Your free Student safety pack

Signs it's fake

• A link asking you to "confirm" or "update" your bank details
• A deadline, such as "within 24 hours or your payment will be cancelled"
• A tax refund offer — students rarely have one due, and HMRC doesn't text links for them
• A sender address or link that isn't on gov.uk

How to check

Don't use the link. Open the Student Finance or HMRC website or app yourself, and log in there. If there's really a problem, it will show in your account.

If you entered your details

• Change your Student Finance password straight away, and any account that used the same password
• Call your bank on 159 if you gave card or bank details
• Contact Student Finance using the number on their website
• Forward scam texts to 7726 and scam emails to report@phishing.gov.uk

Warning signs

• The rent is noticeably cheaper than similar places nearby
• The "landlord" is abroad and can't show you round
• You're asked to pay a holding deposit before viewing
• Payment by bank transfer to a personal account, or in cryptocurrency
• Pressure that "lots of other students are interested"

Safer ways to rent

View in person, or ask a friend to. Use your university's accommodation service or a letting agent you can check. In England, a deposit should be protected in a government-approved scheme, and you should be told which one.

Search the property photos online. If the same pictures appear in other adverts, walk away.

If you've already paid

Call your bank straight away on 159, report it to Action Fraud on 0300 123 2040, and tell your university's accommodation office.

How the offers look

• "Work from home, no experience needed, earn hundreds a week"
• A "company" that wants your bank details before any interview
• Requests to receive money and transfer it on, or buy gift cards or crypto
• Paid "tasks" like liking videos, which later ask you to pay in first

What to do

Never let anyone else use your bank account, however small the amount. Genuine employers pay you a wage; they don't send money for you to pass on.

If you've already said yes, stop and talk to your bank now. Being honest early makes a real difference.

The simple rule

Keep at least two copies of anything that matters, and one of them not on your laptop.

• Save coursework in the OneDrive or Google Drive account your university gives you
• Check that the files sync — look for the tick or cloud icon
• Keep a second copy somewhere else, such as a USB stick or a backup service
• Email yourself the final version before you submit, as a last resort

Sync is not quite backup

If you delete a file or it gets corrupted, cloud sync can copy that mistake everywhere. A proper backup keeps older versions, so you can go back to yesterday's copy.

If your laptop dies

Don't keep switching it on and off. If the drive is failing, that can make recovery harder. Stop and get it looked at.

Act fast

• Check your email for a message from the platform saying your email or password was changed — it often has a "secure your account" link
• Use the app's official "hacked account" help page, not someone offering to recover it for a fee
• Change the password on your email account too, in case that was the way in
• Warn friends from another account not to reply to messages from you

Stop it happening again

• Turn on two-factor authentication, ideally with an authenticator app
• Never share a login code, even with a friend
• Use a different password for every account; a password manager helps
• Be wary of "vote for me" and "is this you in this video?" links

Beware recovery scams

People who post about being hacked are often contacted by "hackers" offering to get the account back for a fee. They can't, and they'll take your money.

What's still worth worrying about

The threats that survive are about who you're connecting to, not what passes over the air.

• Fake hotspots named to look official — "Hotel Guest WiFi Free" sitting next to the real one
• Sign-in pages that ask for far more than they need, or ask you to install something
• Certificate or security warnings in the browser, which you should never click past on a public network
• File sharing left switched on, exposing folders to everyone else on the network
• Someone simply reading your screen over your shoulder

Simple habits that cover most of it

None of this requires extra software.

• Ask staff for the exact network name rather than guessing from the list
• Turn off automatic joining of open networks, so your phone doesn't reconnect to a fake one later
• Set the network as Public on Windows, which switches off sharing
• Use your phone's own mobile hotspot for anything sensitive — it's usually faster anyway
• Keep the device patched, and keep antivirus running

Does a VPN help?

It genuinely does two things: it stops the network operator and anyone else on it seeing which sites you visit, and it protects you on badly configured or hostile networks. On a hotel, airport or conference network that's worth having.

What it doesn't do is make you anonymous or protect you from phishing, malware or a weak password. Treat it as one sensible layer rather than a shield. If you use one, pay for a reputable service — free VPNs make their money by selling the very browsing data you installed them to protect.

For people working away from the office

If work data travels with you, a VPN stops being optional. So does full-disk encryption (BitLocker on Windows, FileVault on a Mac), because the realistic loss is a laptop left on a train rather than anything clever happening over Wi-Fi.

Make sure remote access to the office goes through a VPN or a properly secured gateway with two-factor authentication — exposed remote desktop is still one of the most common ways businesses are breached.

Why reuse is the whole problem

When a company is breached, the stolen email-and-password pairs are sold in bulk. Automated tools then try those pairs on hundreds of other sites — email, shopping, banking. If you reused the password, they're in, and no amount of capital letters or exclamation marks helps.

You can check whether your own address has appeared in a known breach at haveibeenpwned.com. Most people are on at least one list, which is normal — it only matters if the password is still in use somewhere.

What a good password looks like now

The old rules produced passwords that were hard for people to remember and easy for computers to guess. Length beats complexity.

• Three or four unrelated words strung together, for example purple-harbour-kettle-92
• At least 14 characters where the site allows it
• Nothing drawn from your life: no names, pets, birthdays, street or football team
• No pattern you repeat across sites, like the site name plus your usual password
• Change a password when there's a reason to — not on a routine every 90 days

The three passwords worth memorising

You only need to hold a few in your head. Make these three long, unique and unwritten:

• Your email password — it's the master key, because every other account resets through it
• Your password manager's master password
• Your computer or phone unlock code

How a password manager actually works

It's an encrypted vault. You remember one strong password; it remembers everything else, generates new ones and fills them in for you. Bitwarden and 1Password are both sound choices, and the ones built into Apple, Google and Microsoft accounts are fine too if you live inside one of those.

The common worry — "isn't it dangerous to keep them all in one place?" — is understandable but backwards. The realistic risk isn't the vault being cracked; it's you reusing one password across 40 sites because remembering 40 is impossible.

If you'd rather use paper

A notebook is far better than reusing one password everywhere. Burglars are not after your passwords; automated credential stuffing is. Keep the book somewhere sensible, don't write the website next to each one in obvious terms, and never keep it in a file called passwords on the computer itself.

Why it works

A stolen password becomes useless on its own. The attacker has half of what they need, and the other half is sitting in your pocket. That's why almost every serious attack now tries to get around 2FA rather than through it.

The types, best first

They are not all equal, though any of them beats nothing.

• Security key or passkey — a physical key or your phone's fingerprint/face unlock. Phishing-proof, because it will only work on the real website
• Authenticator app — a six-digit code that changes every 30 seconds. Free, and works without signal
• Push approval — a "was this you?" prompt. Convenient, but never approve one you didn't trigger
• Text message code — the weakest, because numbers can be hijacked, but still far better than a password alone

Where to turn it on first

Start with the accounts that unlock everything else, then work outwards.

• Email — first, always; it's how every other account is reset
• Online banking and payment accounts
• Your Microsoft or Apple account
• Anywhere a card is stored: Amazon, PayPal, the supermarket
• Social media, so nobody can impersonate you to your friends
• For a business: remote access, accounting software and the payroll system

Set up recovery before you need it

This is the step people skip, and it's the one that causes the lockouts.

• Save the backup or recovery codes each service gives you — print them or store them in your password manager
• Add a second method, such as a partner's phone number or a second authenticator
• If you use an authenticator app, pick one that backs up to your account, so a new phone restores everything
• Don't store the codes only on the same phone that holds the app

Never approve a prompt you didn't ask for

If a code arrives or your phone asks you to approve a sign-in and you weren't signing in, somebody has your password. Don't approve it, and don't read the code to anyone who rings about it — that phone call is part of the attack.

Change that password straight away, then check the account's list of signed-in devices and remove anything you don't recognise.