security number, bank information or payment to “release” the award.
How to help protect yourself: Verify the scholarship through the official organization or your school’s financial aid office before sharing information.
6. Social media scams
Social media can reveal details about where students live, what school they attend, who they know and what groups they belong to. Criminals can use this information to build trust, impersonate others or tailor scams to a student’s interests and routines.
Anti-Phishing Working Group, Inc (APWG) reported that in Q1 2026, threat volume increased on every social media platform it tracked, with scams and impersonation representing major threat categories.2
How to help protect yourself: Limit public personal details, review privacy settings and be cautious when someone you do not know asks for money, favors, account codes or personal information.
7. Ghost student and identity scams
Criminals may use stolen or synthetic identities to enroll in schools or apply for financial aid. These “ghost students” may collect scholarships, aid payments or other funds and then disappear. In some cases, stolen identity information may also be used for additional fraud.
How to help protect yourself: Monitor your financial accounts, credit reports and school records for unfamiliar activity.
How can students reduce their risk?
Students can take practical steps to make scams easier to spot and harder to execute.
1. Pause before acting
Scammers often depend on urgency. If a message says you must act immediately, slow down. Take time to verify the request.
2. Verify unexpected requests
Before sending money, clicking a link or sharing information, verify the request through a trusted contact method. Use a bookmarked website, type the official website into your browser or call a verified phone number.
3. Share less personal information online
Limit sharing public details such as your address, phone number, class schedule, travel plans, student ID information and financial details.
4. Review privacy settings
Check privacy settings on social media, messaging apps, financial apps and school accounts. Make sure personal information is visible only to people who need it.
5. Protect account credentials
Do not share passwords, one-time passcodes, StudentAid.gov credentials or banking credentials with anyone who contacts you unexpectedly. Federal Student Aid states that the U.S. Department of Education and its partners will never ask for your StudentAid.gov username and password.
6. Be skeptical of “too good to be true” offers
Deep discounts, guaranteed loan forgiveness, high-paying jobs with little effort and surprise scholarships should all be verified before you act.
7. Report suspected scams
If you think you have been targeted, report the scam. Federal Student Aid recommends contacting your loan servicer, bank or credit card company when relevant and filing complaints with appropriate agencies, including the FTC and CFPB.
What should students do if they have already interacted with the scammer?
If you sent money, clicked a suspicious link or shared personal information, act quickly.
- Contact your bank or credit card company to stop or dispute payments.
- Change affected passwords, especially for email, banking, school and StudentAid.gov accounts.
- Contact your loan servicer if the scam involved federal student loans.
- Report the scam to the FTC at ReportFraud.ftc.gov and to other relevant agencies.
- Monitor accounts and credit reports for unfamiliar activity.
FAQs: Student scams and social engineering
How do scammers get personal information about students?
Scammers may gather personal details from social media, public directories, exposed data from breaches, school-related posts or information shared across online platforms. They use those details to make a message sound more credible.
What is the biggest warning sign of a student scam?
A major warning sign is pressure to act immediately, especially when the request involves money, account credentials, personal information or a threat of losing access to classes, housing, loans or financial aid.3
Are student loan forgiveness calls always scams?
Not every student loan communication is fraudulent, but students should be cautious with calls, texts or emails that promise fast forgiveness, ask for upfront fees or request StudentAid.gov login information. Federal Student Aid says federal loan help is available through official servicers and StudentAid.gov at no cost.4
What is the safest way to verify a message from a school or lender?
Use a trusted contact method. Visit the official website by typing the URL into your browser, use a bookmarked portal or call a verified phone number. Do not use links, phone numbers or attachments from a suspicious message.4
Why are students targeted by scammers?
Students are often managing tuition, loans, housing, jobs, scholarships and new digital accounts, creating opportunities for scammers to impersonate schools, employers, landlords, lenders or service providers.
It’s never too early to become cyber aware
Cyber awareness is not just a college skill. As students move from campus life into the workplace, the same habits help protect their identities, finances, families and future employers. By learning how scammers operate, limiting what they share online and verifying unexpected requests, students can reduce their risk and help others do the same.
Stay connected, stay protected
To help keep your Merrill account information safe and secure, make sure your contact information is up to date and set up security and account alerts so we can stay in touch. Remember, if we need to reach out to you, we’ll NEVER ask for personal or financial information or an access code through email, text or unsolicited calls. Visit our Security Center for tips on how to recognize potential scams and learn more about how to keep your accounts safe.
Discover more with Merrill
Work one-on-one with a Merrill advisor for more insights and personalized guidance. Connect with us today.
Have us contact you
Try Merrill Advisor Match
1 Verizon, 2026 Data Breach Investigations Report, accessed August 2026.
2 APWG, Phishing Activity Trends Reports, Q1 2026 summary, accessed August 2026.
3 Federal Trade Commission, Student Loan and Education Scams, accessed August 2026.
4 Federal Student Aid, How To Avoid Student Loan Forgiveness Scams, accessed August 2026.
Neither Bank of America nor its affiliates provide information security or information technology (IT) consulting services. This material is provided “as is,” with no guarantee of completeness, accuracy, timeliness or of the results obtained from the use of this material, and without warranty of any kind, express or implied, including, but not limited to warranties of performance, quality and fitness for a particular purpose. This material should be regarded as general information on information security and IT considerations and is not intended to provide specific information security or IT advice nor is it any substitute for your own independent investigations. If you have questions regarding your particular IT system or information security concerns, please contact your IT or information security advisor.
The BullPen
Timely insights to stay ahead of the curve
