Freshers' week runs on cheap pizza, lanyards and a to-do list that never quite gets finished. Somewhere between registering with a GP and finding out which bus goes to campus, most students hand over a startling amount of personal data: passport scans, bank details, home address, phone number, and a photo of themselves holding a student card. None of that is a problem in itself. What causes trouble is doing it all in a hurry, with the same password used since school, on a Wi-Fi network that four strangers also know the password to.

The good news is that the fixes take an afternoon, not a fortnight. Work through the sections below before term starts, while you still have the patience for it.

Start with the university account

Your student login is the master key to your life for the next three years: timetable, email, coursework, sometimes library fines and exam results. Treat it better than you treat your personal email.

• Use a password you have never used anywhere else. University systems get credential-stuffed constantly — attackers take passwords leaked from other sites and try them here. A unique passphrase solves this in one move.
• Turn on two-factor authentication in your account settings. If you are offered an authenticator app rather than a text message, take the app. Text codes can be intercepted if someone convinces your mobile network to move your number to a new SIM.
• Set a recovery email and phone number you will still have in five years. Not your student address, which expires shortly after graduation, and not a phone you plan to replace in October.
• Check what the portal already knows about you. Term addresses, next of kin, mobile numbers and emergency contacts are often pre-filled and wrong. Update them, and opt out of any public directory listing if the option exists.

One habit worth forming now: your student email is for university business. Keep banking, shopping and social accounts on a separate personal address, so that when the student account closes you are not locked out of everything at once.

Lock down loan and bank details

Money is where freshers get hurt fastest, because the phishing emails are genuinely convincing and they arrive at exactly the moment you are expecting a payment to land.

Log into your Student Loans Company account and check the contact details on file. Change them to an email you actually monitor, set a strong unique password, and enable any two-factor option offered. Then apply the same treatment to your bank: unique password, app notifications switched on, and card controls switched on if your bank offers them.

Some rules of thumb for the first term:

1. Never act on a link in an email about your loan or bank. If a message claims a payment has failed or your details need updating, close it and log in through the official app or by typing the address yourself. Genuine organisations do not need you to re-enter full bank details via a link.
2. Do not share banking app logins with housemates, even for splitting bills. Use a payment request or a standing order. The account is yours alone, and so is the liability.
3. Guard your PIN and card. "Just for the group takeaway" is how cards end up saved in someone else's phone.

If money does go missing or your details are used, contact your bank's fraud team straight away — speed matters more than paperwork — and report the incident to Action Fraud. For anything involving debt, benefits or a tenancy dispute, your university's student advice service or Citizens Advice can point you towards proper help.

Shared Wi-Fi, shared everything else

A student house router is usually a hand-me-down with the previous tenants' password still written on the underside. Fix that before you unpack.

• Change both passwords. The Wi-Fi password, and the router's admin password — they are different things, and the default admin login is printed on the router for anyone standing in your hallway to read.
• Choose WPA2 or WPA3 in the wireless settings if the router offers it, and switch off the guest network unless you need it.
• Assume the network is public. Traffic to most major sites and apps is encrypted these days, but any device on the network can still see which services you use. Use the guest network for smart plugs, TVs and visitors, and keep your laptop on the main one.
• Turn on device tracking and note the serial numbers of your laptop and phone somewhere offline.
• Back up your coursework to both a cloud account and a physical drive. Laptops get spilled on, borrowed and lost in the first month.

Two tiny habits pay off daily: lock your screen when you leave the room — Windows key plus L, or Control plus Command plus Q on a Mac — and decline to install anything on your machine that a flatmate "just needs for a minute".

Trim what the internet knows about you

Freshers' group chats are wonderful and slightly terrifying. A WhatsApp group with two hundred strangers adds your phone number to two hundred address books before you have learned anyone's name. Tighten your privacy settings so your profile photo, last seen and about text are visible only to your contacts, and restrict who can add you to groups. Check the same settings on Instagram and any other app you have handed your contacts list to.

Then do a ten-minute audit of your own name. Search it, and look at what comes up. Old posts naming your school, a public account showing your home town, a summer job tagging your location. None of it is scandalous; all of it is useful to someone building a convincing message aimed at you.

Going forward, three things are worth keeping off the internet: your timetable, your flat number, and any announcement that you are away for the weekend. The classic mistake is a room-tour video that pans past the building entrance, the door number and the view from the window.

Finally, take advantage of the fact that you can ask. Under UK data protection law you can request a copy of the data an organisation holds about you, or ask for it to be deleted. Useful when you leave a letting agent, cancel a gym membership or realise a society has been sitting on your details since freshers' fair.

Your two-hour setup session

Pick an evening, make a drink, and work through this list in order. The first four items do most of the work.

1. Install a password manager and set unique passwords for your student account, loan account, bank and personal email.
2. Switch on two-factor authentication on all four, preferring an authenticator app to text messages.
3. Update the recovery email and phone number on your main email account.
4. Change your phone passcode from four digits to six, and check that automatic updates are on for your phone and laptop.
5. Change the router's admin and Wi-Fi passwords, and confirm it is using WPA2 or WPA3.
6. Review privacy settings on every social account, and delete two or three accounts you no longer use.
7. Save your bank's fraud number and your university IT service's contact details somewhere you can find them without internet access.

If something does go wrong

It happens to careful people every year. Move quickly: change the password on the affected account, sign out of all other sessions, then change the password anywhere you reused it. If your student account is involved, tell the university IT service — they have seen it before and can lock things down. If money is involved, tell your bank immediately and report it to Action Fraud. Keep screenshots and dates; they make every subsequent conversation easier.

Then tell someone. Embarrassment is what turns a two-day inconvenience into a term-long problem, and there is no version of this where you are the first person it has happened to.

Photo: Keira Burton / Pexels