UK student loans targeted by phishers in latest spam campaign

Filed Under: Data loss, Phishing, Privacy, Spam

Student in OxfordWith British students about to start another year at university, the last thing they probably want to hear is that there is a problem with a student loan.

But that's precisely the camouflage that online scammers are using to steal personal information today.

An email, claiming to come from Directgov UK, tells students that there is a problem with the online account for their student loan, and they need to update their account urgently.

Here's a typical spammed-out message we've seen in our traps:

Student loan phishing attack


Student Loan Update.

Message body:

Dear Student Finance Customer.

We at HM Government noticed your Student loan online log in details is incorrect and need to be updated.


Inline Verification. Directgov UK.

Attached file:

Student Loan Update.html

Clicking on the HTML attachment is not a good idea, however, as it will urge you to enter your details which are then sent via a website to the phishers.

Student loan phishing attack

Sophos products block the message as spam, and block the webpage that the HTML form is attempting to post the personal information.

Remember to always be suspicious of unsolicited attachments. Also, I would hope that a good student would have noticed the grammatical mistake in the phisher's email..

, , ,

You might like

5 Responses to UK student loans targeted by phishers in latest spam campaign

  1. Anon · 1497 days ago

    A bank/credit agency/any offical agency or organization would never send out a generic message for an issue as important as what the message was supposed to be for. And the second that the link asked for your security question AND Answer is a significant clue that this is fake.

    Hope people are wise enough not to send in their ino.

  2. Lisa · 1497 days ago

    Anon, you *know* they're not wise enough...that's why we have to have warnings like this. I mean, if we have to have "do not put in eyes" on our chemical cleansers....?

    • Machin Shin · 1497 days ago

      You have a very good point. How are we to expect people to be smart enough to protect themselves from scams online when we have to warn them about everything else. I mean it has reached the point that it is illegal to have a kinder egg in the US. The government has actually gone so far protecting idiots from themselves as to say they will come after me for having some chocolate! I'm sorry but any kid that is piggish enough to choke on a kinder egg deserves his fate.

      People have become far to dependent on others protecting them from harm. It is time for people to wake up and learn to protect themselves for a change and quit trying to blame others. It is not possible to stop the scam artist with any programs or code. The only way to stop them is for people to protect themselves and quit falling for the same old scams. I mean really, at this point if you have been under a rock for so long you do not know that the million dollars from Nigeria is a scam then you deserve what you get.

  3. Mark Warburton · 1494 days ago

    IF students are falling for this then all the money that has been piled into their education has been wasted. Even ignoring the generic mail and secret question question, people should be extremely suspicious when receiving anything like this via their email with no hardcopy, address or phone call.

    Talk about kicking dogs when they're down!



  4. student · 1492 days ago

    woah... many thanks for the heads up :)! shame about the comments though... some people need to get out more hey... :)

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley runs his own award-winning computer security blog at, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Follow him on Twitter at @gcluley