International criminal syndicates are targeting the Canadian education sector, overwhelming institutions with a growing wave of chargeback, refund and "money muling" scams. The fallout of these increasingly sophisticated attacks present a triple threat:
- Students lose money, and jeopardize their study permits and education. Shame and stress often impacts their wellbeing.
- Institutions face severe financial, legal and reputational consequences.
- Staff are overwhelmed: Managing fraudulent payments turns finance teams into "amateur detectives," burdening them with manual work.
The following five strategies, adapted from a recent Flywire webinar with Flywire experts David King, Co-President of Global Education and Chief Product Officer, Eric Diffenbach, Head of Compliance, and John Papandrea, Head of Regulatory, provide Canadian higher education institutions with actionable ways to reduce their risk profiles and safeguard their students.
1. Mandate a strict "refund to source" policy to protect your students & institution
A core risk stems from a commonly used tactic whereby fraudsters pay tuition with a stolen credit card, then convince the student to request a refund to a different bank account. If a school fulfills this request, both the institution and the student have unknowingly participated in money laundering.
For Canadian schools, adhering to a "refund to source" policy (i.e. only sending money back to the account it came from) is non-negotiable to prevent this and maintain compliance with FINTRAC regulations. Without proper safeguards, the institution is potentially exposed to severe regulatory scrutiny and potential criminal liability.
2. Partner with regulated payment providers to reduce fraud detection burden
Institutions often use basic payment gateways that leave them vulnerable to fraud. In these cases, the school acts as the Merchant of Record, so when a fraudulent payment is processed, the legal and financial responsibility for the dispute sits with them, creating a huge operational burden for staff.
To stay focused on their core mission, schools must find ways to enhance their fraud monitoring by partnering with trusted third-parties such as Flywire. Before implementing Flywire, finance staff often spend a substantial portion of their time managing issues, reversing fees, tracking down students, and attempting to defend hundreds of thousands of dollars worth of chargebacks without the necessary forensic data.
As a globally regulated company, registered with, and regulated by, FINTRAC and the Bank of Canada (under the RPAA), Flywire acts as Merchant of Record on behalf of partner institutions. This helps to reduce risk and administrative burden for schools.
3. Protect students with education & a single, secure payment path
Institutions can no longer wait until orientation to talk about security; fraud awareness must be part of the recruitment process. If a student doesn't know that a third-party discount is a red flag before they leave home, the school has already lost the chance to protect them. While educating students on red flags—and ensuring they know that no one, not even an agent, should handle their money—is helpful, providing clarity on how to pay will reduce risk even further.
Providing a single entry point for payments, with an integrated experience which offers students familiar, local payment options, and clearly communicating this from their very first interaction with the university, will avoid uncertainty that could be exploited.
4. Verify education agent credentials to curate a trusted network of recruitment partners
Most Canadian schools use education agents to help recruit international students from across the globe, but doing so can introduce a critical security gap. Unlike countries like Australia with its agent registry and mandatory data collection, or the UK with the Agent Quality Framework, Canada lacks a formal framework for working with agents. Robust due diligence is essential, so that Canadian institutions can be sure the agents they work with are reputable and will protect the best interests of both the school and the students they advise.
While they should never handle a student’s money, education agents do play a vital (and trusted) role in providing advice to students on how to pay. Train them on the official payment process or, even better, enable them to facilitate secure payments, using a third-party solution such as Flywire’s Agent Platform.
5. Use tech that has security baked in
Manual review of student payments is a losing game. For Canadian schools, the takeaway is clear: security must be baked into the payment system itself. Requiring two factor authentication, like 3DS, is a good first step. However, recently fraudsters have had some success extracting security codes from victims using social engineering so education is a critical layer of defense.
Flywire uses machine learning to score transactions based on hundreds of data points—like IP addresses and email patterns—that a human staff member could never track manually. Security is truly baked in: high-risk payments are automatically rejected and moderate risk ones are queued for Flywire’s manual compliance review.
Moving to a more secure, integrated system, like Flywire, also helps to reduce the burden and complexity of PCI compliance and the associated administrative burden. In some cases, outsourcing the Merchant of Record function can mean institutions go from SAQ-D, which contains 360+ questions around their PCI compliance, to SAQ-A which contains around 30, lowering the school’s administrative burden and technical risk at the same time.
Frequently asked questions
What are the main international tuition fee scams currently targeting Canadian institutions?
International criminal syndicates primarily target Canadian institutions through social engineering, chargeback scams, illegal refund requests, and "money muling" operations. A common tactic involves fraudsters paying student tuition using stolen credit cards and subsequently convincing the student or institution to issue a refund to a completely different bank account.
Why is a strict "refund to source" policy critical for regulatory compliance?
Refunding money to an account other than the original payment source unintentionally exposes both the institution and the student to money laundering operations. Enforcing a strict "refund to source" policy ensures that all returned funds go directly back to the original account, protecting institutions from criminal liability and maintaining compliance with Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) regulations.
How does partnering with a payment provider reduce an institution's scope of risk?
When an institution uses basic payment gateways, it acts as the Merchant of Record, bearing full legal and financial responsibility for disputing fraudulent payments and managing chargebacks. By partnering with a regulated provider like Flywire—registered with FINTRAC and regulated by the Bank of Canada—the provider acts as the Merchant of Record, to, among other benefits, handle chargeback management and reduce the scope of institutional operational risk.
What role should education agents play in the payment process?
Because Canada currently lacks a formal national framework or registry for international recruitment agents, institutions must perform thorough due diligence on their partner agents. Education agents should provide guidance on official payment options, but they should never handle student funds directly. Institutions can also leverage solutions like Flywire’s Agent Platform to enable agents to facilitate secure payments safely.
How does built-in payment security technology ease the burden on finance staff and PCI compliance?
Manual payment reviews place an unnecessary burden on finance teams, turning them into "amateur detectives". Security technology utilizes machine learning to analyze transaction data points (such as IP addresses and email patterns) and automatically flags or rejects high-risk transactions. Additionally, outsourcing Merchant of Record responsibilities can simplify PCI compliance—often reducing self-assessment questionnaires from over 360 questions (SAQ-D) down to around 30 questions (SAQ-A).