# Protect your university accounts: email, Blackboard and bank

> Secure your student accounts: two-step verification, a different password for each account, spotting phishing, and what to do if you are hacked.
>
> tiswa lists the current student offers in Saudi Arabia for [Apple](https://tiswa.app/en/deals/apple/).

![Protect your university accounts: email, Blackboard and bank](https://tiswa.app/assets/blog/account-security-students/account-security-students-cover-en.webp)

Protecting your university accounts matters more than you might think. Your university email opens Blackboard, the academic portal and free software, and is sometimes used to recover other accounts. If it is taken over, a student can lose assignments, have scam messages sent to classmates in their name, or have accounts opened in their name. The good news is that three simple habits stop most takeovers: two-step verification, a different password for each account, and never giving a code to anyone.

## Which accounts matter most?

| Account | Why it matters | Priority |
|---|---|---|
| University email | Opens Blackboard, the portal and free software | Very high |
| Personal email | Most of your other accounts recover through it | Very high |
| Banking app | Your money and stipend | Very high |
| Nafath | Proves your identity to government services and banks | Very high |
| Social accounts | Attackers use them to trick your friends | High |
| Subscriptions and shops | Sometimes hold your card | Medium |

![Comparison card of the guide table](https://tiswa.app/assets/blog/account-security-students/account-security-students-inline-2-en.webp)


## Habit one: two-step verification

Two-step verification means a password alone is not enough to sign in: an attacker also needs your phone or authenticator app. Turn it on for every account that supports it, starting with the most important:

1. **University email (usually Microsoft)**: Most universities use Microsoft accounts, and your university may enforce verification itself. For a personal account follow [Microsoft's two-step verification guide](https://support.microsoft.com/en-us/account-billing/how-to-use-two-step-verification-with-your-microsoft-account-c7910146-672f-01e9-50a0-93b4585e7eb4), and use an authenticator app rather than texts where you can.
2. **Google account**: Turn on [Google 2-Step Verification](https://support.google.com/accounts/answer/185839) from your account's security settings.
3. **Apple Account**: Make sure [two-factor authentication](https://support.apple.com/en-us/102660) is on for your Apple Account.
4. **Social accounts**: All the big apps support two-step verification in their security or privacy settings.
5. **Save your recovery codes**: Every service gives you backup codes. Keep them somewhere safe off your phone, because you will need them if you lose it.

![5-step flow: University email (usually Microsoft) / Google account / Apple Account / Social accounts / Save your recovery codes](https://tiswa.app/assets/blog/account-security-students/account-security-students-inline-1-en.webp)


> **Tip**: If a service supports passkeys, use them. They are easier than passwords and much harder to phish, because they are tied to your device and the real site.

## Habit two: a different password for every account

The most dangerous mistake is reusing one password everywhere. If it leaks from one weak site, attackers try it on your email and bank. The answer is not memorising twenty passwords but using a password manager: iPhone has the Passwords app, and Android and Chrome have Google Password Manager. A manager creates a strong password for each account, saves it and fills it in for you.

- The one master password you remember: a long phrase of several words, not your name or birthday.
- Do not keep passwords in a plain note or a screenshot in your photos.
- Check whether your email has appeared in a known breach on [Have I Been Pwned](https://haveibeenpwned.com), and change the password for any account that shows up.

## Habit three: no code for anyone

Most account takeovers do not come from genius hackers breaking systems; they come from someone persuading you to hand over a code. One-time codes, Nafath numbers, passwords: nobody has the right to ask for them, not the university, not the bank, not tech support. The National Cybersecurity Authority publishes awareness advice on [its site](https://www.nca.gov.sa/en/awareness), and reminds people that official government websites end in gov.sa.

## How to spot a phishing message

| Sign | Example |
|---|---|
| Urgency and threats | "Your university account will be suspended within 24 hours" |
| A link that does not match the sender | A link that looks like the university site but has an extra letter or a different domain |
| Asking for a code or password | "Send us the code you received to confirm your identity" |
| An offer too good to be true | "Extra stipend for students, enter your bank details here" |
| A message from a friend that sounds off | "Can you send me the code you got by mistake?" |

If you doubt a message from your university, do not click the link. Open the portal or Blackboard yourself from your browser or the official app. Blackboard is explained in [the Blackboard guide](https://tiswa.app/en/blog/blackboard-guide/).

## Campus and lab computers

- Never save a password in the browser of a shared computer; use a private window.
- Sign out of every account before you leave, not just close the browser.
- Do not leave a USB stick with personal files in the lab.
- On public Wi-Fi, only use your bank through its official app.

## If your account is hacked

1. **Change the password now**: From a device you trust, and sign out of all devices in the security settings.
2. **Turn on two-step verification**: If it was off, and check recovery options, phone number and backup email.
3. **Report it**: University IT support for university email, and your bank straight away for a money account.
4. **Warn your friends**: If messages went out in your name, tell them not to click any link in them.
5. **Change reused passwords**: On every other account where you used the same password.

## An AI prompt to review your account security

Security review prompt:

```
I am a university student with these accounts: [university email, personal email, bank, Nafath, social accounts, shops].
Do not ask me for any password or code.
1) Rank my accounts by how important they are to protect.
2) Give me a checklist for each: two-step verification, recovery options, signed-in devices.
3) Make a one-week plan to secure one or two accounts a day.
```

Nafath and approval requests in particular are covered in [Nafath and Tawakkalna for students](https://tiswa.app/en/blog/nafath-tawakkalna-students/), and what your student account unlocks is in [university email benefits](https://tiswa.app/en/blog/university-email-benefits/).

tiswa checks you are a student once, then opens student discounts in Saudi Arabia. Start from [the tiswa app](https://tiswa.app/en/deals/). [Join tiswa free](https://tiswa.app/en/join/)

## A 20-minute security review

1. **Personal and university email**: Turn on two-step verification and check that your recovery phone and email are current. Whoever owns your email can usually reset your other passwords.
2. **Apple or Google account**: It holds your photos, backups and saved passwords, so treat it as the most important account after email.
3. **Social accounts**: Turn on two-step verification in WhatsApp, Snapchat and Instagram; stolen accounts are often used to trick your friends.
4. **Open sessions**: In each important account, review signed-in devices and sign out of any you do not recognise.

For how genuine Nafath requests work, read [Nafath and Tawakkalna for students](https://tiswa.app/en/blog/nafath-tawakkalna-students/); to protect your bank login, see [opening a student bank account](https://tiswa.app/en/blog/student-bank-account/).

## Questions

### How do I protect my university account?

Turn on two-step verification, use a unique password generated by a password manager, never share a verification code, and sign out of shared campus computers.

### Will my university ask for my password or code by message?

No. Any message asking for your password or verification code is a scam, even if it looks like it is from the university. Open the portal yourself instead of clicking.

### What is the best kind of two-step verification?

Passkeys or an authenticator app are stronger than SMS codes. If they are not available, SMS is still far better than nothing.

### How do I know if my email was leaked?

Check it on Have I Been Pwned, and change the password for any account that appears in a breach.

### What should I do if my university email is hacked?

Change the password from a trusted device, sign out of all devices, turn on two-step verification and contact university IT support.


## Sources

[^1]: nca.gov.sa, https://www.nca.gov.sa/en/awareness
[^2]: support.google.com, https://support.google.com/accounts/answer/185839
[^3]: support.microsoft.com, https://support.microsoft.com/en-us/account-billing/how-to-use-two-step-verification-with-your-microsoft-account-c7910146-672f-01e9-50a0-93b4585e7eb4
[^4]: support.apple.com, https://support.apple.com/en-us/102660
[^5]: haveibeenpwned.com, https://haveibeenpwned.com