Response to fake Student Finance message

Responding to a fake Student Finance message is a common situation and there is a clear set of practical steps to limit any harm. What matters most now is how much information you gave away, so the priority is to work out what the scammers could do with it and to shut down those risks quickly.

Work out what you actually disclosed

The right response depends on exactly what you handed over. Think carefully about what was in your reply or on any website you were taken to:

If you gave bank or card details (account number, sort code, card number, CVV, online banking login), treat this as urgent because your money is directly at risk.

If you gave login details for your Student Finance account or your email, the concern is that someone can access those accounts, change your details and redirect payments.

If you only gave personal information (name, date of birth, address, customer reference number, National Insurance number), the risk is more about identity theft and future targeted scams rather than an immediate loss of funds.

If you clicked a link but did not actually enter anything, your risk is lower, but you should still be alert to malware and follow the reporting steps below.

Immediate steps if you gave financial details

1. Contact your bank straight away using the number on the back of your card or in your banking app, not any number from the suspicious message. Tell them you have been scammed. They can block your card, stop payments, monitor for fraud and reissue cards. Most banks have a 24-hour fraud line.

2. If money has already left your account, ask the bank about reimbursement. Under the mandatory reimbursement rules for authorised push payment fraud that now apply to bank transfers within the UK, victims tricked into sending money can often be reimbursed by their bank, subject to some conditions and a possible excess. If the bank refuses and you are unhappy with its final response, you can escalate to the Financial Ombudsman Service free of charge.

3. Check your statements and recent transactions for anything you do not recognise, and report each one to the bank.

Immediate steps if you gave passwords or account logins

Change the password on your Student Finance account, your email account, and any other account that uses the same or a similar password. Scammers often reuse leaked passwords across multiple sites, so any account sharing that password should be updated to a unique one. Turn on two-factor authentication wherever it is offered, especially on your email, because your email is the gateway to resetting other passwords.

If you can no longer log in to your Student Finance account because the details have been changed, contact the Student Loans Company directly to regain control and secure it.

Report it to the Student Loans Company and the authorities

The Student Loans Company runs an Economic Crime Unit specifically for this. Report the scam message and the fact that you responded by:

Calling the SLC dedicated fraud hotline on 0300 100 0059.

Forwarding the scam email or reporting the text to [email protected], which is the National Cyber Security Centre reporting address. Suspicious texts can also be forwarded to 7726 (free) so the mobile network can investigate.

SLC will never ask you to confirm personal or financial information by email or text, so any message doing that is a scam. Reporting it helps SLC secure your account and helps get the fake site taken down.

If you have lost money or believe fraud has been committed, also report it to Action Fraud, the national reporting centre for fraud and cybercrime in England and Wales, on 0300 123 2040 or through their website. You will receive a crime reference number, which can be useful when dealing with your bank.

Protect against identity theft

If you gave away enough personal information for someone to impersonate you, such as your date of birth, address and National Insurance number, consider protective monitoring. You can register with Cifas for its Protective Registration service, which places a warning flag on your credit file so lenders carry out extra checks before granting credit in your name. Checking your credit report with the main credit reference agencies will help you spot any accounts or applications you did not make.

Be alert to follow-up scams. Once your details are circulating, you may be targeted again, sometimes by someone pretending to be your bank, the police or a fraud recovery service offering to get your money back for a fee. Treat any such contact with suspicion and always verify independently using official numbers.

Check your device

If you clicked a link or downloaded anything, run a security scan with reputable antivirus software and make sure your operating system and apps are up to date. If you entered credentials on a fake page, the main risk is the credentials themselves rather than your device, but a scan is a sensible precaution.

Keep evidence

Before deleting anything, keep a copy of the scam message, screenshots of any website you were taken to, and a note of the date, time and exactly what information you provided. This helps SLC, your bank and Action Fraud investigate and supports any reimbursement claim.

What matters most next

The single most important action is to contact your bank immediately if any financial or card details were shared, because speed directly affects whether payments can be stopped and money recovered. Alongside that, report the scam to SLC and the NCSC so your Student Finance account is protected and future payments are not diverted. If you only clicked a link or gave limited personal details, the situation is far less serious, but changing reused passwords and staying alert to follow-up approaches remains sensible.

If you can tell me exactly what you disclosed and whether any money has moved, I can give you a more targeted list of priorities.