A Sophisticated Phishing Scam Targeting Preply Tutors: “Could You Check My University Course Materials?”

Recently, there has been a wave of scam messages on Preply from people posing as prospective students. Some tutors have even reported having their accounts hacked and losing large amounts of money.

I’ve received several of these messages myself. The scam is surprisingly sophisticated, and after seeing how it works firsthand, I can understand how so many tutors have fallen for it. In this article, I’d like to share one example of a phishing scam message that I received

The scammers use information from real university courses and highly convincing fake student portals to lure tutors to a fake login page and steal their credentials. The whole setup looks remarkably legitimate. In fact, I thought it was real at first.

A Vague Message from a Prospective Student

The first message looked completely normal. She asked whether I could help her prepare for an “assessment.”

I’ve hidden her name and photo because they most likely belong to an unrelated person whose identity is being misused.

I wasn’t really sure what kind of lessons she wanted, so I asked “Are you looking for lessons where we practice conversations using specific grammar points and work on correcting your written assignments?”

It turned out that she wasn’t actually asking for help correcting assignments. Instead, she said she could share the assessment with me so I could get a better idea of what she needed. Then she sent me a Dropbox link.

A Convincing University Course Document

When I opened the link, I found a surprisingly convincing PDF containing detailed information about the course. It included very specific details, such as:

• Course title
• Course code
• Professor’s name
• Number of credits

I looked up the information and found that it was actually a real course offered by a university in the UK. I’ve hidden part of the course title and the professor’s name because the university and professor are most likely victims of impersonation too.

Her time zone also matched the UK. At this point, everything seemed to check out, so I had no reason to suspect that it was a scam.

For Some Reason, It Took Me to What Looked Like San José State University’s Student Portal

When I clicked “Click Here To Access Course Materials” in the PDF, something strange happened. I was taken to what appeared to be a student portal for San José State University.

The site was surprisingly well made. At first glance, it looked completely legitimate. In the center of the page were separate login sections for “Student” and “Tutor,” along with the logos of several tutoring platforms, including Preply.

Several Things Didn’t Quite Add Up

Both the PDF and the website looked remarkably convincing, but there were several details that didn’t quite make sense.

A UK University Course Using San José State University’s System?

The first obvious problem was that this was supposedly a course at a university in the UK, yet I was being asked to log in through the system of a university in California.

If it had been something like Google Classroom, I wouldn’t have thought much of it. But it seemed very strange for a university to use the system of another university in an entirely different country to give an outside tutor access to course materials.

The Domain Didn’t Match San José State University’s Official Domain

The website I was sent to used the domain sjsu.site.

However, when I clicked the “Academics” button on the site, it took me to an official San José State University page using the sjsu.edu domain.

I did some research and found that San José State University already has an official student portal called “one.SJSU,” which uses the sjsu.edu domain as well.

This definitely raised a red flag, but at the time, it still didn’t feel like definitive proof that the site was fake. The site just looked too polished.

I even found myself wondering whether the university might use a separate domain when giving outside tutors access to course materials for security reasons. And if that were the case, I could imagine the university in the UK choosing to use this system for the same reason.

It Was a Japanese History Course, Not a Japanese Language Course

She had told me that the assessment included a speaking component, but for some reason, the course itself was about Japanese history.

For a moment, I almost convinced myself that this made sense. That’s one of the interesting things about human psychology. Even when something feels off, we’re surprisingly good at coming up with explanations for why it might actually be perfectly normal.

But when I stopped and thought about it, it really didn’t make much sense.

She Never Clearly Explained What Kind of Lessons She Wanted

Her request had been extremely vague from the very first message. It was vague enough that I almost wanted to ask, “Are you even Japanese?”

But if you assume that her real goal from the beginning was to get me to the login page under the pretext of asking me to check her assessment, suddenly everything makes sense.

With all these little inconsistencies adding up, I decided not to log in. After a while, she sent me another message reminding me to look at the materials.

I Was Shocked by What I Found in the Preply Tutor Community

Preply does not allow external links to be shared before the first lesson has been paid for. Needless to say, entering your login credentials on an unfamiliar website is an even bigger risk.

I started wondering what other tutors would do in a situation like this, so I checked the Preply tutor community, which I rarely ever look at.

What I found surprised me. Several tutors had reported receiving similar scam messages over the past few days. Some, just like me, had been directed to what appeared to be a San José State University portal and asked to log in.

Even worse, some tutors reported that their accounts had actually been hacked and that large amounts of money from their Preply balances had been stolen.

Of course, we technically shouldn’t have opened those links in the first place. But asking a tutor to look over an assessment before a lesson is a perfectly reasonable request. I can understand why some tutors fell for it.

At the time, I hadn’t seen much discussion about the scam among Japanese tutors, so I posted a warning in a Japanese tutor community as well.

Curiosity Killed the Cat

As you probably know (or maybe you don’t), I’ve recently become very interested in how Japanese history is taught and discussed outside Japan.

Just the other day, I bought an English edition of a Japanese history textbook. I’d also been doing some research of my own, comparing how Japanese and American history textbooks describe the Pacific War.

山川の日本史教科書の日英対訳版が売ってた。見開きで対応しているのでわかりやすいです。高校生のときにこんな本があったらな。

岡さんもこれで日本史と英語を勉強してもろて。あとポルトガル語も。 pic.twitter.com/yoAXSCEdMD

— Naoto (@japanese_naoto) July 7, 2026

山川の日本史教科書の日英対訳版が売ってた。見開きで対応しているのでわかりやすいです。高校生のときにこんな本があったらな。

岡さんもこれで日本史と英語を勉強してもろて。あとポルトガル語も。

Translation:
I found a bilingual Japanese-English edition of Yamakawa’s Japanese history textbook. The Japanese and English versions are printed on facing pages, so it’s easy to compare them. I wish I’d had books like them when I was in high school.

Prof. Oka, you should use this to study Japanese history and English too. And Portuguese while you’re at it.

Then, right in the middle of all that, I received this lesson request involving a Japanese history course. Naturally, I was curious. I really wanted to see how Japanese history was being taught at a university in the UK.

That curiosity made me think, just for a moment, “Maybe I’ll log in and take a quick look.” Thankfully, I stopped myself before I did, but it was a little close.

Scammers Always Exploit Our Psychology

Preply tutors have been getting spam messages like “I’m looking for a translator” for years. Most of them were so obviously suspicious that you’d wonder who would ever fall for them.

But then again, some Preply tutors are probably looking for other ways to make money using their language skills. So even a poorly written scam like that might work on a small number of people.

This new scam is completely different. It’s far more sophisticated than the usual spam.

Around the time I received these messages, my weekly schedule was getting pretty full, and I was actually considering temporarily stopping taking on new students.

With this particular student, I had already decided that if her lessons required too much preparation outside of class, I would probably turn down the request.

Fortunately, I had enough time to stop and think things through before doing anything. But what if things had been slightly different?

• What if the two universities had matched?
• What if I hadn’t known enough about websites to notice that the domain looked suspicious?
• What if I had just started tutoring and was eager to get new students as quickly as possible?

The more I think about those “what ifs,” the more I realize that avoiding this scam may have come down to luck and timing as much as anything else.

Scammers take advantage of our desires and curiosity. When something appealing appears right in front of us, that’s exactly when we need to stop and think before taking the bait.

This Scam Comes in Many Different Forms

There seem to be several variations of this scam. In another version, for example, someone contacts a tutor asking for help with an “educational project.” The scammers may even be A/B testing different approaches to figure out which ones are most likely to work.

I also found a post on Reddit from a tutor who said they had been directed to a site impersonating the University of Pennsylvania instead of San José State University.

The problem is that requests like these aren’t necessarily unusual. Real students sometimes do ask tutors to look at course materials or assessments. That’s what makes this scam so difficult for tutors to spot. The request itself can sound completely legitimate.

When Scam Messages Make You Suspicious of Real Students Too

To make matters worse, Preply requires tutors to respond to messages from prospective students within 24 hours. If we don’t, our profiles may be hidden. Even when a message looks like obvious spam, we still have to reply just in case.

This time, I received five similar messages in a row. I kept replying to them thinking, “Yeah, these are probably all spam.” Then it turned out that one of them was actually from a real person. Sorry for doubting you, Stephanie (not her real name).

The funny thing is that Stephanie(not her real name)’s message arrived shortly after I blocked the student mentioned earlier. That immediately made me wonder, “Wait, is this another account run by the scammers? Are they checking to see whether I blocked the previous one?”

At that point, I was suspicious of everything. In Japan, we have an expression for this state of mind: 疑心暗鬼 (gishin anki). It describes how, once you become suspicious, you start seeing reasons to distrust everything around you. Literally, it evokes the idea that when your mind (心) is filled with suspicion (疑), you begin to see ghosts (鬼) even in the darkness (暗).

As AI Gets Better, Scams Will Become More Convincing Too

I suspect that the convincing course overview PDF I received may have been one of many documents mass-produced using AI.

This particular scam still had a few flaws. The course was about Japanese history rather than the Japanese language, and the university offering the course didn’t match the university impersonated by the phishing site.

Those mistakes helped raise my suspicions. But as AI continues to improve, scammers will probably get better at eliminating inconsistencies like these. The fake documents, websites, and messages will only become harder to distinguish from the real thing.

Even the convincing phishing site I saw could now be created by someone with little or no coding experience. We’re entering an age where something simply “looking legitimate” is no longer a good enough reason to trust it.

We need to be careful not to let professional-looking websites, university names, logos, or other signs of authority do our thinking for us. Sometimes the most important thing we can do is stop for a moment and ask ourselves whether the situation actually makes sense.

Words Not to Understand Each Other, but to Deceive

And once people learn how to recognize this particular scam, the scammers will probably come up with something new.

I assume the messages I received were being sent manually. But perhaps one day, AI will be able to automatically generate scam messages tailored to each individual target, based on what is most likely to get that particular person to respond.

It makes me think of the demons in Frieren: Beyond Journey’s End.

奴らにとっての“言葉”は人類を欺く術だ。
大魔法使いフランメは言葉を話す魔物を“魔族”と定義付けた。
その祖先は人をおびき寄せるために物陰から「助けて」と言葉を発した魔物だよ。

Translation:
To them, “words” are a means of deceiving humans.
The great mage Flamme defined monsters capable of human speech as “demons.”
Their ancestors were monsters that hid in the shadows and cried out “Help me” to lure humans to them.

Frieren: Beyond Journey’s End

What I Learned from This Experience

I learned a lot from this experience. As an individual tutor, I think there are three simple things we can do to protect ourselves.

Don’t Open External Links

This sounds obvious, but in practice, it isn’t always that simple. Students don’t necessarily know what tutors are and aren’t allowed to do on Preply. A genuine student could easily send an external link without realizing that it might put the tutor in an uncomfortable position.

I also think a lot of language tutors are naturally inclined to help people. When a student says they’re struggling with an exam, we want to help as soon as possible. When a new student has a specific request, we want to accommodate them if we can.

But that goodwill can make us vulnerable.

Protecting ourselves has to come first. If a request requires us to do something that goes against Preply’s safety policies, we need to say so.

From now on, if I receive a similar request, I’ll ask the student to show me the materials by sharing their screen during the trial lesson instead.

Withdraw Your Preply Balance Regularly

Preply is not our bank. Banks are designed to hold and protect our money. A tutoring platform isn’t.

I believe Preply will do what it can to help tutors work safely. But if a tutor contributes to an account breach by entering their credentials on an external website, there’s no guarantee that any losses will be reimbursed.

I sometimes leave money in my Preply account while waiting for a better exchange rate before converting it to yen. After this experience, though, I’ve decided that regularly withdrawing my balance is more important.

Staying Connected with Other Tutors Matters Too

Not to sound like I’m trying to be a sigma boy, but I genuinely used to think:

This experience changed my mind. If we want to recognize new scams early, staying connected with other tutors and sharing information can be incredibly valuable. In my case, checking the tutor community was what turned my suspicions into certainty.

When I posted a warning in a community for Japanese tutors, I received several comments like:

• “I didn’t notice anything suspicious about the message until I saw your post.”
• “Thanks to your post, I realized it was a scam. Thank you.”

If my warning helped even one person avoid getting scammed, I’m glad I posted it. And I hope this article can help prevent someone else from becoming the next victim.

One of the best defenses against a scam is making sure people know how it works. If I come across new variations of this scam in the future, I’ll keep sharing them.