How to Spot a PhD Funding Scam (2026)

A funded PhD offer is one of the few pieces of mail in an applicant's life that can plausibly change their next five years, which is exactly why it's a high-value target for fraud. The scams built around it aren't exotic, they're a small set of well-documented patterns that show up again and again in warnings from the FTC, the FBI's Internet Crime Complaint Center, university security offices, and fraud-reporting bodies like the UK's Action Fraud. This is a walkthrough of those actual documented patterns, what a genuine offer looks like by contrast, and how to verify one before any money moves.

The advance-fee scam: pay to "secure" your funded spot

This is the core mechanic behind almost every version of this fraud, and it's the same mechanic behind decades of advance-fee scams in other contexts. You receive a message, often congratulating you on being selected for a fully funded position, a scholarship, or a research assistantship, and at some point before the money supposedly arrives, you're asked to send money first: a "processing fee," an "administrative deposit," a "visa sponsorship fee," or taxes on the award. The FTC's own consumer guidance on scholarship and financial-aid fraud is blunt about this: you should never have to pay money to receive a scholarship or grant, and any message that frames payment as the step that unlocks funding is describing something that doesn't happen in legitimate funding at all. Real funding is disbursed to you. It is never collected from you first.

The payment methods requested are themselves a tell. Legitimate universities invoice tuition and fees through their own student billing systems and accept normal, traceable payment rails. Scammers overwhelmingly ask for wire transfers to a personal account, cryptocurrency, or gift card codes read aloud over phone or email, methods that are fast, hard to reverse, and don't require the recipient to have any real banking relationship with a university. The FBI's Internet Crime Complaint Center (IC3) issued a 2025 public service announcement describing a closely related scheme in which fraudsters impersonate government officials to international students already on valid visas, falsely claiming a problem with their immigration status and demanding payment to an unfamiliar account to "process" paperwork or avoid deportation, with students from several countries including the UAE, Saudi Arabia, Qatar, and Jordan specifically named as targets. The mechanism is the same advance-fee structure wearing a different costume: manufactured urgency plus a payment demand that has no legitimate equivalent.

Fake offer letters: the tells that actually show up

A forged offer or admission letter is usually built to be visually convincing, a real-looking university logo, formal letterhead, an official-sounding signature block, because visual polish is trivial to copy from any university's public website. What's harder for a scammer to fake convincingly, and what you should actually check, is everything underneath the visual layer.

• A sender domain that's slightly off. Instead of the university's real domain (ending in .edu, .ac.uk, or the country-specific academic equivalent), the email comes from a close lookalike, an extra letter, a .co instead of .edu, a hyphenated variant, or a generic webmail address with the university's name stuffed into the display name while the actual address is something else entirely. University IT security offices, including the University of Michigan's, have documented this exact mechanic in alerts about faculty-impersonation scams: the display name looks right, the actual sending address doesn't match once you look past it.
• Manufactured urgency. "Respond within 24 hours or your funded place will be given to another candidate" is a pressure tactic designed to stop you from doing the one thing that would expose the scam: slowing down and verifying it independently. Genuine universities operate on real administrative timelines and do not generally threaten to revoke a funded offer over a one-day delay in a reply email.
• A request to keep the offer or the payment quiet. Any instruction suggesting you shouldn't discuss the offer with the university's actual admissions or international office is a direct attempt to stop you from doing exactly the verification step that would catch it.
• Unusual payment channels tied to the letter itself. A real admission or funding letter doesn't include wiring instructions to a named individual's personal account, a cryptocurrency wallet address, or directions to purchase gift cards.

This pattern isn't hypothetical. A 2024 Inside Higher Ed investigation documented how widespread document fraud, including forged admission and funding paperwork, has become across international admissions pipelines, often introduced by intermediary agents rather than the applicant or the university itself. In Canada, reporting by CBC News and Global News documented cases where education agents supplied international students with fraudulent acceptance letters bearing the names of real, legitimate colleges the students had never actually been admitted to, and students who unknowingly relied on these letters later lost their study permits as a direct result, through no dishonesty of their own. The letter looking real was never the problem. What it claimed, and where it actually came from, was.

Visa-sponsorship and government-impersonation variants

A specific and increasingly documented variant targets students around visa status rather than funding directly, though the two get blended together in practice. The pitch is some version of "a problem with your visa or SEVIS record needs an urgent fee to resolve," or "your sponsorship requires a payment to confirm," sometimes delivered by someone impersonating a government immigration official rather than a professor. The FBI Philadelphia field office has published a warning on exactly this pattern affecting international college students, describing callers and emailers who claim an immigration or legal issue and demand payment to a bank account or via wire to avoid prosecution or deportation. No genuine visa, SEVIS, or sponsorship issue is resolved by wiring money to an account named in an unsolicited email or phone call. Real immigration fees are paid directly to the relevant government agency through its own official payment portal, never to an individual, a professor, or a third party who contacted you first claiming to be able to fix the problem for a fee.

Red-flag checklist

Pulled together, the signals above form a short, concrete checklist. Any single item here is a reason to slow down and verify independently before doing anything else, and more than one together should be treated as a strong signal the offer isn't real.

• You're asked to pay any fee, deposit, or tax to receive, confirm, or release funding.
• Payment is requested via wire transfer to a personal account, cryptocurrency, or gift cards.
• The sender's email domain doesn't exactly match the university's real domain.
• You're pressured to respond or pay within an unusually short window.
• You're told not to discuss the offer with the university's actual admissions office.
• The offer arrived with no prior application, interview, or any contact from you, and immediately involves money.
• The letter cites a real professor or department but was never confirmed through that person's actual university contact details.

What a genuine funded offer actually looks like

A real funded PhD or Master's offer, whether it's a departmental fellowship, a government scholarship, or a research assistantship tied to a professor's grant, moves through the university's own financial aid, graduate school, or international student office, not through a side arrangement with an individual professor's personal account. It arrives from an official university domain, not a free webmail address with the university's name typed into the sender field. It names a specific, checkable funding source, a grant number, a named fellowship, a departmental line, rather than vague language about a "donor fund" or "special program." And critically, it never requires the admitted student to pay anything to a professor, department, or third party in order to have the funding released to them. If a stipend or tuition waiver is genuinely confirmed, it's disbursed by the university's own payroll or bursar system on the university's own schedule, the same system that pays every other funded student, not a special wire transfer arranged over email with the person who offered it. For a fuller breakdown of what "fully funded" is actually supposed to cover and how to verify a real offer letter against it, see our guide on what fully funded actually means.

How to actually verify an offer before you trust it

Verification here doesn't require any special expertise, just a short, deliberate detour before responding to anything involving money or sensitive personal information.

• Check the sender's email domain against the real one. Search the university's official website directly, not a link from the suspicious email, and find the department's real faculty directory. Compare the professor's listed, official email address character by character against the one that contacted you. A mismatch, even a subtle one, is disqualifying on its own.
• Call the university directly, using a number from its own official website. Not a phone number printed in the suspicious email or letter, which may route to the scammer. Ask the international admissions office or the graduate school directly whether the offer, the funding, or the professor's contact is genuine. This single step catches the overwhelming majority of fake offers, because the fabricated details don't survive contact with the actual institution.
• Confirm the professor is a real, currently active researcher, independently. Search for them on the university's own department page and on a public research index like Google Scholar, and check that their recent publication activity is real and current, not just that a name with that spelling exists somewhere online.
• Never send money or gift card codes to "secure," "confirm," or "release" an academic offer. This is the one instruction that holds in every version of this scam, regardless of how the request is framed or how official it sounds.

This is also where GradScoutFunding is genuinely useful as part of the same habit, though it's worth being precise about what it actually does. It doesn't screen messages for fraud or detect scams, that isn't a feature it has. What it does is help you find and verify real, currently active, actively publishing professors from the start, filtered by field and country, grounded in their real recent published work, and it drafts a personalized first email for you to review and send yourself. Starting from a professor you've already confirmed is real and actively publishing, rather than trusting an inbound offer from a stranger, removes most of the surface area this entire scam depends on. Your first 100 credits are free, no card required, and see our guide on finding professors who are genuinely taking students for how to build that list in the first place.

If you've already responded or already paid

If you've sent money, wired funds, shared gift card codes, or handed over personal or financial information in response to one of these messages, act immediately rather than out of embarrassment delaying it. Contact your bank or card provider directly to report the transaction and ask about reversal or fraud protection, the odds drop sharply with time. Report the incident to your country's relevant fraud authority, in the US that's the FTC and the FBI's IC3 at ic3.gov, in the UK that's Action Fraud, and most countries have an equivalent consumer-fraud or cybercrime reporting body. Separately, contact the real university directly, using contact details from its own official website, both to confirm the offer was fraudulent and to flag that the institution's name is being used without authorization, which helps them warn other applicants. If any personal identification documents or passport details were shared, treat it as an identity-theft risk and follow your country's standard identity-theft reporting steps as well. None of this is a reason to feel foolish, these schemes are built by people running the same script against hundreds of applicants, and the ones who get caught by it are often simply the ones furthest from home, most anxious about funding, and least able to walk into the actual admissions office to ask in person, which is precisely why the scam targets international applicants so disproportionately.

A pattern worth remembering past this one list

Every version of this fraud, the advance fee, the fake letter, the visa-sponsorship threat, the impersonated professor, shares one structural feature: it asks you to act, usually to pay, before you've had the chance to verify independently, and it discourages or rushes past exactly the step that would expose it. A genuine funded offer survives a phone call to the university's real admissions office and a side-by-side comparison of the sender's email against the faculty directory. A fraudulent one does not. That single habit, verify before you act on anything involving money, is the actual defense here, more than memorizing any specific list of tells, because new variations of this scam will keep showing up with details this list doesn't cover yet. If you're also weighing whether a specific supervisor or lab is a good fit beyond just confirming the offer is real, our guide on PhD interview red flags to watch for covers the adjacent, non-fraud version of due diligence worth doing once you know an offer is genuine.

Common questions