CONSUMER ALERT - SEASONAL FRAUD

Back-to-school scams 2026: the four frauds that return every August

Every back-to-school season runs on the same money: supply lists, new laptops, activity fees, and the last scramble for scholarships. Scammers know the calendar as well as any parent does. On July 22, 2026, IRS Criminal Investigation's Atlanta Field Office and the Better Business Bureau warned families about a wave of fake e-commerce sites, fraudulent fee requests, and scams aimed at children, noting IRS-CI identified more than $24 million tied to cyber-related crime in fiscal year 2025. Four scams do most of the damage. Here is how each one works and the checks that beat it.

SB

SafeBrowz Threat Research Security ResearchJuly 23, 20269 min read

Four back-to-school scams are circulating right now

Back-to-school fraud is not one scam but a small season of them, each aimed at a different purchase. Consumer agencies flag the same four families every year, and the July 2026 alerts name them again:

1. The store that sells supplies it does not have. A lookalike shopping site with backpack and laptop prices far below retail, built to take a card number and ship nothing.
2. The school email that wants a fee. A spoofed message about registration, activity fees, or a supply list, with a payment link that does not lead to your district.
3. The scholarship that charges to apply. A letter, call, or ad promising a "guaranteed" award in exchange for a processing or redemption fee that a real scholarship would never ask for.
4. The scam that targets your kid. Free in-game currency, account "verification," and giveaway links aimed at students on gaming and social platforms.

The Federal Communications Commission lists the same season on its back-to-school scams page, warning that fakes are harder to spot when they arrive alongside legitimate school fundraisers, grants, and scholarships. That camouflage is the whole point.

Scam one: the fake school-supply and electronics store

Fake shopping sites are cheap to spin up and easy to promote through social ads timed to the supply-list rush. The formula is familiar: a clean storefront template, product photos lifted from real retailers, a name that sounds like a discount outlet, and prices on backpacks, calculators, and laptops that are too good to be true. You enter a card, you get an order confirmation, and the goods never arrive, or a card-skimming checkout harvests the number for later.

The domain usually gives it away before the checkout does. The classic fake-store address bolts words like outlet, clearance, deals, or backtoschool onto a plausible retailer name, or swaps the real .com for a cheap .shop, .store, or .online. A pattern like campus-supplies-outlet[.]shop or back2school-tech-deals[.]store, registered days before the season, is the shape to distrust. The IRS-CI alert named the same tells: similar domain names, tricky subdomains, links pushed by text or email, poor design, and low-quality images.

This is the seasonal version of a year-round problem, and the defenses are the same ones in our guide to spotting fake online stores. Buy from retailers you already know, and reach the store by typing its address or opening the app you already have, never through an ad or a forwarded link. If a "store" only takes gift cards, wire transfer, or crypto at checkout, that alone is the answer, the same untraceable-payment tell we documented in the gift card payment scam.

Scam two: the fake school fee or communication email

The second front borrows the school's own authority. As enrollment opens, parents get a flurry of legitimate messages about registration, activity fees, lunch accounts, book deposits, and supply lists. Scammers slip into that stream with a spoofed email or text: your child's registration is "incomplete," a fee is "past due," a payment link is attached, act today.

The link is where it breaks. A real district collects money through its own portal on its own domain, usually a .edu or .org address you have used before. The fake points somewhere else: a district name on a domain the school does not own, like lincoln-schools-payments[.]com, or a login page that harvests your parent-portal password. The FCC's advice is direct: never share your Social Security number, bank details, or logins for school or social-media accounts in response to a message like this, and if a caller claims to be from a government agency, hang up and verify through the agency's own .gov site.

The fix costs nothing: never pay or log in through the message's link. Open the district's website or app the way you always do and check for the same notice there, or call the office at the number on the school's real site. Treat it like any unsolicited link, a habit our complete guide to text message scams covers in depth. It is the same play as the agency-authority scams in our guide to bank and government imposter scams: borrow a trusted institution, invent a step that needs payment, add a deadline.

Scam three: the advance-fee scholarship letter

The third front waits for the aid season. A letter, email, call, or seminar invitation announces that your student has won, or is guaranteed to win, a scholarship or grant. There is just one step: a "processing cost," "redemption fee," or refundable "hold" on a card. The award never arrives, and the fee, and sometimes the card and bank details, are gone.

One rule collapses this whole front. The FTC's guidance on scholarship and financial-aid scams is direct: the financial aid application process is free, and you never have to pay to apply for a scholarship or to file the Free Application for Federal Student Aid. If a company promises an award in exchange for an upfront payment, walk away. The FTC even lists the tell-tale sales lines to listen for: "the scholarship is guaranteed or your money back," "you can't get this information anywhere else," and "I just need your credit card or bank account number to hold this scholarship."

Two more habits close the gap. Only you and your family complete your FAFSA, always free at studentaid.gov, and you should never share your FSA ID login with any company or "consultant." And do not let a seminar rush you into paying on the spot; talk to a school guidance counselor or financial-aid advisor first. The same "pay a fee to unlock money you are owed" mechanic drives the student loan forgiveness scam, which spikes in the same weeks.

Scam four: scams that target your kids on games and social apps

The fourth front does not go through the parent at all. The IRS-CI alert singled out scams aimed at minors on gaming and social-media apps, and back-to-school is peak season for them: new devices, new accounts, and kids online more than they were all summer. The lures are built for that audience, free in-game currency or skins from a "generator" link, an account that needs "verification," a giveaway that asks for a login, or a "friend" in a chat who needs a code sent to their phone.

The damage is real even when no card is involved. A handed-over password becomes a hijacked account, resold or used to scam the child's friends from a trusted name, exactly the pattern in our breakdown of the Roblox account hijack scam. Some of these pipelines are the on-ramp for the same fake-offer schemes teenagers meet when they look for a first job, which we cover in how to spot a fake job offer.

Protecting this front is mostly conversation plus a few settings. Turn on the parental controls and purchase approvals your console, phone, and app store already offer, and teach one flat rule that covers almost all of it: never enter a password anywhere except the game or app's own login, never buy "free" currency from a link, and never send anyone a verification code. Watch for account-recovery scams too, where the "help" that offers to get a locked account back is the theft itself.

The back-to-school checklist

Verification takes a couple of minutes, less than a scam page spends picking its photos. Run these before money or a login moves:

1. Buy from stores you already know. A brand-new "outlet" domain with prices far below retail is the highest-risk purchase of the season. Reach a store by typing its address or opening its app, not through an ad or a shared link.
2. Read the domain. A retailer's name with outlet, clearance, deals, or backtoschool bolted on, or a cheap .shop, .store, or .online in place of the real .com, is the lookalike signature.
3. Open school messages from the source. Never pay a fee or "supply charge" through a link in a text or email. Confirm anything urgent by calling the office number on the school's own site.
4. Remember that aid is free. The FAFSA is free at studentaid.gov, and no legitimate scholarship charges an application, processing, or redemption fee.
5. Guard the FSA ID, logins, and SSN. Never share your FAFSA login, Social Security number, or bank details in response to a message.
6. Lock down your kids' accounts. Turn on parental controls and purchase approvals, and teach the "never share a password or a code" rule.
7. Check the link before you pay. Paste any unfamiliar store or school-portal URL into our free URL checker and let it check the domain age, blocklists, and page content before you type a card number.

Check the store or the school email before your card does

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI. Seasonal fraud pages are born clean, hours old, on no blocklist, with no history. That is exactly the case the layers are built for.

• Layer 1 - Local detection: 60+ URL patterns and a 550+ brand database run inside the browser before the page renders. A retailer or district name on a domain that entity does not own, "outlet" and "clearance" keyword constructions bolted onto a brand, and newly registered lookalike hosts add weight instantly, with no network call.
• Layer 2 - API checks: Google Safe Browsing, PhishTank, URLhaus, ScamAdviser feeds, and 30+ scam TLD lists, aggregated server-side. Fake back-to-school stores get reported in volume once a campaign spreads, so this layer catches fakes that are hours-to-days old.
• Layer 3 - AI deep scan (Premium): AI content analysis via our proxy reads the page the way a trained reviewer would. On a fake store the tells cluster: prices far below retail, logos lifted from the real retailer, no business address, a checkout that only takes gift cards or crypto, and no history beyond this week. On a spoofed school page it is a login form that submits to a domain the district does not own. That pattern scores as fake even on a brand-new address that is on no list anywhere.

The honest limit: SafeBrowz checks the store link or the school-email link you open. It cannot verify a paper flyer taped to a locker, vet a scholarship seminar in a hotel ballroom, or stop a gift-card handover made in person. For those fronts, the FTC's and your school office's steps above are the real defense. What it adds is a verdict on every link that does pass through your browser, where the fake store and the spoofed email live.

Detection signatures are derived from threat-intelligence research and our internal brand database, not from user browsing data. SafeBrowz does not store per-user browsing history.

Frequently asked questions

How can I tell if a back-to-school store is a scam before I buy?

Start with the domain and the price. A brand-new address that bolts words like outlet, clearance, deals, or backtoschool onto a retailer's name, or swaps the real .com for a cheap .shop, .store, or .online, is the classic fake-store signature, especially when backpack or laptop prices are far below retail. Reach a store by typing its address or opening its own app, never through an ad or a forwarded link, and treat a checkout that only accepts gift cards, wire transfer, or crypto as an automatic no. If you are unsure, paste the link into a free URL checker before you enter a card.

Is a text or email about school fees or a supply list ever real?

Schools do send real messages, which is exactly why spoofed ones work. The safe move is to never pay or log in through the message's link. A real district collects money through its own portal on its own domain, usually a .edu or .org you have used before. When a message says a fee is past due or registration is incomplete, open the district's website or app the way you always do and check for the same notice there, or call the front office at the number on the school's real site. Never send Social Security numbers, bank details, or parent-portal logins in reply to an unsolicited message.

Do I ever have to pay a fee to get a scholarship or financial aid?

No. The FTC states plainly that the financial aid application process is free and that you never have to pay to apply for a scholarship or to file the FAFSA. Any "processing cost," "redemption fee," or refundable "hold" on a card is the scam. Watch for the sales lines the FTC lists, such as a scholarship that is "guaranteed or your money back" or a caller who "just needs your credit card number to hold" the award. Only you and your family complete your FAFSA, always free at studentaid.gov, and you should never share your FSA ID with a company or consultant.

How do scammers target kids during back-to-school season?

Through the games and social apps children use, which spike with new devices and accounts in the fall. IRS Criminal Investigation specifically warned about scams aimed at minors on gaming and social-media platforms. The lures are built for that audience: free in-game currency or skins from a "generator" link, an account that needs "verification," giveaway pages that ask for a login, or a chat contact who asks the child to send a verification code. Turn on parental controls and purchase approvals, and teach one flat rule: never enter a password anywhere except the app's own login, never buy free currency from a link, and never send anyone a verification code.

What should I do if I already paid a fake school store or scholarship?

Act on the payment first. If you paid by card, contact your issuer immediately and dispute the charge; if you paid through a payment app, report the transaction in the app and to your bank; a gift-card payment should be reported to the card's issuer right away. Then report the scam to the FTC at ReportFraud.ftc.gov, to the FBI at ic3.gov for an online-store loss, and to the BBB Scam Tracker at bbb.org. Keep screenshots of the page, the message, and the receipt. If you entered a password, Social Security number, or bank details, change the password, watch the accounts, and consider a credit freeze. Our guide on what to do after a scam walks through the full recovery order.

Last updated 2026-07-23