Recognize the pattern
How it starts
Calls, emails or messages using a school, loan servicer or government program’s name.
The promise
You are on the refund list; follow the steps to recover tuition.
What happens next
Some course details and forged documents make impersonation convincing, turning a normal refund into a pay-first scheme.
Signs to watch for
- Refund requires deposits, investments or tasks
- Unfamiliar groups replace the provider’s process
- Requests screen sharing or bank codes
Start with what you can do now
If this happened to you
Stop payments and contact the actual school or loan servicer.
Change exposed account credentials through the real website.
Keep the offer and payments for a report to the FTC.
What to save
Keep the original records. Use copies to organize the details.
- Course contract and payment
- Refund notice and forged documents
- Group chats and URLs
- Additional transfers
Before you send money
- Check student loan information at StudentAid.gov or with your actual servicer.
- Verify a course refund with the original school or provider.
- Do not share your account password with an unsolicited caller.
These guides explain common patterns. The facts of your situation and your payment provider’s rules determine which steps are available.