Short answer: Your university account is usually your most valuable one — it holds your coursework, your grades, your student finance details, and a free Microsoft or Google licence attackers want. Set up the institution’s MFA properly with an authenticator app rather than SMS, enrol a second device, and secure your personal email separately. Do it before deadline season, because losing access the week a dissertation is due is a genuinely bad experience.
Why student accounts get targeted
Universities are attacked constantly, and students are the softest entry point.
Free software licences. Your .edu or .ac address usually carries Microsoft 365, Google Workspace, Adobe, and various developer tools. Those accounts are resold in bulk, which is why phishing aimed at students is so persistent. Design tools count here too — see our guide to free design software with Figma for students.
Storage and email for abuse. A university mailbox with a trusted domain is an excellent platform for sending phishing to everyone else at the institution — and to the outside world, since the domain has good reputation.
Student finance and personal data. Bank details for maintenance payments, home address, date of birth, and identity documents uploaded during enrolment. If you receive or spend that money through a mobile wallet, see how to secure your mobile wallet account.
Your actual work. Coursework, research data, and a dissertation with no other copy. This is the one that ruins a term.
Research access. For postgraduates, credentials that reach library systems and research data — a target for more organised actors.
Step 1: Set up the institution’s MFA properly
Most universities use Microsoft 365 or Google Workspace, so the setup will look like one of these:
- Microsoft — usually Microsoft Authenticator with number-matching push approvals. Follow the enrolment link IT sends, and see our Microsoft guide for the concepts.
- Google Workspace — 2-Step Verification, ideally with a passkey or Google prompt rather than SMS. See our Google guide.
- Duo — common in universities, push-based approval with a mobile app.
Choose the app, not SMS. Text codes are exposed to SIM swapping, and they fail exactly when you need them — poor signal in a lecture theatre, a foreign SIM during a placement, a phone with no credit. The comparison is in SMS vs authenticator apps.
Step 2: Enrol a second method — before you need it
This is the step students skip and then regret at 2am.
- Add a second device if your institution allows it — a tablet, an old phone.
- Save any backup codes offline. Print them and keep them in your room, not on the phone that holds the app. See where to store backup codes.
- Know where the IT helpdesk is and what identification they need. During term they are busy; during exam periods they are extremely busy.
- Back up your authenticator app — how to back it up.
Losing your phone is common. Losing your phone the week before submission is the specific scenario to plan for.
Step 3: Secure your personal email too
Your university account will be closed after you graduate — often within months. Anything registered to it becomes unreachable.
So:
- Use a personal email for anything you want to keep after graduation: banking, job applications, subscriptions, portfolio accounts. Shared streaming subscriptions deserve a look as well — does Netflix have 2FA.
- Secure that personal account with a passkey or authenticator app — it will outlive the university one.
- Do not use your university address as the recovery address for personal accounts. This is a very common mistake, and it strands people after graduation.
- Export what matters before your access ends: files, emails, contacts.
Step 4: Recognise student-targeted phishing
The scripts are consistent across institutions:
- “Your student account will be deactivated” — usually timed near enrolment or the start of term.
- “Your mailbox is full, verify to continue receiving mail.”
- Student finance or bursary payment messages asking you to confirm bank details.
- Fake job and internship offers, often with a “registration” step or a request for identity documents.
- Money mule recruitment disguised as part-time work — “receive payments and forward them for a commission”. This is a criminal offence, and students are recruited deliberately.
- Free software or textbook downloads carrying infostealer malware, which takes session cookies and bypasses 2FA entirely — session hijacking.
- Fake accommodation listings requiring a deposit before viewing.
The habit: never sign in from an email link. Go to the university portal yourself, from a bookmark.
Step 5: Practical campus habits
- Lock your laptop when you leave the library table. Ten seconds is enough for someone to do damage, and library theft is not rare.
- Do not sign in on shared lab machines for personal accounts, and never tick “remember this device” there — remember this device.
- Back up your work to at least two places. OneDrive or Google Drive plus a physical drive. A dissertation with one copy is a risk you are choosing to take.
- Do not share your login, ever — including with a friend who “just needs to print something”. Most institutions treat account sharing as a disciplinary matter.
- Beware “free” software from unofficial sources. Your institution probably licenses the real thing already.
Frequently asked questions
Can I use my own authenticator app instead of the university’s?
Usually yes for TOTP-based systems. Duo and some Microsoft push configurations require their own app. Ask IT — most are happy either way.
What if I lose my phone during exams?
Use a backup code or your second enrolled device. Otherwise the IT helpdesk with student ID. Plan for this in week one, not in week twelve.
Why does my code keep getting rejected?
Usually clock drift. Turn on automatic network time — why 2FA codes get rejected.
Do I need 2FA on my personal accounts too?
Yes, starting with your personal email. It is the account that will still matter in five years — see what is an authenticator app.
I’m going abroad on a year abroad or placement. What should I do first?
Move off SMS before you go, print backup codes, and enrol a second device. Authenticator codes work with no signal and in any time zone — see 2FA while travelling.
My account has been compromised. What now?
Tell IT immediately — they can end sessions centrally and check what was sent from your address. Then change your password, check for forwarding rules, and re-enrol 2FA. See what to do if your email is hacked.
The bottom line
Set up the university MFA with an app, enrol a second method the same day, and keep your personal email separate and well protected — because that is the account that survives graduation. Then treat every “your account will be deactivated” email as fake, because it almost always is.
Starting from scratch? Read our complete guide to two-factor authentication first.