Yavapai College Stops Financial Aid Fraud Before It Starts

Community colleges have been a popular target for foreign bad actors because the process is streamlined, and admissions decisions can be automatic.  That said, colleges and universities of all shapes and sizes are impacted as well, with the same stolen identities being used across multiple institutions.

‍

The Federal Student Aid Office within the Education Department (ED) has been battling fraud, primarily involving bad actors targeting the Pell Grant program.  In response to this issue, ED updated its risk-scoring model, requiring more students, including Yavapai College students, to complete additional verification checks.

‍

Possible fraud wasn't limited to new applicants, either. Bad actors also targeted Yavapai's IT service desk directly, claiming their multi-factor authentication wasn't working (e.g., after receiving a new phone) and requesting a reset.

‍

New AI detection models are being used across Higher Education to identify potentially fraudulent students by leveraging available demographic and IP location data, as well as other patterns.  This technology is a useful tool for identifying fraudulent students, but it is not, by itself, a complete solution.  As Burns added, “IAL2 ID verification checks are a necessary add-on to ensure the applicant is a valid student.”  Identity Assurance Level 2 (IAL2) includes biometric comparison, matching a live selfie with liveness detection against the photo on the validated government document.

‍

The tension underneath all of it: Yavapai couldn't afford to let fraud through, but it also couldn't afford to make life harder for the students whose open-door mission exists to serve.

Yavapai evaluated identity verification vendors and kept running into the same limitation. "Many of the solutions in the marketplace are API-driven, where you need to write your own front-end system or work with a 3rd party partner," Burns said. "The Proof platform is more turnkey. You actually have a user interface that can be easily configured and used on day one."

‍

That interface mattered because more than one team needed to use it. Using Command Center, Proof's admin layer, Yavapai organized access into four groups: Admissions, Financial Aid, IT Security, and Procurement, each with different permissions. Burns said the platform let Yavapai segment those groups, set up SSO, and assign permissions department by department, a management layer he didn't find with the API-only competitors he researched.

‍

Each group put that access to a different use. Transactions are mostly automated for the Admissions team through YC’s CRM platform (Element 451), which is integrated with the Proof API.  Financial Aid sends one-off verification requests to students flagged for additional scrutiny. The YC Service Desk and IT Security team resolve user account issues, mostly multi-factor authentication resets for students who got a new phone and didn't back up their authenticator app. Procurement uses Proof's Sign product for e-signatures, an entirely different use case that shows how adoption spread once one department brought Proof in.

‍

That same flexibility carries through to students: once someone passes an IAL2 check, whether through admissions or a one-off request, the result is recorded in the Banner ERP system, Yavapai's system of record, so a student flagged later for the separate financial aid check never has to verify twice. Proof's IAL2-compliant verification checked both boxes for Yavapai. As Burns put it, it was "killing two birds with one stone."

‍

For some use cases, Proof's reusable EasyLink fits the constraints of Yavapai's form-based software, which could only present students with text and a hyperlink. Instead of building a custom workflow, staff select a student for verification and send them a single link to click.

‍

As stated above, Yavapai also connected Proof via API to Element 451, which they use for admissions applications and advising.  The default ID verification tool wasn't IAL2-certified. Yavapai was the first Element 451 customer to make that integration work with Proof.

Yavapai started small, running Proof against select applicant populations before expanding it to everyone who applies for admission. Now, an applicant who doesn't pass the IAL2 check never makes it into the college's ERP system and is stopped at the door instead of flagged after the fact, before a stolen identity can be used for nefarious purposes.

‍

Where verification used to mean scheduling a Zoom call and hoping the applicant showed up, it now takes about 3 minutes on average. Applied across all of Yavapai's credit students, that adds up to roughly 5,000 identity checks a year, most of them handled without a staff member ever getting involved.

‍

Initial concerns about friction for Yavapai's least tech-savvy applicants haven't materialized so far in the first full registration cycle with the requirement in place. "I think one of the cool parts about this is how hands-off it's been," Burns said. "When students need extra assistance, the trained specialists at Proof are patient and walk students through the process.”

‍

Service Desk staff also gained a tool they didn't have before: the ability to run an on-demand identity check for a walk-in or a phone call that didn't feel right, rather than relying on judgment alone.