Back-to-school scams are flooding phones and inboxes across the US

As millions of Americans prepare for a new school year, cybercriminals are launching their own seasonal scam campaigns.

Researchers at Bitdefender Labs have identified multiple SMS and email campaigns targeting students, parents, teachers, and others preparing for the school year. From fake education grants and Pell Grants to free laptop offers, discounted AI subscriptions, and delivery notifications, scammers are seeking to take advantage of the approaching new school year.

Key takeaways

• Fake education grant text messages are among the most prominent back-to-school scam trends Bitdefender Labs is seeing this season.
• Scammers are impersonating grant programs and promising thousands of dollars with "no repayment required."
• Other campaigns offer fake scholarships, financial aid, or free laptops to lure victims into clicking phishing links.
• While SMS scam campaigns have reached people across the United States, our mobile telemetry shows that Florida, Texas, Georgia, and California have emerged as some of the most heavily targeted states.
• Email scammers are capitalizing on students' growing interest in AI by promoting fake or misleading premium AI subscriptions and study tools.
• Increased online shopping for school supplies also brings a rise in fake delivery and Amazon-related scams.

Fake education grant texts promise thousands of dollars

The largest SMS campaigns we've observed promise recipients between $6,500 and nearly $8,000 in education grants. Nearly every message follows the same formula: you've supposedly been selected, the money is waiting, and you must act immediately before the opportunity disappears.

Some examples include:

"Rick, Your $7,395 edu grant is set to expire on Thursday. No payback. Get your funds now. [Redacted Phishing Link] STOP to end."

"Patty, Your $7945.00 edu grant is expiring tonight. No payback. Get yours today before it expires 7/30. [Redacted Phishing Link] STOP to end."

Bitdefender Labs telemetry shows these campaigns primarily target Florida, Texas, and Georgia, although similar messages have been delivered to recipients across many other US states.

The goal isn't to award financial aid. Instead, victims are directed to phishing pages designed to collect personal information or persuade them to engage with fraudulent offers.

Pell Grant scams make the messages appear legitimate

Another variation abuses the name of the US Federal Pell Grant program to make scam messages sound more credible.

One example reads:

"Denelle, your $6,850 Pell Grant is close to expiring. No repayment required. Confirm by Sunday before it closes. [Redacted Phishing Link] STOP to end."

These messages again heavily targeted Texas, Georgia, and Florida, while similar scams were also observed elsewhere across the country.

The mention of a well-known government education program may encourage recipients to let their guard down, especially if they're actively seeking financial aid before the semester begins.

"Money for school" texts avoid mentioning government programs

Not every campaign pretends to be a government agency.

Some simply promise money for education without explaining where it comes from.

For example:

"Hi Tx, up to 7,395 is available for school and it's yours to keep. Check now: [Redacted Phishing Link] Reply Stop to Quit."

These messages were most commonly seen targeting California, Florida, and Georgia, although recipients in other states also reported receiving similar texts.

The vague wording is intentional. Rather than impersonating a specific organization, scammers simply tempt recipients with the promise of easy money.

"Free laptop" offers target students

Back-to-school shopping means many families are looking for affordable technology, making laptops another popular lure.

One campaign tells recipients:

"HURRY! This New Laptop Opportunity Won't Last Long. Get One Delivered Right To You. Click Here: [Redacted Phishing Link] Text stop to end."

Instead of receiving a free device, victims are directed to phishing websites or pages requesting personal information under the guise of verifying eligibility.

AI has become a new back-to-school lure

It's not just SMS campaigns that are evolving.

Bitdefender's antispam telemetry shows scammers increasingly exploiting the popularity of AI tools among students.

One campaign spotted by researcher Viorel Zavoiu impersonates Google and advertises what appears to be a discounted Google AI Premium subscription. The emails promote 18 months of premium access for a one-time payment, encouraging recipients to believe they can unlock premium AI services at a heavily discounted price.

The emails rely on urgency and the promise of long-term premium access to persuade recipients to click embedded links before the offer supposedly expires.

As students prepare for classes, interest in AI assistants for research, writing, note-taking, coding, and other schoolwork creates an ideal opportunity for scammers to disguise fraudulent offers as useful educational tools.

We're also seeing AI-themed email campaigns such as:

• ChatGPT Plus for students
• Free AI subscriptions
• Premium student AI accounts
• Education AI services
• AI study assistants
• AI homework tools

Not every email promoting AI tools is malicious. However, these themes are increasingly being used by scammers, spam operators, and affiliate marketers to attract clicks from students eager to prepare for the school year.

Don't forget about delivery scams

Back-to-school season also means millions of online purchases.

Families order laptops, backpacks, clothing, school supplies, textbooks and dorm essentials. Scammers know this all too well.

Bitdefender researchers also see seasonal spikes in fake delivery notifications and Amazon-themed scams that claim there's a problem with an order or package.

These messages often urge recipients to:

• Verify shipping information
• Pay a small delivery fee
• Confirm account details
• Click a tracking link

In reality, the links typically lead to phishing websites designed to steal login credentials or payment information.

Why these scams work

Back-to-school season creates the perfect environment for social engineering.

Parents are trying to reduce expenses. College students are searching for scholarships and grants. Adults returning to school may be looking for financial aid or discounts. At the same time, many people are buying new devices and experimenting with AI tools to prepare for classes.

Scammers simply insert themselves into those everyday activities.

By combining urgency, personalization, and promises of financial relief, they make fraudulent messages appear both timely and believable.

Red flags to watch for

Whether a message arrives by SMS or email, watch for these warning signs:

• Unexpected offers for grants, scholarships, or financial aid you never applied for.
• Claims that money or benefits will expire within hours or days.
• Promises of "no repayment required" or guaranteed approval.
• Messages using your first name to appear legitimate.
• Unfamiliar or shortened links instead of official government, school, or company websites.
• Misspelled words or unusual characters such as "peII," "CIaim," or "stiII," which scammers sometimes use to bypass spam filters.

The trend extends beyond the United States

Although the United States is currently experiencing the largest wave of back-to-school SMS scams in our telemetry, similar education-themed campaigns are appearing worldwide.

Bitdefender Labs has also observed:

• Malaysia: Fake government aid programs offering free laptops for students and financial assistance.
• Nigeria: Fraudsters impersonating youth empowerment and government grant programs to collect banking information.
• Kenya: Fake student bursary schemes promising education funding.
• India: Bogus scholarship exams, AI education promotions, and scholarship giveaways.
• Peru: WhatsApp campaigns promoting AI thesis-writing courses that pressure students into making payments.

Resurgence of ‘Vote for My Child’ scams

In Malta: we're also seeing a resurgence of the WhatsApp "Vote for My Child" scam previously documented by Bitdefender Labs. While the original campaign spread rapidly across Europe by asking victims to vote for a friend's child in a dance competition, the current variants increasingly use scholarship and education-related themes, asking recipients to support a student competing for tuition assistance or an educational prize. Once victims click the link, they're tricked into sharing their WhatsApp verification code, allowing attackers to hijack their account and continue spreading the scam through trusted contacts.

Example: "Hi! Could you please vote for Sonya? She's the daughter of my close friends, and this is her only chance to receive a scholarship for tuition‑free education. Thank you [Phishing Link]"

While the names of the programs change from country to country, the tactics remain remarkably similar: exploit the cost of education, create urgency, promise financial assistance, and lure victims into handing over personal information.

How to stay safe

Before clicking any education-related offer, take a few moments to verify it.

• Never trust unsolicited texts or emails promising grants, scholarships, or free devices.
• Visit official government, university, or school websites directly instead of following links in messages.
• Be skeptical of offers that promise guaranteed approval or "free money" with no application process.
• Verify suspicious links using Bitdefender Link Checker before opening them.
• If you're unsure whether a message is a potential scam, ask Scamio, Bitdefender's free AI-powered scam detection tool, for a second opinion.
• A layered security solution with Scam Protection can help detect phishing links, scam websites, malicious SMS messages, and other scam attempts before they reach you or trick you into handing over sensitive information.

Disclaimer: This article is published for informational and educational purposes only. The information presented is based on technical research conducted by Bitdefender Labs and publicly available sources. Bitdefender does not make any legal determination regarding the activities described herein. The mention of any company, brand, domain, or individual does not constitute an accusation of illegal activity. The technical indicators and behavioral patterns described reflect observations made at the time of research and may change over time. Readers should exercise their own judgment and consult appropriate authorities or legal counsel if they believe they have been affected by any of the activities described. Domain names and URLs listed in this article are provided solely to help consumers and security professionals identify potentially harmful infrastructure. Bitdefender disclaims any liability for actions taken based on the information in this article.