Changing student loan rules are giving scammers a new opening. Here’s how to protect yourself

Student loan borrowers who were on the Saving on a Valuable Education (SAVE) plan began receiving notices from their servicers on July 1 telling them to choose a new repayment plan within 90 days of receiving the notice. Now, some borrowers are just weeks away from their deadlines.

With repayment changes already underway, questions are piling up: Will my servicer stay the same? What happens if I miss the notice? And once I choose a plan, did I pick the right one?

That confusion can create an opening for scammers, says Carolina Rodriguez, director of New York's Education Debt Consumer Assistance Program (EDCAP). As borrowers turn to Google, AI tools, Reddit and other sources for help navigating the changes, Rodriguez says EDCAP is seeing more people looking for assistance. That same surge in confusion and demand, she said, is likely something scammers are capitalizing on, too.

"There are people always willing to give you what you want to hear, whether it's true or not," Rodriguez tells CNBC Select.

Here's how student loan scams work, what to do if you're targeted and how to protect yourself as borrowers navigate these changes.

Scammers aren't reinventing the wheel, but they are adjusting their pitches to fit the moment. In the past, when loan forgiveness felt within reach, fraudsters could play on hope. Now, Rodriguez says, they're leaning into fear, as millions of borrowers worry changes to their payments.

Here's what that looks like in practice:

• Advance-fee scams. Student loan expert Mark Kantrowitz says one of the biggest red flags is a company asking you to pay before providing a service. Legitimate loan fees are typically added to your balance rather than collected upfront. "If you have to pay money to get money, it's probably a scam," he says.
• Ongoing "maintenance" fees. Rodriguez calls this a "triple red flag." Borrowers may think they're paying toward their actual loan when they're really paying a third party to perform a task they could handle themselves for free through their servicer or StudentAid.gov. "What are you paying for?" she says.
• Requests for your login information. "Never give your username and password to any third party," Kantrowitz says. "That's all they need to change your mailing address and borrow new loans in your name."
• Fake forgiveness or relief offers. Fake loan forgiveness programs and schemes that redirect borrowers' monthly payments away from their legitimate servicer remain common, Kantrowitz says.
• Social media pitches. Rodriguez says she's seen more companies advertising loan "consultations" on social media. She expects those pitches to become more prevalent as new federal loan caps push some borrowers toward private loans, which can come with their own risks and potentially unfavorable terms.

If you think you've been targeted — or worse, you've already paid a scammer or shared your login information — acting quickly can limit the damage.

Stop the bleeding

Rodriguez says the first step is to "stop the bleeding." If you set up autopay with the company, cancel it immediately. If you gave someone access to your StudentAid.gov account, log in and change your password right away, along with the passwords for any other accounts whose information you shared.

Rodriguez says her program is also seeing more borrowers with past-due balances. In some cases, borrowers didn't realize they had an outstanding balance. In others, the balance is incorrect because their repayment application wasn't properly processed. Either way, double-check your account directly through StudentAid.gov or your loan servicer rather than assuming everything is in order.

File a complaint, even if you don't get your money back

If the company is still operating, try to recover your money directly. But Rodriguez says an equally important step, even if you never get the money back, is to file a complaint.

In New York, borrowers can report scams to the state's Department of Financial Services or attorney general's office. Borrowers in other states should check with their state financial regulator or attorney general.

Individual complaints can matter more than you might think, Rodriguez says, because "the attorney general, DFS, all these government entities work on patterns." A single report may not trigger an investigation, but multiple complaints about the same company can help regulators identify a pattern and take action.

Protect your identity

Kantrowitz recommends a few additional steps if you believe your identity has been compromised:

• Visit IdentityTheft.gov. The FTC's site walks you through reporting identity theft and creating a personalized recovery plan.
• Freeze your credit. A credit freeze can help prevent someone from opening new credit accounts in your name.
• Secure your Federal Student Aid account. If you believe your FSA ID credentials have been compromised, contact the Federal Student Aid Information Center at 1-800-433-3243 for help securing your account.
• Check your credit reports. Look for unfamiliar accounts or other signs that your information may have been misused.

Rodriguez echoes that advice: Freeze your credit, change compromised passwords and usernames, and check your credit reports and accounts for signs of suspicious activity.

Since student loan scams can involve attempts to steal sensitive personal or financial information, sign up for a credit monitoring or identity theft protection service. These services can help by alerting you to suspicious activity like new accounts opened in your name and, in some cases, they can assist with recovery.

LifeLock's identity and financial monitoring features can alert you to certain signs of identity theft, while its restoration services can help if your information is misused.

PrivacyGuard can provide an extra layer of protection if a student loan scammer gets your personal information. Its services include triple-bureau credit monitoring, dark web monitoring and identity-fraud alerts, which can help you spot potential misuse of your information.

Aura is a great option if a family member's finances, such as a Parent PLUS loan, are tied to your situation, since its family plan covers up to five adults with three-bureau monitoring and dedicated fraud-resolution help. IdentityForce offers dark web scanning, which is great if you're worried a stolen StudentAid.gov login or FSA ID is already circulating online. And Experian IdentityWorks is a solid, affordable pick if you're already stretched thin by loan payments, with a free tier and paid plans still under $25 a month for three-bureau coverage.

The best defense, according to Rodriguez and Kantrowitz, is knowing where to find reliable answers before a scammer has a chance to offer fake ones.

Go straight to the source

Rodriguez says to treat student loan communications like a bank alert. If you get an email saying your account needs to be updated, you probably wouldn't click the link; you'd go directly to your bank to check. The same logic applies here: Go directly to StudentAid.gov or your servicer's official website or app to verify the notice.

Both offer free, self-service tools to change your repayment plan, consolidate loans and check your forgiveness eligibility, so there's rarely a reason to pay someone else to do it for you.

Confirm who you're dealing with

Make sure your loan servicer is legitimate before sharing any information or making a payment. Kantrowitz recommends checking the official list of federal loan servicers on StudentAid.gov and comparing it with anyone who contacts you.

The FTC also maintains information on common student loan scams at Consumer.ftc.gov, which can be a useful gut check if an offer doesn't feel right.

Never share your login

Rodriguez says no legitimate company should ask for your StudentAid.gov username or password. If a company wants to log in to your account on your behalf, that's reason enough to walk away.

Her broader advice to clients: "I wish I could say trust but verify, but don't even trust. You must take control of your loans and understand your options before you embark on anything."

Be skeptical of urgency

Scammers thrive on making borrowers feel like they need to act immediately, whether it's a countdown clock, a "limited-time" consolidation offer or a warning that you'll lose eligibility if you don't act now.

Legitimate repayment options available through StudentAid.gov and your servicer don't require you to make a snap decision, so take the time to verify any claim before you act or send money.

Monitor your information before there's a problem

Signing up for a credit monitoring service before anything goes wrong can help you spot suspicious activity sooner if your personal information is compromised. Depending on the service, you may receive alerts about changes to your credit or other signs of potential identity theft.

At CNBC Select, we work with experts who have specialized knowledge and authority based on relevant training and/or experience. For this story, we interviewed Carolina Rodriguez, director of New York's Education Debt Consumer Assistance Program (EDCAP), a free, state-funded resource for New York student loan borrowers. We also interviewed Mark Kantrowitz, a nationally recognized expert on student financial aid and loans, as well as author of "How to Appeal for More College Financial Aid" and "Who Graduates from College? Who Doesn't?"

At CNBC Select, our mission is to provide our readers with high-quality service journalism and comprehensive consumer advice so they can make informed decisions with their money. Every student loan article is based on rigorous reporting by our team of expert writers and editors with extensive knowledge of student loan products. While CNBC Select earns a commission from affiliate partners on many offers and links, we create all our content without input from our commercial team or any outside third parties, and we pride ourselves on our journalistic standards and ethics.

Catch up on CNBC Select's in-depth coverage of credit cards, banking and money, and follow us on TikTok, Facebook, Instagram and X to stay up to date.