How are you reducing token theft from fake forms on student accounts?

First, pin down the sign-in path the fake form is abusing. A page that collects passwords, a device-code prompt, and a flow that captures a live session each call for different controls. Check sign-in records and incident details, then consider disabling device-code authentication if students have no legitimate need for it.

For session theft, phishing-resistant MFA such as passkeys or security keys can make stolen credentials much less useful. It will not fit every student or device, so plan around access needs and the cost of offering alternatives.

Since you can't depend on campus networks or managed personal devices, use conditional access to make those differences count. For example, require stronger authentication off trusted networks, and use shorter sessions for higher-risk or unmanaged access. Check that changes to MFA methods also require strong verification.

There are tradeoffs: more prompts can frustrate students, and session limits alone do not stop a stolen token from being reused. Test policies with a pilot group and make sure exceptions are controlled rather than permanent.

Assume some students will still get caught, and make reporting painless. A clear report button or short route to the help desk, plus a calm message that quick reporting helps, can reduce the time an attacker has access. Have a response checklist ready to revoke sessions, reset credentials where appropriate, review MFA settings, and check for suspicious activity.

Country blocks and impossible-travel alerts can be useful signals, but location data can be wrong and students may travel. Treat them as pieces of detection, not a guarantee.

Look at the fake forms themselves as well as the login controls. Give students a simple way to report suspicious forms and messages, and coordinate with whoever can take them down or block them. Short, repeated awareness reminders about checking the sign-in page and not approving unexpected prompts may help, but training won't prevent every mistake.

For an institution-wide setup, consistent single sign-on and centralized monitoring can make it easier to spot and contain suspicious activity across services. Automated alerts or account lockouts may limit the impact, but verify that the monitoring catches token reuse and that legitimate students can recover access quickly.

Physical security keys may be an option for groups that need stronger protection, though issuing and supporting them for every student can be expensive and inconvenient.