October is Cybersecurity Awareness Month, and for campus IT teams, that means more than patching servers and updating firewalls. It means protecting students who've never encountered sophisticated phishing attacks, international students unfamiliar with US financial aid processes, and families trying to navigate school payments online.
The reality? Students are high-value targets. They have access to financial aid, university systems, research data, and often lack the security awareness that comes with years of corporate email experience. Attackers know this.
Here are two email scams actively targeting students and their families right now, pulled from real incidents at US educational institutions in 2023-2025.
You receive an email with a Microsoft Word attachment claiming to provide details about a "US Student Service Supplementary Grant" designed to help with educational expenses and well-being costs. The email looks official enough, it mentions specific dollar amounts, talks about eligibility criteria, and directs you to fill out a Google Form to claim your funds.
The form asks for:
In 2024, this exact scam targeted students at Fairleigh Dickinson University and other institutions across New Jersey.
The New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) issued alerts after multiple reports of students submitting their personal and financial information to these fraudulent forms.
Google eventually disabled the specific form in that campaign, but similar phishing pages continue to appear using different platforms (Microsoft Forms, Jotform, Google Sites).
Financial pressure is real. Students are constantly looking for legitimate aid opportunities, including scholarships, grants, or emergency funds. Attackers exploit this by:
The fact that legitimate financial aid does come through email makes it harder to distinguish the real from the fake.
If you submitted information to a fraudulent form:
This one targets K-12 families, but if you're a college student with younger siblings (or if you work in a school setting) your family might encounter this.
Parents receive an email that appears to be from MySchoolBucks (a legitimate school lunch payment platform used by many districts). The message looks authentic enough, but it doesn't actually originate from MySchoolBucks or the school district.
The scam email requests payment through:
McMinnville School District in Oregon issued fraud alerts after families received these fake MySchoolBucks emails. The district had to clarify that they would never request payment via Venmo, cryptocurrency, or any cash transfer app.
Legitimate payments should only go through:
You might be thinking, "I don't have kids, why do I care?" This scam matters for college students for several reasons.
You might work in education. Student teachers, graduate assistants, campus jobs, if you're around K-12 environments, you'll see these scams.
Your parents might fall for it. If you have younger siblings, your parents could receive this email and lose money.
The tactics are the same. The payment redirection scam targeting MySchoolBucks is identical to attacks targeting university parking payments, lab fees, and other student charges.
No legitimate school district or university will ever request payment through:
Before you click any link in an email:
If something seems off:
Set yourself up for success:
Cybersecurity Awareness Month is the perfect time to refresh student security awareness. Here's what works:
Reach students where they are:
Make it relevant:
Engage student ambassadors:
Students are targets because they're valuable. They have access to university systems, financial aid dollars, research data, and often limited security experience. The scams are getting more sophisticated, and traditional "don't click suspicious links" training isn't enough when attackers use legitimate platforms (Google Forms, Microsoft Word attachments) and timely social engineering (financial aid season, enrollment periods).
The good news? Awareness works. Students who know what to look for can protect themselves and their families.
For IT teams: Want to see how IRONSCALES helps education institutions catch sophisticated threats like fake financial aid forms and payment redirection scams before they reach student inboxes? Learn more here!
Stay safe out there.