Hackers Exploit FAFSA Tool to Steal $30 Million from IRS

All Security Reviews Staff · November 22, 2017

Hackers Exploit FAFSA Tool to Steal $30 Million from IRS

Tax season is fraught with scams, hackers and identity fraud. While restaurants, stores and businesses have been targets in the past, this year it was students. Up to 100,000 parents and students may be at risk for identity theft if they filled out a FAFSA form. The government’s financial aid site was hacked and may have been used as one of the latest identity theft schemes this tax season.

What Happened?

Back in September 2016, the IRS detected a breach on FAFSA’s site, but decided to keep it open because so many students depend on financial aid to attend college. However, this status changed in March when the IRS detected criminal activity, reports CNET. They believe the breach originated from the tax section of the FAFSA form that allowed users to automatically populate their tax information. The IRS believes that hackers posed as 8,000 students (up to 100,000 have been notified of a risk to their information), and stole $30 million in fake tax returns from the IRS.

What Should Students Do?

Students who are at risk of identity theft from this breach should have received a letter from the IRS about the possibility of fraudulent tax returns in their name. Students who filled out a FAFSA form using the auto fill feature but haven’t received a letter should still check with the IRS to make sure there wasn’t a false claim made. Students who have had their information stolen by hackers should carefully monitor their credit reports. They should put a fraud alert on their files, which forces creditors to go through extra steps to confirm their identity. They also should report identity theft to the FTC and file a police report. Students who aren’t sure if they were affected should check their credit report through one of the three credit agencies and make sure no new accounts were made in their name. The FAFSA online tool has been removed from the site to make sure there aren’t further problems. This means that students who have not filled out a FAFSA form will need to do so manually. They still can use the FAFSA.gov site, but will need to have their 2015 tax information on hand. If they don’t have a copy of their taxes, they can use the IRS’ transcript tool to get a summary of their returns.

How Can Students Protect Themselves in the Future?

Students should follow the same steps to protect themselves in the future. Because they have to fill out a lot of paperwork with personal information for school, they should monitor their accounts carefully. They should check their credit cards, financial statements, credit reports and any other accounts in their name frequently for any red flags. If they find anything unusual, they should report it to one of the credit agencies, their bank and credit card company and the business where it occurred. Especially around tax time, students should be aware of phone, email and online phishing scams. They should not give out personal information to places or people they don’t know, such as emails from unknown senders. They also need to install antivirus and anti-malware software on their computers to help protect them from bad links or scams.

All Security Reviews Staff avatar

All Security Reviews Staff

Our team at All Security Reviews (ASR) has extensive experience in the personal security industry. At ASR we bring this experience and expertise to you by reviewing security providers and grading each company through our proprietary Identity Protection Rating System.