FAFSA warning: Hackers steal students’ tax info via financial aid application

After FAFSA hackers pretended to be students and used the government’s financial aid tool to access information of up to 100,000 taxpayers, the U.S. Department of Education announced that FAFSA’s Data Retrieval Tool (DRT) has been shut down. FAFSA online applications are still available online. However, the Data Retrieval Tool to import IRS tax information will remain unavailable until further notice.

Students and parents completing a 2016/2017 and 2017/2018 FAFSA have to enter 2015 (not 2016) tax information manually until the financial aid security breach is fixed.

The DRT was disabled last month and will remain unavailable for students applying for financial aid on fafsa.gov and StudentLoans.gov until the Internal Revenue Service (IRS) and Federal Student Aid (FSA) can implement safety measures against further hackers and identity thieves.

The DRT is a web-based IRS data tool that allows FAFSA applicants to import tax information automatically into their FAFSA application.

Filling out a Free Application for Federal Student Aid (FAFSA)application contains more than 100 questions. Some of the questions ask for a student’s detailed financial information, including adjusted gross income and tax deductions.

In September 2016, the IRS discovered that hackers had used the financial aid tool to gain access to personal information and to file fraudulent tax returns.

Apparently, hackers used FAFSA to begin filling out an application and used the Data Retrieval Tool to download personal tax information. Once that information was accessed, the application process then remained uncompleted.

The IRS flagged 100,000 FAFSA applications that were not continued after the DRT was used and personal tax information had been downloaded. While some of those incomplete financial aid applications might be legitimate, many of them were likely started by hackers.

According to IRS Commissioner John Koskinen, 8,000 fraudulent refunds totaling $30 million have been issued so far. The IRS stopped 14,000 illegal refunds and detected 52,000 more cases of identity thefts.

The IRS has notified at least 100,000 FAFSA applicants that their personal information might be at risk.

Parents or students who have not been notified by the IRS so far might want to check the status of a child’s financial aid application.

The U.S. Department of Education announced that the scope of affected students is still being determined.