Email security for universities and colleges: the risks and what to do

A university runs email for a small city. Thousands of students, faculty, researchers and staff share one domain, many departments send their own mail, and a new class of first-year students arrives every fall. Criminals know this, and higher education sees some scams built around how campuses work. This guide covers those threats, what the Department of Education says about FERPA and GLBA, and a checklist for central IT.

What email threats do universities face?

Universities see ordinary phishing, plus several schemes aimed at how students are paid and how institutions buy.

Fake jobs sent to student accounts

Federal agencies have warned about this for years. In a January 2017 alert, the FBI said scammers "advertise phony job opportunities on college employment websites" and also email students directly at their school accounts. The student is sent a check, deposits it, keeps a share as "pay" and wires the rest on. Then "the checks are confirmed to be fraudulent by the bank" (FBI IC3). The FBI's advice is blunt: "Never accept a job that requires depositing checks into your account or wiring portions to other individuals or accounts." The FTC repeated the warning in April 2024: scammers send emails that look like they're from "a professor or an office at your college", and "if a new employer mails your first paycheck before you even start working, that's your cue to stop" (FTC).

Here's an example of the pattern to put in student awareness material:

Example: "Hi, Professor Lee's research group needs a part-time personal assistant. Flexible hours, $400 a week. Reply with your personal email and cell number to receive your first assignment."

The professor's name is often real, taken from a department website. Our guide to fake job offer scams covers the other versions.

Fake procurement requests in your name

You can be impersonated to your own vendors. The GSA Office of Inspector General warns that scammers pose as federal, state, local, hospital or university procurement staff, often with real officials' names, and send requests for quotes from addresses that look official but use domains like .net, .org or .com (GSA OIG). The vendor ships laptops or equipment to a drop address and is never paid. When the invoice reaches your real purchasing office, nobody has a record of the order. Publish a short notice on your procurement page saying how real requests reach vendors and which domain they come from.

Payroll and refund diversion

A stolen student or employee password lets an attacker sign in to self-service systems and change where money goes. Treat any change to bank details, especially one made shortly after a password reset or from an unfamiliar sign-in, as something to confirm. See payroll diversion scams and vendor invoice fraud for the verification steps.

Why is university email harder to protect than business email?

University email is harder to protect because it combines huge account numbers, constant turnover and decentralized sending. A company of 300 people can know every service that sends mail as its domain. A university often can't, at first.

• Scale and turnover. Every term adds and removes thousands of accounts. New students haven't yet learned what real university email looks like.
• Decentralized senders. Admissions, alumni relations, athletics, the library and individual labs may each use their own mailing, survey or ticketing service. Each needs SPF or DKIM set up, and SPF allows only 10 DNS lookups. See SPF too many DNS lookups.
• Many subdomains. Departments often have their own subdomains, and some send mail. Unused ones can be spoofed or taken over. See subdomain takeover.
• Open directories. Faculty and staff addresses are published on purpose, which also feeds attackers' target lists.
• Personal devices. Students read mail on their own phones, where the sender's full address is often hidden.

Does FERPA require email security?

No. FERPA doesn't list email security controls. The Department of Education's student privacy site says FERPA "does not require educational institutions to adopt specific security controls", but that "Educational institutions should take appropriate steps to safeguard student records." It also warns that "Breaches of educational data are common and can lead to a violation of FERPA" (US Department of Education).

The same page points colleges somewhere stricter. It says "Title IV Participating Institutions are subject to Gramm Leach Bliley Act (GLBA) data security requirements", and refers postsecondary institutions to Federal Student Aid (FSA) for the details.

What GLBA means for a Title IV institution

GLBA is the Gramm-Leach-Bliley Act. Its Safeguards Rule, run by the FTC, sets the parts of an information security program. Federal Student Aid says each institution "has agreed in its Program Participation Agreement (PPA) to comply with the GLBA Safeguards Rule" (FSA, February 2023). The amended rule took effect June 9, 2023. For email, the relevant pieces include:

• MFA "for anyone accessing customer information on its systems". Staff mailboxes in financial aid, the bursar and admissions usually hold that information.
• Encryption of customer information "while it is in transit outside its systems or stored on its system".
• Service provider oversight. FSA's April 2024 announcement repeats that institutions must select capable providers, require safeguards by contract and periodically assess them (FSA, April 2024). Your email platform and any filtering service are service providers.
• Breach reporting. The same announcement says institutions "must immediately report breaches within 24 hours after the incident is known or identified", through FSA's Cybersecurity Breach Intake page.

Our FTC Safeguards Rule guide maps each requirement to email controls, so we won't repeat it here. This is general information, not legal advice. Your general counsel and compliance office decide what applies to your institution.

How should a university roll out DMARC across departments?

Roll DMARC out in stages: monitor first, find every department's senders, fix their authentication, then enforce. DMARC is a DNS record that tells receiving servers what to do with mail that claims to come from your domain but fails SPF and DKIM checks. CISA's joint phishing guidance asks organizations to "Ensure DMARC is set to 'reject' for sent emails" (CISA and partners, October 2023).

A monitoring record for a university might start like this (example domain):

_dmarc.example.edu  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.edu"

1. Publish p=none with a reporting address and collect aggregate reports for at least a few weeks, across a term start if you can. Those reports show every service sending as your domain.
2. Match each sending source to an owner. Expect surprises, such as a lab's survey tool or an old alumni platform. Our guide to unknown sources in DMARC reports helps sort them.
3. Fix authentication per service. Give each vendor its own DKIM key on your domain or a departmental subdomain. See authenticating third-party senders.
4. Decide the subdomain policy. The sp= tag sets policy for subdomains that have no DMARC record of their own. See DMARC subdomain policy.
5. Move to p=quarantine, then p=reject, once reports show your real senders passing. Our none to reject guide covers the pacing.

DMARC protects your exact domain. It doesn't stop lookalikes. Impostors often register lookalikes in other endings, such as example-university.com or exampleedu.org. See lookalike domain phishing.

How should universities manage student, alumni and departed accounts?

Manage accounts by role and lifecycle. Most account abuse on campus comes from accounts nobody is watching.

Two controls do most of the work. First, stop compromised student accounts from reaching everyone: limit who can send to all-staff and all-student lists, as described in restricting who can email distribution lists. Second, watch for the signs of a compromised account, especially new forwarding rules to outside addresses. Our K-12 guide shows how to restrict student mail in Google Workspace if you need it for younger students in dual-enrollment or lab-school programs.

What higher education resources can help?

The research and education community shares a lot. Three resources are worth knowing:

• EDUCAUSE's HECVAT. The Higher Education Community Vendor Assessment Toolkit is a standard security and privacy questionnaire for vendors, created by EDUCAUSE's Higher Education Information Security Council. Use it when you evaluate email, filtering and cloud services, and check what the vendor stores and where.
• REN-ISAC. The Research and Education Networks Information Sharing and Analysis Center lets member institutions share threat intelligence with peers. Check its current membership terms.
• FSA's cybersecurity announcements. FSA publishes GLBA updates and alerts on its partner site. Someone in IT security should follow them.

University email security checklist

1. Enforce MFA for all staff and faculty, then students. Start with financial aid, the bursar, payroll, HR and admins.
2. Publish DMARC with reporting and work toward p=reject as described above.
3. Inventory every sending service by department and give each one an owner.
4. Write a bank-change rule. Any change to staff or student deposit details, or to vendor payment details, is confirmed outside email.
5. Warn students about job scams at orientation and before each term, using the FBI's check-deposit rule.
6. Publish a procurement notice for vendors saying how real purchase requests arrive.
7. Close or convert dormant accounts on a schedule for graduates and departed staff.
8. Filter inbound mail for phishing, malware and risky attachments, with a quarantine users can check. See how spam filters work.
9. Make reporting easy, with one button or address, and tell students what happens next. See how to report a phishing email.
10. Practice your incident plan, including the 24-hour FSA reporting step. Our incident response plan is a starting point.

Next steps

• Run the free Email Health Check on your main domain and a few departmental subdomains to see where SPF, DKIM and DMARC stand.
• Confirm MFA covers every mailbox that handles financial aid or payment data.
• Add the student job scam warning to this term's orientation or newsletter.
• If you're reviewing filtering, our buying checklist is vendor-neutral. iBlockSpam is priced per domain with unlimited mailboxes (the count of mailboxes, not message volume: 100,000 inbound messages per domain per month are included). A large campus can exceed that volume, so it fits smaller colleges and individual schools or departments with their own domains best.