1. The “Off-Portal” Red Flag

The most important rule in 2026 is the Origin Rule.

• The Scam: You receive an email or WhatsApp from an “Admissions Officer” with a direct link to a “New Payment Portal.”
• The Reality: Legitimate universities almost never send direct links to payment pages via text or social media.
• The Fix: Always log in to your official Student Portal (e.g., my.university.edu.au) first. Only follow the “Make a Payment” links found inside your secure, password-protected account.

2. Domain and SSL “Spoofing”

In 2026, simply seeing a “padlock” icon isn’t enough, as scammers can easily obtain SSL certificates.

• Look-alike Domains: Check for subtle typos. A scammer might use payments-unimelb.com instead of the official unimelb.edu.au/payments.
• The “.edu” Gold Standard: In Australia and the US, official university sites must use .edu.au or .edu. If the payment site ends in .com, .net, or .org, it is almost certainly a scam.
• The “About” Test: On a fake site, clicking links like “About Us,” “Privacy Policy,” or “Contact” will often lead to a 404 error or redirect you back to the home page.

3. AI-Generated Design Flaws

While AI can clone a logo perfectly, it often struggles with the “deep” architecture of a website.

• Grammar & Tone: Scammers often use AI to write their copy, but they frequently miss the specific academic tone. Look for phrases like “Pay now to avoid visa cancellation” or “Immediate discount for early birds”—real universities use more formal, less threatening language.
• Inconsistent Graphics: Look at the university logo. If it looks slightly blurry (pixelated) while the rest of the text is sharp, it’s a copy-paste job.
• Limited Payment Options: Fake portals often steer you toward “untraceable” methods like Cryptocurrency, Zelle, or direct bank transfers to a personal name. Official portals like Flywire or Convera will always offer multiple, verifiable options.

4. 2026 Verification Checklist

5. The “Personal Account” Trap

A real university will never ask you to transfer money into an account held in an individual’s name (e.g., “John Smith – University Treasurer”). All legitimate payments are made to the Institution’s Legal Name or a verified partner like Flywire, Convera, or Geoswift.