Bad actors will attempt to phish for your information by sending emails that look like they came from someone you know.
Bad actors can spoof web pages and make them look like your school or bank. If you are suspicious, browse to your bank or schools website manually.
These links can be copycat URLs, designed to fool someone into thinking it is legitimate (IE: "my.gmail.com" instead of "gmail.com")
If you receive an email from someone you do not know personally, or an email from someone you were not expecting, you need to be suspicious. In most situations, these are not legitimate.
These bad actors can even call you and pretend to be someone you know. If you are suspicious, do not provide them with this information. Tell them you will call them back later.
Bad actors will try and spoof email addresses and phone numbers from people you know. Always be suspicious of anyone asking for personal information or payments over email.
This includes anything that's personal information: Credit Card numbers, Social Security Numbers, Bank Accounts, Usernames, Passwords, Address, etc.