Safer by design: reducing fraud risk in the student journey

Ask an international student who keeps their tuition payment safe, and the answer can be sobering. "I’d go for the cheapest option," one told our researchers, "because security-wise, that’s on the institution's side. It’s not my problem. I have the receipt that my money went somewhere. If it doesn’t get to its destination, that’s not my problem."

Those of us who work where admissions, finance and technology meet know the risk hiding behind that shrug. The money still has to reach the right somewhere, and the space between what the student assumes and what the institution can see is where fraud settles in.

Over two years, we at Flywire surveyed more than 1,650 international students at thirteen business schools across France, Italy, Germany and Spain to see how they actually pay. We partnered on the research with Edified, a global education consultancy that helps institutions improve student recruitment, admissions, strategy, performance and outcomes through independent research, expertise and insights. Most students have a good experience. The friction that remains sits where money changes hands, and that is where criminals tend to look.

Meet your invisible payer

Almost half of the time, someone other than the student is making the payment. Nearly half of 2025 tuition payments, some 46%, were made by a parent rather than the student. Among undergraduates, this figure rises to 56%, and among African students to 73%.

In my years in international admissions, I saw this gap open again and again, the careful email landing with the applicant while a parent (or education agent) made the transfer. Any control that assumes the student will always be in the driver’s seat is incomplete.

The silence where fraud grows

In practice, the bigger exposure is usually much quieter than a breach: it is silence.

More than a third of students told us they received no confirmation from their institution once tuition had been paid, and 29% needed help to complete the payment at all. When an institution goes quiet, students do not. They ask WhatsApp groups, social media channels and older students instead.

This is the part that worries me most. Students judge what is trustworthy by how clearly a school communicates. As one put it, comparing two payment providers, "there was more information about one, a link to a video, so straight away you think this one seems more legitimate." Fraudsters understand that instinct better than most institutions do. I have come across cases where they copied a school’s official payment instructions almost word for word, changed a single account number, and let anxious families do the rest. Weeks later a parent discovers the money never arrived and the student is not enrolled. By then the institution has lost control of the first financial conversation it ever had with that family.

Where does the risk actually sit?

It is not spread evenly across the journey. It gathers at the deposit, the student’s first financial contact with the institution. It grows across tuition and instalments, where redirection scams and third-party payers appear. And it lingers at refunds, the stage that most policies forget to design. It is also no longer a purely operational worry; it is a legal one. The UK offers a clear example, and similar duties are spreading across Europe: the Money Laundering Regulations, the Proceeds of Crime Act, the Sanctions and Anti-Money Laundering Act and the Economic Crime and Corporate Transparency Act 2023 now make institutions accountable for the money that passes through them. In plain terms, an institution can be held responsible if it accepts money it should have questioned.

And the sanctions risk is not abstract: one US institution recently paid a $1.72 million settlement to regulators after accepting tuition from a parent who was under sanctions.

Why safer often means simpler

The instinct is to pile on checks. The institutions making real progress do the opposite and shrink the ground they have to defend. As one consultant who has spent years on this in the sector likes to put it, simplicity and reducing scope is the way forward.

The University of Kent shows what that looks like in practice. It cut the number of staff who handle card payment data from 250 to 150, reduced the devices it had to manage from around fifty to twenty, and brought its outside suppliers down from fourteen to five, largely by taking whole payment channels off the table. With fewer channels, there was simply less to monitor.

That is good for security, and it turns out to be good for students too. Around three-quarters rate their payment experience as excellent or good, and that share climbs when the process is properly joined up. Card chargebacks (card payments a buyer later reverses or disputes) tell the same story: the sector average sits near 1%, and when payments run through a single, verified channel, that rate drops sharply.

What the leaders are doing differently

The finance team at the University of Sheffield can name the moment their thinking changed. For years the reassurance had been that chargebacks were low and their cohorts "low risk". Then they realised what that really meant, summed up in a phrase one of them still uses: "it’s ok, until it’s not."

So they began looking at fraud across the whole payer journey, rather than as a technology problem. In one cross-functional workshop, with admissions, finance, accommodation and the student registry in the same room, they laid fraud risk over the payer journey and rebuilt their response around it: same-day escalation across teams, a fraud-scoring system applied to every escalated case, and a named money-laundering reporting officer. Where they could not change the systems, they built oversight "into the cracks". Their own verdict was blunt: "our people are our single point of success or failure."

Leadership comes first

None of this holds without leadership. Asked what would make compliance simpler, practitioners name leadership support before any tool.