Phishing at university works because emails linked to studies look trustworthy. You expect registration deadlines, exam results or re-enrolment notices anyway, and fraudsters rely on exactly that expectation. This guide shows how to recognise suspicious emails before you click or enter login details.
Short answer: An email is not genuine just because it looks like it comes from a university. Check the greeting, the sender address, links, deadlines and attachments before you respond. Never enter login details through a link in an email. Open the site yourself instead. The Verbraucherzentrale (German consumer advice centre) lists these features as general warning signs for phishing emails. Last updated: November 2026.
The most important points
- The name in the greeting is not enough of a check, because sender addresses can be faked.
- Do not open links from the email. Call up the site yourself by a known route.
- Short deadlines and threats are meant to pressure you and count as suspicious.
- Do not open unexpected attachments, as they may contain malicious software.
- A request to confirm login details by email is a clear warning sign.
Why university emails make good bait
Emails linked to studies seem credible because they match your everyday life. Fraudsters therefore use occasions such as registrations, certificates, scholarships or re-enrolment. The Verbraucherzentrale describes phishing in general as an attempt to obtain personal data through forged messages.
The trick is that the email looks genuine. Logos, wording and sender names can be copied. That is why a check based only on first impressions is not enough. A structured check that does not depend on appearance is the better approach.
The checklist: how to spot suspicious emails
| Feature | Why it is suspicious |
|---|---|
| Missing name in the greeting | A missing name of yours is a warning sign. Criminals sometimes use personal greetings, though. |
| Sender address looks wrong | The sender address can be forged. Only the IP address in the mail header is reliable. |
| Login link | Legitimate providers send links only in exceptional cases and never to log in. Open the site in your browser instead. |
| Short deadlines or threats | They are designed to create pressure, for example with a supposed account block. |
| Unexpected attachments | Files usually contain malicious software. The Verbraucherzentrale also names cab and zip files. |
| Poor German or foreign-language emails | Missing umlauts and unusual phrasing are signs to note. |
| Recipient field does not show your address | A missing address of yours in the To field is a warning sign, although BCC lists also appear in legitimate emails. |
No single feature proves fraud on its own. Several signs together give a clear picture. Checking through the official site remains the safe route in every case.
What to do if you have already clicked
Change your password immediately through the official login page, not through a link in the email. Check whether you entered data on the fake page, and inform your university IT service. If you see suspicious payments, contact your bank as well.
Even if you only clicked and entered nothing, a report is worthwhile. It allows the university to warn other students before more accounts are affected.
Frequently asked questions
Is an email genuine if it comes from the correct domain?
Not necessarily. Sender addresses can be forged. Check the link by opening the site through a bookmark or the homepage instead of clicking the link in the email.
What if the email looks like it came from my university, but the link seems odd?
Open the university website through saved bookmarks or its homepage. You will usually find the same information there, without the detour through the email.
Should I report suspicious emails?
Yes, if you are unsure. A report to the responsible office at your university helps issue warnings and protects accounts. Do not delete the email hastily before that office has seen it.
What if the email looks perfect?
Then the check itself matters most: sender, link, pressure and attachments. Carefully made emails can also be forged. Checking through the official site protects you however genuine the email appears.
How does this differ from bank phishing?
Bank phishing uses a different sender and different occasions. The features overlap, but the Verbraucherzentrale guide on phishing emails from banks shows the typical differences.
Typical patterns in university emails
Fraudulent emails in a university context often repeat similar patterns. They rely on time pressure, look official and ask you to take an action you would not normally take. Knowing these patterns helps you spot suspicious messages faster.
- A registration deadline is said to expire “today”, and without confirmation there are supposed disadvantages.
- You are asked to log in through a link with your university credentials.
- A certificate or notice is supposedly attached.
- A supposed office asks for bank details, for example for a refund.
Such wording is no proof of fraud, but it calls for a closer check. If the request involves money, a password or bank details, stop and verify the matter through a separate route.
Why you should be careful with attachments and links
Attachments such as notices or forms are a popular tool because they look official. The Verbraucherzentrale points out that unexpected files usually contain malicious software. Do not open them, even if the sender seems familiar, and ask through your own route instead.
Links often lead to pages that look very much like the original. Read the address carefully, because small differences in letters or endings are typical. If in doubt, open the site through a bookmark.
What to document in a suspected case
If you consider an email suspicious, save it before you delete it. Keep the full mail header, the time of arrival and the wording of the request. This helps the IT service at your university see which accounts could be affected and warn other students more precisely.
Stopping is almost always the right move. A legitimate office is rarely in a hurry, and a short check costs you a few minutes at most. When you write back, use the contact address you already know, not the address that sent the suspicious email.
So what do you do now?
- Check the greeting, the sender address and the recipient field.
- Do not open links or attachments from the email. Open the site yourself.
- Never enter login details through a link in an email.
- Report suspicious emails to the IT service at your university.
Related reading
- Consumer rights in everyday life: protection against fraud and unfair contracts
- Phishing emails from your bank: how to recognise them
- Parcel phishing: how to recognise fake delivery notices
- Phishing losses: does insurance pay the money back?
- Social media account hacked: first steps for students
Sources:
Verbraucherzentrale: recognising phishing emails (status 25 March 2026, German original)
Last updated: November 2026. This guide is general information, not individual advice.
