Recognize the pattern
How it starts
School emails, class groups or messages from supposed finance staff.
The promise
Overdue tuition requires immediate payment to avoid academic or collection consequences.
What happens next
A familiar school identity and overdue fee threats reduce scrutiny, redirecting payment to attacker-controlled accounts or links.
Signs to watch for
- Charge absent from the official portal
- Urgent transfer to a new account
- Odd domain or personal collection account
Start with what you can do now
If this happened to you
Pause payment and notify the school
Alert the bank to the fraudulent payment request
Keep emails and account details; report to police
What to save
Keep the original records. Use copies to organize the details.
- Billing email and headers
- Original class group messages
- Official bills and verification
- Account details and transfers
Before you send money
- Check real bills in the student portal
- Confirm with finance through known contacts
- Verify recipients rather than trusting group identities
These guides explain common patterns. The facts of your situation and your payment provider’s rules determine which steps are available.