Online Scams Targeting College Students: How FAFSA and QR Code Fraud Work

Online Scams Targeting College Students: How FAFSA and QR Code Fraud Work

Imagine this: a student's financial aid disbursement doesn't arrive on the scheduled date. She logs into her studentaid.gov account and finds a bank routing number she doesn't recognize. Someone else collected her Pell Grant. She never responded to a suspicious email. Three weeks earlier, she scanned a QR code on a flyer posted near the financial aid office. That was enough.

Online scams targeting college students have grown sharply more sophisticated in 2026. Phishing attacks rose 13.8% in the early months of this year, and QR-code phishing alone jumped from 7.6 million incidents in January to 18.7 million in March, a 146% increase in a single quarter, according to Great Basin College reporting on Anti-Phishing Working Group data. The federal government's response reflects how serious the underlying problem has become: the U.S. Department of Education reported in June 2025 that identity-based fraud had reached a level that "imperils" the federal student aid system, and flagged almost 150,000 suspect identities in active FAFSA forms during a single review window.

These scams hit two types of victims. The first is direct: students are tricked into surrendering FSA credentials, paying fake fees, or depositing fraudulent checks. The second is indirect: students' identities are used without their knowledge by organized fraud rings that enroll fictitious "ghost students" at real colleges to drain federal aid at scale. Both paths feed the same problem.

If you think your aid account has already been touched, skip to the recovery steps in Section 4. Everything else in this article explains how the scams work and what to watch for.

How online scams targeting college students usually start: FSA credential theft

The FSA ID, the username and password that unlocks a student's FAFSA account on studentaid.gov, is the primary target in most financial aid phishing schemes. With those credentials, an attacker can file a falsified FAFSA in the student's name, redirect disbursements to a different bank account, and collect the student's full legal name, date of birth, and Social Security number as part of the same operation. Most students don't realize anything went wrong until a disbursement date passes with no deposit, Great Basin College warned in a June 2026 alert. By then, the funds have typically moved through multiple accounts and the scammer is unreachable.

Scammers deliver FSA credential theft through fake financial aid office emails, text messages claiming an account needs verification, and QR codes posted in physical campus spaces. The fake login page looks identical to studentaid.gov. Section 2 explains exactly how that delivery method works.

Never share your FSA ID. No financial aid office, no Federal Student Aid representative, and no scholarship organization has any reason to ask for your login credentials. Great Basin College warns that the FSA ID is a single-user credential, and sharing it with anyone is the entry point for everything described here. That same source notes that federal law prohibits charging anyone for help completing a FAFSA, meaning any request for payment in exchange for FAFSA assistance is fraudulent by definition. Free help is available directly through studentaid.gov and through your school's financial aid office.

Fake scholarship notices and job offers

A related scam follows a simple pattern: a student receives an unsolicited message congratulating them on winning a scholarship they never applied for, then is told to pay an upfront fee to release the funds. A surprise award notice paired with an upfront payment demand is a reliable red flag. Scammers prefer gift cards, wire transfers, and cryptocurrency because those transactions are difficult to reverse, Great Basin College notes.

Fake job offers work on a different pressure point. An NC State case documented by NC State student affairs staff involved a scammer impersonating a faculty member, advertising a research position paying $40 per hour, and sending the offer from a non-university email address to students who had never applied. "Some of these students are dealing with financial pressures and can't pay their rent month to month, so when someone offers them a good job, they're going to jump on it," NC State's Mike Giancola observed in early 2024. NC State confirmed that its faculty and staff will never email students from a non-NC State address to offer a job. Policies vary by institution, so check your campus directory if an offer's source seems off.

The overpayment check scam often surfaces in housing or job contexts. A scammer sends a check for more than the agreed amount, asks the student to deposit it and return the difference via Zelle or wire transfer, and disappears once the real money moves. The deposited check later bounces and the bank reverses the full amount. "Don't ever cash a check from someone you don't know. If someone sends you a check for more than what they owe you and asks you to return some of it, it's likely a scam," NC State advisors told students.

Government and law enforcement impersonation scams hit international students with particular force. Scammers spoof caller ID to appear as a sheriff's office or immigration authority, claim there is a warrant or visa problem, and instruct students not to hang up. Gift card payments are often demanded. "If someone asks you to pay them in gift cards, it's a scam 100% of the time," Giancola told NC State students. If you receive a call like this, hang up and contact your campus Office of International Services using the number listed on your school's official website.

QR codes: a link in disguise

A typed URL in an email gives a careful reader something to inspect before clicking. A QR code printed on a flyer reveals nothing about its destination until the phone has already processed it. University of Rochester IT described this directly in a June 2026 alert: "A QR code is just a link in disguise, and you can't tell where it leads by looking at it." Scammers exploit that gap with a technique called "quishing," short for QR-code phishing, embedding links to convincing fake login pages for student portals, financial aid sites, or bank accounts. Once a student enters credentials on the fake page, the attacker may have enough information to attempt an account takeover.

QR-code phishing was the fastest-growing threat category tracked in the first quarter of 2026. Combined with traditional phishing, scams and impersonation attacks accounted for nearly 44% of all tracked threats during that period, Great Basin College reported.

Quishing codes appear on bulletin board flyers near financial aid and registrar offices, in emails appearing to come from campus departments, in texts claiming a package is held or an account needs attention, and as stickers placed directly over legitimate QR codes at parking meters, printers, or event check-ins. Urgency language in the surrounding message, "verify your account now," "your financial aid is on hold," is a consistent warning sign, University of Rochester IT noted.

Four steps to scan more safely:

1. Use your phone's built-in camera. Third-party QR scanner apps from app stores may introduce their own security risks.
2. Read the URL preview your camera displays before tapping. A fake studentaid.gov page might use a domain like "studentaid-verify.com" (this is an illustrative example, not a documented scam domain). The preview exposes that kind of mismatch.
3. If the destination asks for login credentials or payment, close the scanner and type the official site address directly into your browser.
4. If something feels off, don't scan. University of Rochester IT puts it plainly: "When something feels off, don't scan."

Ghost student fraud: when your identity is the product

Ghost student fraud is a different category of threat. Students here aren't the direct targets of a phishing message. Their identities are the raw material for a larger operation.

Organized fraud rings use stolen personal information, or AI-generated "synthetic identities" that combine real data with fabricated details to defeat identity checks, to enroll non-existent people at colleges, complete FAFSA applications in their names, and collect federal aid refund payments. Victims, including minors, are often completely unaware their information is being used, the U.S. Treasury's Financial Crimes Enforcement Network (FinCEN) reported in an alert issued last week. A related variation called "straw student" fraud recruits real individuals who voluntarily provide their information to fraud rings in exchange for a fee, with the fraud ring enrolling them at institutions and collecting aid refunds in their names, FinCEN reported. Participating carries legal consequences for the individuals involved.

Once fraudulent aid refunds are collected, they are typically laundered through money mules, shell companies, and fraudulent accounts. Banks tracking these payments may see ACH transfers labeled with a college name and the word "refund," for example "LCC REFUND" or "Local Community College Refund [Student Name]," as potential fraud indicators, FinCEN noted. That operational detail matters for enrolled students: it means legitimate refund transfers from a school look structurally similar to fraudulent ones, which is part of why identity verification at enrollment has become a federal priority.

The scale is concrete. The College of Southern Nevada wrote off $7.4 million in a single semester due to fraudulent enrollments, according to the U.S. Department of Education. That same source cited 2024 media reports alleging that Foothill-De Anza Community College District received around 26,000 applications, with approximately 10,000 held for possible fraud review before a single quarter began. Community colleges and smaller institutions have been identified as especially vulnerable to these coordinated schemes, Great Basin College reported.

The classroom impact is real too. When fraud rings fill enrollment rosters with fictitious students, legitimate students may find courses closed or waitlisted, capacity consumed by applicants who never existed, FinCEN noted. A student whose identity was used in one of these schemes may also face enrollment complications or aid holds they can't immediately explain. If you encounter unexpected aid delays or enrollment problems with no clear cause, contact your financial aid office directly and ask whether an identity verification flag is associated with your account.

The U.S. Department of Education embedded real-time fraud screening directly into the FAFSA in April 2026, in what it called the largest nationwide fraud prevention effort in its history. Every applicant is now evaluated during submission, and those flagged as higher-risk must present government-issued photo identification before aid is released. The Department estimates these measures will prevent more than $1 billion in fraudulent disbursements during the current FAFSA cycle. Schools may send legitimate verification requests as part of this process. Confirm any such request through your school's official website before responding, not through a link in the notification itself.

If it already happened: what to do right now

Your FSA ID credentials may have been compromised

1. Change your FSA ID password immediately at studentaid.gov. Do not wait.
2. Log into your account and check that the bank account information and contact email on file are yours. If anything has changed, screenshot the unfamiliar details before correcting them.
3. Report suspected unauthorized access through the help resources at studentaid.gov.
4. Contact your school's financial aid office the same day. Great Basin College warns that by the time a missing disbursement is confirmed, funds have typically already moved and cannot be recovered easily. Do not wait for the next disbursement date to confirm the problem.

You paid a fake fee, deposited a fraudulent check, or sent money via Zelle or wire transfer

1. Contact your bank or credit union the same day. Report the transaction as fraud and ask specifically about reversal options. Wire transfers and peer-to-peer payments are often difficult to reverse, but reporting quickly gives your bank more options to review the transaction.
2. File a fraud report at reportfraud.ftc.gov.
3. Check whether your campus offers free student legal services. Staff there can help you document what happened and understand your options at no cost.

Your Social Security number or other personal information was exposed

1. Consider placing a credit freeze with all three major credit bureaus: Equifax, Experian, and TransUnion. A freeze prevents new accounts from being opened in your name.
2. File an identity theft report at identitytheft.gov, an FTC resource that generates a step-by-step personalized recovery plan.
3. Contact your campus IT security office. Your institution may be able to help check your accounts or device at no cost to enrolled students.

You suspect your identity was used to create a ghost student enrollment

Contact your school's financial aid office and registrar directly and ask whether any FAFSA or enrollment record exists under your name that you did not create. If you find fraudulent records, file an identity theft report at identitytheft.gov and report the situation to Federal Student Aid.

Steps that apply in any scenario

• Report suspected FSA account access to both Federal Student Aid and your financial aid office.
• Contact official offices with authority to act, not just friends or family.
• Keep records of every communication, transaction reference, and screenshot. You will need them.

Check your account before the semester starts

The federal protections added in April 2026 catch a significant volume of fraudulent applications before aid is released. They do not eliminate the risk to individual students whose FSA credentials are compromised directly.

Log into your studentaid.gov account now and confirm that your name, contact email, and linked bank account are accurate. Write down your expected disbursement dates and your school's financial aid office phone number and official email address. If anything looks unfamiliar, contact your financial aid office immediately using contact information from your school's official website, not from any email, text, or QR code that directed you to check the account in the first place.