Students Are Advised About Financial Theft Through Cyber Fraud

The Georgia Tech Office of the Bursar, Office of Information Technology (OIT), and the Office of Scholarships and Financial Aid (OSFA) are warning students about cybertheft affecting student refund payments, including financial aid refunds.

Across higher education, cybercriminals are using email phishing scams, malicious web links, and other techniques to gain access to student credentials, often resulting in unauthorized changes to their financial information stored on file with their college or university. This can lead to the theft of their financial aid refunds or other payments from their institution. Victims may not realize their accounts have been compromised until they receive unexpected bills or notice discrepancies.

"As part of our ongoing commitment to strengthen our defenses against cyberthreats, OIT implemented stronger two-factor authentication (2FA) methods available to students, faculty, and staff at the Institute last summer," said Jennifer Rhodes, Georgia Tech's interim chief information security officer. "We encourage students to use 2FA methods such as Duo Mobile, YubiKeys, and passkeys to keep their accounts safe and to implement the use of 2FA as soon as they begin their enrollment."

Two-factor authentication resources for students can be found at oit.gatech.edu/two-factor-authentication.

"It is also important that students periodically review their banking information saved on the student portal - including the full account, routing, or debit card numbers - saved for direct deposit," said Georgia Tech Bursar Gloria Kobus. "Students should do so to ensure there have been no changes to the information that they did not approve."

Protect Your Accounts

The offices encourage students to also take the following steps to keep their accounts safe:

1. Only check your Georgia Tech financial aid application status and awards through BuzzPort (buzzport.gatech.edu), OSCAR (oscar.gatech.edu), or by contacting OSFA (finaid.gatech.edu).

1. To check Institute balances, make payments, or sign up for electronic student aid refunds, visit the Office of the Bursar's Student Payments Instructions webpage. Regularly verify your personal information on file.

1. Do not engage with suspicious emails by replying to the sender, opening attachments, or visiting links in the message. Report these emails by forwarding them as an attachment to OIT's Security Operations Center (SOC) at [email protected]. Microsoft Outlook application users can also employ its "Report" feature.

1. Pay special attention to website URLs. Malicious actors may use part of a trusted site domain, such as gatech.edu, in their URLs. Do not click on links that you are unsure of. Instead, visit websites by typing the URLs directly into your browser.

1. Choose strong passwords and keep them secure. Do not change your campus password through an emailed link; instead, only do so at Passport, at passport.gatech.edu. 

1. Do not approve 2FA requests you did not initiate. If you receive repeated 2FA approval requests that were not initiated by you, report this activity to the SOC at [email protected]. If you ever believe your Georgia Tech accounts have been compromised, contact the SOC immediately.

"We want our students to understand the importance of protecting their online accounts from the moment they begin their first semester," said Rhodes. "Though cyberthreats will likely always be around, personal awareness and vigilance are top defenses against them."