Secure the account before the inbox gets busy

Use a clean setup session, not a link in an unexpected message.14

  1. Start from the school siteType the known domain or use a saved official app to reach email, billing and identity settings.
  2. Create a unique passwordDo not reuse the password from admissions, social media, shopping or a personal email account.1
  3. Enroll in MFAUse the method supported by the school and confirm what happens when the primary phone is lost.13
  4. Store recovery informationKeep backup codes in a password manager or another protected location separate from the phone.13
  5. Turn on useful alertsEnable sign-in, password-change and payment notifications without silencing them during the move.

Pause at these red flags

Scam messages often imitate the exact pressure of the pre-arrival month.

  • Urgent paymentA threat that housing, classes or aid will vanish unless money is sent immediately through a new link.12
  • Credential requestA form asking for a password, MFA code, FSA ID, full Social Security number or bank login.13
  • Unexpected attachmentA document described as a bill, schedule, scholarship or payroll form that you did not request.1
  • Too-easy opportunityA job, grant or scholarship that requires a fee, check deposit, gift card, equipment purchase or money transfer.2
  • Look-alike addressA sender or domain with an extra word, swapped letter or unrelated reply-to address.1

Verify without using the message

Use a second path that the sender did not control.

  • Is the task in the portal?Open the billing, housing or financial-aid portal independently and look for the same notice.4
  • Does the office publish this process?Compare the request with the office’s official payment, employment or scholarship instructions.4
  • Can the office confirm it?Call a number from the official website or forward the message to the school’s published security address.4
  • Did I already act?Change the affected password, end active sessions, contact the bank if needed and report the message promptly.1

Protect other people in the rush

Parents and students should agree on one verification rule for large or unusual payments. A quick call using a known number is safer than replying to a forwarded message while everyone is packing.4

Never share an FSA ID or student-account password, even with someone helping complete a form. Access can often be delegated through the school’s authorized-user process without surrendering the student’s identity.34

Student setting up multifactor authentication and storing backup codes
Set account recovery before travel, device changes or a lost phone make it urgent.
Student independently opening a university billing portal before making a payment
A real-looking email is not proof; verify the request inside a known portal.