Visa and scholarship scams: how phishing targets students

Students are a good target for phishing because they are in a hurry, waiting for an answer that changes their life, and sending sensitive documents to strangers all the time. A message that says "you are selected" or "your visa slot is ready" gets opened quickly.

This is the security side of the problem: how the attack is built, and the checks that break it. For the student's side (fake agents, fake offers, what to do in Bangladesh), read Scholarship and visa scams in Bangladesh.

How the attack works

1. The bait. An email, WhatsApp or Telegram message claims you won a scholarship, were shortlisted, or that your visa application needs action.
2. The link. It points to a page that looks like a university, scholarship or visa portal. The address is different from the real one, often by a letter, a hyphen or an extra word.
3. The ask. The page wants a login, a scan of your passport, your bank details, or a "processing fee".
4. The damage. Your documents are used for identity fraud, your account is taken over, or your money is gone.

Red flags in the message

• Urgency and fear. "Reply within 24 hours or you lose your place."
• A prize you never applied for. If you did not apply, you were not selected.
• A fee. The big government scholarship programmes list their rules on their own sites; check there before believing that any payment is needed. Anyone asking you to pay to receive an award is a warning sign.
• Personal email addresses. A "university office" writing from a free mail account.
• Attachments you did not expect, especially .zip, .html or Office files asking you to "enable macros".

Red flags in the link

• Hover over the link (or long-press on a phone) and read the real address before you click.
• Look at the part right before the first single slash: login.university.example belongs to university.example, but university.example.login-check.net belongs to login-check.net.
• Lookalike letters, an extra hyphen, or a different ending (.net instead of the one the institution really uses) are common tricks.
• Shortened links hide the destination. Do not use them for anything involving documents or money.

The checks that stop it

1. Go to the site yourself. Type the address of the scholarship or university from the programme's own official page, or use a bookmark you saved earlier. Do not use the link in the message.
2. Confirm through a second channel. Find the contact details on the official site and write or call there. Ask whether the message is real.
3. Use a password manager. It fills your password only on the exact saved domain, so a lookalike page gets nothing, and that is a signal in itself.
4. Turn on two-factor authentication for your email first. Your email can reset every other account.
5. Send documents only after you have confirmed the recipient. A passport scan is hard to take back.

If you already clicked or paid

• Change the password of the account you entered, and of any other account that used the same password.
• Turn on two-factor authentication and sign out of other sessions.
• If you shared card or bank details, contact your bank at once.
• If you sent a passport scan, keep evidence (messages, emails, links) and report it to the real institution and to the police.
• Do not delete the messages: you may need them.

Takeaway: never act on the link in the message. Open the official site yourself, confirm through a second channel, and let a password manager tell you when the domain is wrong.