South African matriculants looking for bursaries to pay for their studies next year are being warned about increasingly convincing scams, with artificial intelligence making it much easier for criminals to create fake funding adverts that look like the real thing.
It’s happening at a difficult time for learners. Matric exams are underway, university applications are being finalised and families are trying to work out how they’ll afford the cost of tertiary education. The last thing anyone needs is to discover that a bursary they’ve applied for doesn’t exist, especially if they’ve already handed over money or personal information.
Anna Collard, senior vice-president of content strategy and CISO advisor at cybersecurity company KnowBe4 Africa, says scammers are well aware of the pressure learners are under and are using it to their advantage. With AI, they can create professional-looking adverts, copy the branding of legitimate organisations and build convincing websites without needing much technical expertise.
The National Student Financial Aid Scheme (NSFAS) has already warned applicants about fraudulent funding offers circulating on WhatsApp and social media. Applications for the 2027 academic year closed on 31 October, and the scheme confirmed that the deadline wouldn’t be extended. That hasn’t stopped concerns about messages offering guaranteed funding or claiming that applications are still open.
NSFAS applications are free, and the scheme doesn’t authorise third parties to charge applicants for assistance. Anyone claiming they can secure funding in exchange for a payment should immediately raise suspicion, regardless of how convincing their advert might look.
A convincing advert doesn’t mean it’s legitimate
For years, one of the easiest ways to recognise an online scam was to look at how badly it was put together. A company logo might be stretched, the spelling would be questionable or the wording would sound nothing like something a professional organisation would publish.
Those mistakes still happen, of course, but they’re becoming less useful as warning signs. AI tools can produce convincing marketing material in seconds, while criminals can copy text and images directly from legitimate websites to make fraudulent application pages look authentic.
Collard points to research from KnowBe4 showing how common AI has become in phishing attacks. The company’s Phishing Threat Trends Report, published in April, found that 86% of the phishing attacks it analysed involved AI in some form. That doesn’t mean 86% of bursary scams use AI, as the research covers phishing more broadly, but it does show how extensively criminals are using the technology to make their attacks more convincing.
KnowBe4’s researchers have also examined phishing campaigns that automatically reproduce the branding of organisations being impersonated. In one campaign, fraudulent login pages used genuine company logos and screenshots of the organisations’ websites, even adjusting their language to match the visitor’s browser settings.
Imagine coming across a bursary advert on TikTok or Facebook that appears to come from a company you recognise. You follow the link, arrive at a professional-looking website and find an application form asking for the same documents you’d expect a legitimate bursary provider to request. There may be nothing obviously wrong with the design or wording, which makes it easy to assume the offer is genuine.
It’s a problem we’ve also seen with cybercriminals using AI to make familiar scams more convincing. The technology hasn’t necessarily changed what criminals want, but it has made it easier for them to impersonate legitimate people and organisations without giving themselves away through obvious mistakes.
Collard also points to research into AI chatbots and online fraud, which suggests that automated conversations can be effective at building trust. Someone who contacts a fraudulent bursary provider with questions could receive detailed, reassuring answers from a chatbot and never realise they’re dealing with a scammer.
How can you tell whether a bursary is real?
Collard recommends checking four things before applying for a bursary, starting with whether the organisation is asking for money.
NSFAS doesn’t charge application fees, and anyone requesting a payment to secure or speed up NSFAS funding is attempting to exploit applicants. Genuine bursary programmes generally don’t require applicants to pay upfront fees to access funding either, so demands for administration fees, processing charges or deposits deserve scrutiny.
It’s also important to consider where you found the opportunity. There are plenty of legitimate bursaries advertised through social media, and there’s nothing inherently suspicious about an organisation promoting its funding programmes on Facebook, Instagram or TikTok. The problem comes when an advert directs applicants to a website that hasn’t been independently verified.
Rather than clicking through from a WhatsApp message or social media post, Collard recommends finding the organisation’s official website yourself and checking whether the bursary appears there. If you can’t find any mention of it, contact the organisation through its published contact details before doing anything further.
The same caution applies to personal documents. Legitimate bursary applications often require copies of identity documents, academic results and information about a family’s financial circumstances. That’s normal, especially when a funder needs to establish whether someone qualifies for financial assistance.
What matters is where those documents are being submitted. Collard advises applicants to use only verified application portals and to avoid sending sensitive information to unfamiliar WhatsApp numbers or email addresses. NSFAS also warns applicants never to share their myNSFAS passwords or one-time PINs with anyone, including people claiming to work for the scheme.
The fourth warning sign is urgency. Scammers often claim that funding is about to run out, applications will close within hours or a special extension has been granted. These messages are designed to make people act quickly, sometimes before they’ve had an opportunity to check whether the offer is genuine.
In the case of NSFAS, the official application information confirms that the 2027 funding window ran from 18 September to 31 October 2026. The scheme also made it clear ahead of the closing date that there would be no extensions. Anyone receiving a message claiming otherwise should verify that information directly with NSFAS.
Your personal information could be more valuable than the application fee
Losing a few hundred rand to a fake bursary application would be bad enough, especially for a family already struggling to cover the cost of education. Collard warns, however, that the financial loss could be considerably greater if criminals manage to collect enough personal information to commit identity fraud.
A certified ID copy, banking information and other personal details can give criminals what they need to attempt to open accounts or apply for credit in someone else’s name. Depending on what information has been compromised, they may also be able to impersonate the applicant when dealing with other organisations.
The consequences aren’t always immediate. Someone could discover that their identity has been misused months or even years later, when they apply for a cellphone contract or loan and find accounts or debts they know nothing about. By that point, proving that they weren’t responsible for the accounts can become a lengthy and frustrating process.
For learners who’ve already submitted personal information to a suspicious website, Collard recommends applying for Protective Registration through the Southern African Fraud Prevention Service (SAFPS). The free service alerts participating credit providers that someone’s identity may have been compromised, allowing them to take additional precautions when processing applications.
If banking information has been shared, the bank should also be contacted as soon as possible. Passwords that may have been exposed should be changed, and applicants should never disclose one-time PINs, even to someone claiming to be helping with an existing application.
There’s also support available for people who aren’t sure whether they’ve been scammed. The Cyber Helpline has launched a free, confidential pilot service in South Africa for people aged 13 and older, helping victims understand what has happened, secure their accounts and work out where to report incidents.
The service, which is being piloted in partnership with MiDO Academy and supported by Amazon Web Services, starts with an online chatbot that provides guidance at any time. Cases requiring more assistance can be referred to trained responders.
Schools and bursary providers can help
Collard believes parents, guardians and teachers should be involved in helping matriculants check funding opportunities. With learners already dealing with the pressure of final examinations, expecting them to recognise every fraudulent application on their own isn’t reasonable.
She suggests spending a few minutes checking an opportunity together before any documents are submitted. That could mean looking up the funder’s official website, confirming the closing date or speaking to a school’s career guidance teacher, who may already be familiar with established bursary programmes.
Collard also wants organisations offering legitimate bursaries and learnerships to make it easier for applicants to identify genuine opportunities. Employers, foundations, Sector Education and Training Authorities (SETAs) and government departments can do this by including their official website addresses and verified contact details in adverts, along with clear information about how applications are handled and whether any fees apply.
There’s a practical reason for that. If someone encounters a bursary advert on social media, they should be able to confirm that it’s legitimate without having to rely on the advert itself. Providing that information consistently across official websites and social media accounts would make it easier for learners to check an offer before responding.
AI’s made it much easier for criminals to produce convincing material, and we can’t assume that learners will always recognise the difference between a genuine opportunity and a fraudulent one. Checking directly with the organisation offering the funding remains one of the simplest ways to avoid handing over personal information to the wrong people.