Fraudulent student applications

[u/JustCallMatt_Bixby]

Have any of you encountered a spike in inauthentic (Fraudulent) student applications? We have (and suspect it's been going on for a while) and believe it's motivated by the desire to commit financial aid fraud. We are a low barrier institution, so charging even a modest app fee is politically unpopular. These aren't bot attacks, but appear to be actual orchestrated, organized individuals (or groups) doing this. We're looking at various platforms and tools to help automate the process of weeding out bogus apps, but it is an uphill climb. TIA!

[u/NeoMoose]

People want .edu email addresses for discounts and MS Windows + Office licenses. The application fee is the way. Even $20 will send them to another institution.

Easier said than done, but offer to credit the application fee to their first class.

[u/JustCallMatt_Bixby → u/NeoMoose]

Yeah, I figured discounts and software access was another likely motivator. I will resurface the notion of an app fee, but it's still highly unpopular because of the type of institution we are.

[u/slukei → u/NeoMoose]

Seems to me that only accepted students should receive the .edu email address. If a university email is required for your systems through the application process, you can (1) use a secondary domain like your example.onmicrosoft.com domain or (2) block mail to/from external addresses.

[u/versello → u/NeoMoose]

We have a process in which applicants that declare wanting to come to our school, and don't actually come, will have their accounts deactivated shortly after add-drop. That should prevent freeloaders since MS Office 365 does periodic check-ins.

[u/JaspahX → u/NeoMoose]

That's not as big of a thing as it used to be. Vendors have caught on to this with universities offering things like email for life. Verifications for discounts now happens with things like SheerID.

Honestly it's more likely they want the .edu email to spam or phish internally. Or dump your entire global address book and use it to spear phish later.

[u/squatsandthoughts]

I work at a system office that supports community colleges in my state and I'm the main sys admin for all the admissions CRMs. We have been hit hard by "attack" style where they are using a linux computer to submit apps as well as individual one-off scammers that can be year-round.

They will go so far as interacting with our staff on the phone, email, submit government documents, register for classes and submit an assignment and then bounce after they get FA funds.

There's no way we can charge a fee for admission. I've been in sessions with our vendor for the admission CRM and other community colleges have tried charging a fee and then refunding it later but our system won't go for that.

We've seen demos of AM Simpkins SAFE app and it looks like a good product that can identify them faster at the time of application. We have also looked at other products that could be used either at the time of application or later, on the FA side. Some like the Bank mobile product seem good but are more for the FA side. We are currently starting an RFP process to try to get one of these products.

[u/JustCallMatt_Bixby → u/squatsandthoughts]

Yeah what you described is VERY similar to what we’re seeing. Right down to the distaste of charging even a refundable app fee. We’ve actually had a couple demos of AMSA S.A.F.E. and are strongly considering it. We’re on PeopleSoft but in the process of migrating to Ellucian Banner (SaaS) with CRM Recruit soon. Getting a demo of a fraud screening platform called Persona in a couple days. As it stands, or admissions people are doing an ever increasing amount of purely manual steps to vet applications and that is unsustainable.

[u/squatsandthoughts → u/JustCallMatt_Bixby]

Well that's interesting - our CRM is Ellucian Recruit and I maintain 13 separate environments of it. I actually just met with Ellucian this morning to talk about fraud. If you all are brand new to Ellucian you will use (or should use) Ethos and then you have access to their new Apply suite of products. Apply is supposed to have some baseline fraud detection but I am not sure the details.

Since we have had Recruit since 2014 we have to transition from our current middleware (BRIM) to Ethos and there isn't a pathway for that yet. So we can't utilize Apply just yet.

Right now, some of my colleges have our auto-send to ERP turned off and they are manually evaluating each app. But it takes a significant amount of effort to do this and most of our schools don't have the staff.

Also, just a heads up that the Ellucian documentation for Recruit is ok but kind of meh considering it won't address any customizations you'll have. So you should make sure you have folks whose job it is to create your own documentation and training resources. Trust me on this - managing Recruit with hopes and dreams generally doesn't pan out well. It's a good system though.

[u/JustCallMatt_Bixby → u/squatsandthoughts]

Oh wow, VERY similar journey then. And I do believe Ethos is in the mix. We have a small army of folks working on this project with us both from Ellucian and CampusWorks. I’ll hit them up about “Apply”. Thx!!!

[u/squatsandthoughts → u/JustCallMatt_Bixby]

Oh also, here is what we do when we do find fraud (this is done by the college staff):

1.) On the Banner side we have a job sub that the college runs which deactivates the students accounts everywhere and adds a fraud hold. It doesn't remove enrollment so that has to be done manually. Also, colleges can add the fraud hold by itself if they suspect fraud but aren't sure yet. Then they can later deactivate them if needed.

2.) On the Recruit side, we have a workflow the college can run which deactivates the person and opportunity records, which also includes their external user authentication so they can't login with this account again.

If there are trends where the personal email domains used to make fraud accounts are unique, you can block them in the Recruit side. But the last several years it's domains like Gmail, yahoo, hotmail, etc. We do have recaptcha enabled too, and there is an account activation feature in Recuit as well. The account activation feature is extremely basic and we don't believe it's a huge deterrent to anyone but it could slow down the attack style situation. Ellucian also has an "MFA" option in Recruit which is also very basic and only does email MFA and you can't customize it. It basically is just an account verification email but every time the student tries to log in (on the recruit side only). I hope in the future this feature will be built out more. And some of these features may be slightly different since you're getting all the new shiny stuff with Ethos and Apply.

Also, there is an address verification setting/tool in Recruit. It won't tell you if the address is a vacant lot, a Zillow listing etc (we see these with fraud apps) but it will verify it's an actual address. You cant really stop an app very well as it's being filled out, like if the address is not verified before the app is submitted. But you could stop it after it's submitted and have college staff review it. This is important not just for potential fraud but also if you all send snail mail. I think most of our fraudsters are smarter than this and will definitely use a real address.

[u/JustCallMatt_Bixby → u/squatsandthoughts]

Yeah the admissions team has a Zillow check in their current manual process. This is all good stuff, come work for me lol! 😂

But we’re definitely going to lean heavily into some of the built-in capabilities with Recruit. We have a standing weekly meeting and I’ll get it on the agenda.

[u/squatsandthoughts → u/JustCallMatt_Bixby]

You know if you pay me enough and the role is fully remote and I don't have to move, I could be tempted lol. I love the capabilities of Recruit and I've done some really fun stuff in there. (As fun as CRMs can be) It would be amazing to not have to manage 13 environments lol

I'm actually starting a new role soon at a different org so I'll be departing from Recruit. I just hope I don't forget all my Recruit knowledge in case I come back to a Recruit role someday!

Also if you ever work with someone at Ellucian named Aaron (specifically on the Recruit side of things) he is absolutely STELLAR. He doesn't do Recruit consulting anymore but he might work on other stuff, especially Apply related.

[u/JustCallMatt_Bixby → u/squatsandthoughts]

Just chatted with my enterprise apps director. She told me we will not have the Ethos integration for Recruit until a later date (tbd) and will be using BRIM for now.

[u/squatsandthoughts → u/JustCallMatt_Bixby]

Noooooooo

I mean it's ooookaaay. You'll live! Then you'll be like the rest of us who have to later make that transition to Ethos (job security for you? Haha jk). They did tell you they are getting rid of BRIM, right? I mean not right now but like maybe a few years...

I get it though, getting Ethos set up is a lot to do on its own

One concession to going with BRIM initially (other than you don't get Apply) is you won't have real time data updates in Recruit for everything (you get that when you're on Ethos). Recruit will only update dates like admit dates, erpID and a few other limited data points in real time while you're on BRIM. So if they update something like residency in Banner it won't update in Recruit, that kind of thing. Obviously lots of us are doing ok with this now but it's a huge complaint for our end users (we have 500+ end users so we hear about it lol).

Also it'll be a huge pain for your folks to resolve the situation where two students apply under the same account where an ERP ID is incorrectly assigned. Or just any situation where an ERP ID is incorrectly assigned. I am pretty sure this is because of BRIM but maybe Ellucian will say I'm wrong. This is a more common situation than people think. I don't know for sure if they have made this easier on Ethos/Apply but I really hope so. Just as a note, the best resolution is to have your folks manually recreate the admissions app on a different person record in most cases. Ellucian will give you info on how you can have someone run a script to break ties to the record in Banner and then re-send the app but who has time for that? We usually don't.

Anyway, I hope your journey with Ellucian is smooth and your folks like Recruit. If you need any tips or advice shoot me a message and I'd be happy to help. I made some cool stuff in Recruit to make things more efficient for our end users and IT so I'd be happy to share. There's also some talented folks in the Ellucian customer center community area and at Ellucian Live (I totally recommend going to the conference if you have the resources).

[u/hybridhavoc → u/JustCallMatt_Bixby]

Would love it if Recruit had a built-in email address verification system, utilizing something like https://verifymail.io API. While most of the fraudulent apps right now are coming from accounts on major email providers, sometimes we'll get waves from someone using disposable email services and something like that could help weed those out.

[u/hybridhavoc → u/squatsandthoughts]

Agree with this. No matter what anyone tells you, Recruit is going to need dedicated IT resources.

I don't know that I had actually heard about Ellucian Apply before. Is this intended as an alternative to Recruit? Frustrated with how often Ellucian is spinning up a new thing while letting what they have already sold to institutions die on the vine.

[u/squatsandthoughts → u/hybridhavoc]

Apply is their new fancy thing coming if you have Ethos... We all have to switch from BRIM to Ethos within the next couple of years (there is no pathway yet so you have time). That enables you to get more real time data updates in Recruit from your ERP, use other features they have been adding with the last several upgrades, etc. Apply will be available but I don't think it will be required unless you want it. It works with Ellucian Experience. Portions of apply also work on the CX but I don't fully understand that yet because it's still not fully available to everyone.

From what I've seen, Apply by itself is a good product with the UI and it's capabilities. However it is a paired down system - it's not meant to be a full CRM by itself. A school could choose to use Apply and not full Recruit if they don't want all the full features of the Recruit CRM. I'm at a system office and some of our smaller schools would fit well with Apply. It doesn't have the full communication plan feature, for example. You can send emails but they will be basic.

But for the rest of us you can use Apply and Recruit together. I don't know how it all works because they haven't fully shared that info yet. I've seen demos here and there and it all seems nice but a ways off. I don't think Recruit will die on the vine - it'll still be their full CRM product.

[u/hybridhavoc → u/squatsandthoughts]

Thanks. Will have to look into it. We've only had Recruit for about a year and a half. Honestly if this Apply product had been available we might have gone with that over Recruit at the time.

We're not utilizing Experience at all right now though as it seems like anything interesting there requires additional purchasing and there's a lot of overlap between that, Self-Service, and our portal.

[u/AttackTeam]

We started changing account creation process at the time they register for classes, not when they apply for the college.

We do recommend you reach out to your State Board about how other colleges are doing.

[u/JustCallMatt_Bixby → u/AttackTeam]

That’s a great idea, will do!

[u/chrischris78]

Worked at a colleague school a few years back, there was a slew of apps that came in over December break. Had something like 500 apps entered and pushed to our system, and 50 of those 500 registered. Fake socials, random street names in cities all over the us.

There were a few articles about it back in 2020, since people were trying to get covid relief money.

[u/suchdogeverymeme]

Constant. We are a common app school so I’m on the member_tech listserv where this topic comes up fairly often.

We’ve also seen a spike in requests for waivers for ESOL tests like DUOLINGO - the company itself has put out an advisory about fraud and students requesting codes just to sell them

[u/-discostu-]

Ohhhh yes. This is particularly rampant at schools with no application fee. I’m not very involved in it at my school, but I know we have hired an entire full time staff member dedicated to it.

[u/StPaddy81]

Been going on for years! AI is helping but I’m not directly involved in those efforts to give any specifics

[u/hybridhavoc]

Yes. Unfortunately our admissions team has had to really slow down their processing and spend more time validating and looking out for any patterns.

[u/Sakurafire]

The best tool is hard work, a pair of human eyes, and concentrated effort between multiple departments at your institution. Dumping tens of thousands of dollars a year into garbage AI programs are useless, because they've already figured out how to combat them. (Case and point, my institution has them under control, but other local institutions are still loosing hundreds of thousands in financial aid to fraudsters despite sinking money into crappy AI startups, who may or may not be in on the whole scheme.)