Student Loan Fraud with Guest Co-Host Ben Orencia and Expert Fred Rocha

Student Loan Fraud is a somewhat unknown and unenforced crime. This interview with Fred Rocha, retired 30+ year employee of the California Community College system sheds light on the national student loan fraud problem. To date, billions have been lost, and our education system and students suffer. It’s time to end this travesty. 

DISCLAIMER: The information provided in this podcast is for informational purposes only and is not intended to and shall not be used as legal advice. The views and opinions expressed in this episode are solely those of the speaker/s and do not necessarily reflect the views or positions of LexisNexis Risk Solutions. LexisNexis Risk Solutions does not warrant that the information provided in this podcast is accurate or error-free. 

Transcript

Narrator: Hello and welcome to the FraudKast, brought to you by LexisNexis Risk Solutions. The series that shines a light on fraud and theft across numerous government benefit programs. FraudKast is hosted by Larry Benson, Director of Strategic Alliances for LexisNexis Risk Solutions Government division, and the creator and principal author for the Fraud of the Day website. And now, here’s Larry with today’s guests.

Larry Benson: Welcome to the FraudKast, I’m your host Larry Benson. In this podcast we expose government fraud and theft. Today we will look into student loan fraud. Our guest is Fred Rocha, a past 30-year veteran of the California community college system. Fred, welcome.

Fred Rocha: Good day Larry. Good to see you.

Larry: And with me as co-host will be Ben Orencia, an executive at Okta Corporation, who’s got 20 years of cybersecurity expertise in education of the public sector, and he also works in the space of Identity Access Management. Ben, welcome.

Ben Orencia: Thank you Larry, pleasure to be here.

Larry: So Fred, let’s just jump right into it. For our listeners, could you describe the process, just briefly, on applying for a student loan and some of the areas that you see are challenging?

Fred: Certainly. I think one of the challenges working in the public sector is that certainly we want our resources, and access to our resources, to be as simple as possible. In California, specifically in the community college system, both the application process to participate in higher education as well as the application for receiving loans, or grants, or any other sort of financial assistance, is relatively straightforward. There’s a few basic questions that are asked, and once answered, permits a student, or someone purporting to be a student, access to that information that would be necessary to apply and receive loans and grants to continue their education. 

Larry: Ok. Now, what are the requirements? Do you need to be a citizen of the U.S., what are the details?

Fred: One of the unique aspects of education in California is certainly access for all. So if a person is not a U.S. citizen, if a person has difficulty establishing identity, that does not bar them from receiving assistance specifically from the state. Federal regulations certainly have other requirements that have to be adhered to, but in the case of California, and maybe true in other states as well, the goal is to eliminate as many barriers as possible for that individual. So it would not be a requirement to have, say, a social security number, or perhaps even a TIN, in order to request and receive financial assistance. 

Larry: Mm-hmm, is that for grants as well?

Fred: Absolutely.

Ben: Fred, thanks for that. So this is Ben, I was curious to kind of ask a little bit more about the experience for that applicant, like where do they go, who do they have to connect with in order to complete that application to get that information to then go from applicant to student?

Fred: So the application process is relatively straightforward. There is what is called a common app, a single application process for any student, any person looking to attend the California community college system. Once that is completed the student is able to direct that information to go to college or colleges of their choice. That information then is passed on to those institutions. So, for example, the last district that I was with had three different colleges that comprised the district. It was not uncommon for us to receive hundreds, if not thousands, of applications during any cycle, in which those students would indicate their potential areas of interest, areas of study, and also areas in which they may need assistance in order to be able to attend. 

Ben: Yeah, that was going to be my next question. Once they give that process then at what point are they then looking to provide those requirements that Larry had asked about to get that student financial aid or resources so they can get registration done with the college?

Fred: Well, so much of that student’s identity is generated or created during that application process. With regards to their presence in our system, I think one of the challenges certainly is that you are dealing with very little verification process to the extent that as long as it is a legitimate address, a legitimate zip code, city, and state, someone can provide that. So it isn’t going to have the ability to see if somebody actually is living there or to see if even that property actually has a home on it.

Ben: Right.

Fred: You know, one of the things we certainly notice is that, thanks to programs like Zillow someone can put in just about any address they want and get a reasonable assurance that there’s at least a residential area, and use that if they’re looking to do this for reasons other than true desire to improve themselves and take advantage of what higher education offers them. 

Larry: Well it sounds like, Fred, that there’s really, it doesn’t sound like there’s a lot of checks and balances here.

Fred: There really isn’t. And that’s part of the problem. You know, if I turn the hands of the clock back, or  the pages of the calendar back about three years ago when we were in the beginnings of the pandemic, we had every service that was offered within higher education that suddenly had to be turned to be an external process, one in which you didn’t have to have a number of actual human interactions in order to complete that process. And that really, I think, exacerbated the flaws within the system. It gave us an opportunity to see where our challenges were really lying. The best example I can give you, at one of the institutions that I was working at, suddenly we started to see this huge influx of applications that were pretty easy to identify from one sense. They were all coming from a very specific IP address, Internet Protocol address. They were all using the same physical address. They were not being very diligent in their efforts. You know, it was a lazy man’s way of trying to get into the system, just keep repeating the same, whether cut and paste, or likely, in this case, more of a bot, using a program.

Larry: So are you saying that I could take your identity, or Ben’s identity, and just go apply for student loans, and more than likely, get those student loans?

Fred: It’d be probably easiest with Ben and myself because we’re upstanding citizens who have, you know, lots of information that would make us look like upstanding citizens applying for just a standard financial aid package, so yes, unfortunately that …

Larry: Well, it sounds like if they’re not checking really very much or anything, whether you’re an upstanding citizen or not, it’s still going to go through.

Fred: Yeah, well, I think you can be dead and still get financial aid in our system. That’s one of the amazing things that I think has really been uncovered is that as we went through this and you start trying to clean up the mess afterwards, as far as, you know, what happens within your systems, your student information systems, your financial aid systems after the fact instead of trying to prevent this from occurring in the first place. You get a pretty good sense about what sort of data is being used, what that process looks like, and hopefully learning some important lessons about what we should be doing in order to prevent this from happening. 

Larry: So is this potentially organized crime? And then second part of this, is this isolated to California or do you think this is a national problem?

Fred: I definitely think it’s a national problem and, organized crime, you know, when we say organized crime, I think sometimes we have some very specific ideas in our head about what that could be from a criminal element. Organized crime, I think in this case, simply means individuals or groups of individuals who have found an actual practice, and systematic in which they’re able to take advantage of these holes within the system. It is more than the individual, I’ll put it that way. It’s more than the random person connecting. These are people who have figured out that the FBI isn’t going to investigate, local law enforcement isn’t going to investigate unless there’s some level of activity that warrants it. And while you and I may think of “Hey anything is worth investigating, any dollar amount”. When you hear that they don’t even begin to look at this until it’s a hundred thousand or two hundred thousand, you realize that people, that they’re able to fly under that radar. Right, you know, hit every institution you can, rotate through the various states, try to get fifty thousand dollars in financial aid and you could make a pretty good living, never really drawing the attention of law enforcement because it just isn’t worth their level of effort that it would take to crack down on this.

Larry: So this sounds like death by a thousand cuts.

Fred: Oh absolutely, and I think that the part that people may not realize is that the institutions themselves are the ones that pay the price. In other words, if you give out financial aid dollars, whether it’s a loan or a grant, and not only are you taking those one time resources, those very specific resources, away from the students who truly need them, you’re also subject to penalties and fines for having to return those dollars because you as the institution were supposed to have a methodology, a practice, standards that would prevent that from occurring within your environment.

Ben: Yeah, Fred, I was going to ask about, like, what is that impact to the institutions, then, as you mentioned, the people, the right people that are looking for those services? Have you seen, or have any experience with institutions that have tried to address this issue, or what’s been done, and then on the flipside, is it just up to each individual college, as opposed to having a standard practice across the board?

Fred: Well, you know, I think there’s many of my colleagues who find strength in numbers, and we have certainly tried to collaborate, develop methodologies and processes that we can put in place. Again, if I turn the calendar back, in the early days of this, you know, we had our own limited resources, meaning each district was dealing with this as it occurred within their environment. So, you began to utilize either specific tools or services that would help identify the type of activity in your system that was suspicious. But by then it’s really too late. Then it’s such a labor-intensive process that is using up all of the critical resources of that individual college and district to respond, that, you know, all of us within the larger California system are advocating for assistance. And we did get some, you know, there was focus on trying to deal with some of the bot activity that was getting in there. But as you would remove a certain layer, you would find that there were other layers that were there that had to be dealt with. And I think that’s one of the things that still, the big challenge within the California community college system is still the need to have an ID proofing practice and procedure in place. To have tools that would allow that sort of negative activity to be caught at the beginning and not allow it to be passed on through the food chain. And then end to ensure that if you get blocked at my institution, I don’t have to worry about sharing that information with somebody else. Instead it gets blocked at the highest level, and that means all of us are protected. So there’s certainly better ways to do it than the way we’re doing it right now. And it’s just making sure that that stays on the radar for those people that make those decisions.

Ben: So obviously at the time that the institutions are doing these things manually, right, what is the impact, again, on the timeframe back to the applicant? Are they waiting to hear back as those processes are going through? And then to your point as we forward, then, being able to leverage that hive mentality where you can share that I blocked Ben, who wasn’t, maybe, NOT the upstanding citizen, right, so then the actual Ben can go in and get the services and not have to wait an uncertain amount of time to get that.

Fred: Well, you just really touched upon, I think, what is the struggle in California. And I don’t think this is perhaps to the same degree other states. You know, I would say that California has a true focus and a desire to not have barriers or obstacles for a student to achieve their higher educational dreams. Which is a wonderful aspirational goal, I fully support the idea that we want to have an educated populace. And we want to make it as accessible as possible. But the problem with having so little check and balance on that application process really creates that other ripple effect further down the line. You know, as you mentioned, we can have student applications that are put on hold because, of course, we’re trying to figure out what was triggered, if you will, that gave us some indication that there’s either more information that’s needed or necessary in order to really get this student into the system. But more often than not it’s almost the opposite effect. It’s “Hey, let’s get them into the system, let’s get them able to register”, and that’s when activity suddenly started to appear. Every time you would try to put some sort of safeguard, say, not only does the student have to apply to an institution in order to get some services, they have to actually register for a course, and then they even actually had to show up, you had to see them show up. Well, again, in an online format, when we were dealing with no in-person classes, it was very easy for somebody to have an online presence. To appear as if they were actually attending these courses, and students, or in this case the criminals, figured out exactly what was the minimum threshold, what did they have to do in order to finally get those dollars released. And, for the average person, they might think, “Well, why don’t you just simply withhold the financial aid until there’s some level of ability to verify?” That actually goes against what financial aid is for. Financial aid is meant to help that student get their books before classes start, to get a place, to have room and board if they’re having to live onsite. You know, whatever the case might be, the real need for those dollars is real for our students right upfront in that process. So it’s not really possible to say withhold the bulk of those dollars until some further point in the semester where there’s additional validation that’s taking place. And the other part of your question, Ben, is the part that drove me crazy. And that was once we started to see suspicious activity, say, that there was a particular section, an English 101 section that was filled, it had a waiting list that came up, and then when class would begin, you’d find out that those were fake registrations. That those were people who were simply trying to game the system to get whatever financial aid, whatever grants, whatever it was they could get that they felt they were entitled to based on that enrollment requirement, they would then go ahead and suddenly disappear into the wind after they received that. And what that meant was that not only did students not get into a class that they needed, it also meant that in some cases, that course was cancelled because there weren’t enough legitimate students in it. And all of that took legwork, it took humans at a district, or at a college, to have to dig in and figure that out, which just ate up all sorts of additional resources, that again, could have been going to helping real students. Instead, all it did was try to turn us into, you know, the student aid fraud police when that’s not really what our job is. 

Larry: Hey Fred, you said something very interesting, that after the class started it was determined that some of these students were fraudulent. So who’s doing this determination? Is this actually being done in the classroom?

Fred: Done in the classroom, done in financial aid offices, done in counselling offices, done in IT, it literally took an army Larry. You want to talk about the greatest resource waste, it’s having to take your instructor, your actual subject matter expert who’s teaching this course, who’s trying to impart knowledge to their students, suddenly having to find ways in which they’re becoming internet sleuths and looking up to see “Hmm, did that student say the same answer or is this somebody else? Was the activity that was in class minimal?” In other words, the chat or the discussion boards that were part of that online process, were they just repeating the same things? In other words, the equivalent of, you know, mashing the keyboard and just submitting it in order to look as if they were actively engaged. Yeah, it took away the work of our faculty, our instructors doing that. And then when they would raise that, then it would have to go to a student services expert who would then have to try to locate and figure out, was that a legitimate address? Had the student taken other coursework? Maybe contacting peers in other districts to say, “Have you seen this name appear within your district having fraudulent activity?” It just became monumental, and you could see that we were pulling away all these needed people from the activity they were really meant to be doing, which was serving the needs of students. Instead, it was addressing the outcomes of criminals. And that was a heartbreaker.

Larry: Now I know that you’ve got upwards of a million applicants a year, which is an enormous number, and across over a hundred colleges. So you’re talking about thousands of professors that are playing traffic cop in the classroom every single day.

Fred: Exactly.

Larry: That’s an enormous cost.

Fred: It is. Ang again, it takes away from instructional time. I mean, we could talk about whether that instructor should have to do that, right? Whether that’s actually part of their role. But, separate and apart from that, instructional minutes are precious minutes, right? All of us who have ever spent time in a classroom, who have ever been trying to learn a complex task or deal with concepts and ideas. Anytime an instructor is not able to really focus on what their expertise is and to help students is really time lost that will never be recovered and has such a negative impact for our students. 

Larry: Amazing. So what do you see as the way to address this, and for the California community college system, which is an enormous system. I think it’s the largest in the country. What’s the way to address this when you’ve got over a million people coming in? It calls for some level of automation.

Fred: Oh, absolutely. And I think there’s any number of us, even those of us who are like me now and have retired who still advocate at the highest levels within the California system to really focus on ways of automating and having an ID proofing system that still honors the idea of equal access, to elimination of barriers, and it can be done. I mean, the thing is that we know the technology exists that would allow us to very quickly do some checks that are perhaps some of the largest areas in which we know fraud is taking place. And too are, you know I talked about earlier, literally dead people applying to take courses, that’s one. But the other one is incarcerated individuals. We actually provide instruction from the district I worked in, we provide legitimate instruction to incarcerated individuals. It’s a wonderful service, an absolutely needed and necessary service. But what happens is that those individuals can have their social security number, which is absolutely legitimate, tied to a person, be harvested and be used by cybercriminals in order to gain access and get financial aid under the guise of somebody else. And, again, if somebody’s incarcerated, are they going to be pulling their credit report, knowing that there were loans taken out in their name? Probably not. I mean, the dead certainly aren’t going to report that, and neither are the people who don’t have access to technology. So it’s pretty simple to look at just those two areas and say if we had those tools in place that would catch and flag any sort of data that was tied to those two classifications, we’d be able to stop quite a bit right up front. Large percentages right up front. And then finetune that and be able to utilize systems that would actually improve our ability to respond. I mean, if we had clean data coming to us at the application layer, meaning, when a student is applying into the system, I wouldn’t have to have spent time with my team, and within the student services teams running down and trying to track down and squish the thousands of inappropriate applications, and fraudulent applications that were having a negative impact on us. We could have actually been focused instead on getting the resources and the services to those students who needed them.

Ben: Yeah, on top of having to react to what the professors and teachers were doing as traffic cops, that fraud already happened.

Fred: Exactly. And, you know, that’s the thing. Education, as itself, is supposed to be the great enabler. And what we found is that it really was enabling criminals to be able to get into the financial aid business and figure out exactly how they could profit and do this at dollars amounts that wouldn’t get them the attention in law enforcement tracking them down. And that’s a dangerous recipe. When you make it easy for criminals to do something illegal, when you make it profitable for them to do it, and then you’re negligent and don’t go and actually put the tools and services in place that could prevent that, that’s a recipe for disaster. 

Ben: Yeah, kind of like you said earlier Fred, I mean it’s, hey we need to have these gates so we can have the right outcomes and processes and resources and education for these folks, but that’s going to take time, so forget that, open up the gates and then we’ll just deal with what we’ll have to deal with from a reactionary standpoint. And it sounds like from your experience and what you said about being able to automate that upfront, right, not only helps your teams and the professors, but the applicants that are vetted, right, like you said, get that access to what they need to access to. So it doesn’t impact them, and you actually have the right class sizes, at least for ninety-five to ninety-eight percent of it. 

Larry: Well Ben, it sounds like you’re describing what we went through with unemployment during the pandemic.

Ben: Yeah.

Fred: Exactly. And you know, you’d figure those criminals that got stopped there just went to the next weakest link in that security food chain, right? They figured out that, and that’s the thing, I don’t want my system to be perfect. It doesn’t need to be perfect. It just needs to be resilient and difficult for them to go, “You know what? It takes too much effort for me to extract any value from being here”, move on to something else. And I don’t want them moving on to another community college in California. Heck, I don’t want them moving on to any education institution at all, but I do want us to benefit from lessons learned and get ourselves in place where we actually are employing the tools that are needed and necessary to secure our environments. And make sure that your tax dollars, my tax dollars, they all go to actually serving the good that they’re supposed to provide, as opposed to ending up in somebody’s pocket who’s simply out there trying to figure out how best to rip off another system to their benefit.

Larry: Hey Fred, would you have a personal guess as to what you think the potential fraud rate is? I mean, you’ve been doing this for a long time, you’ve, as you mentioned, all these applications, you’ve dealt with all the professors, etc. If you had to throw a dart at the side of a barn, where would you think that that would land? Is that a half a percent, five percent, what percentage rate are we talking about?

Fred: At any given time, Larry, I’d say it’s probably ten percent of the applications that come into a district. You know, and it’s funny, if you were scoring a test, right, you’d go, “Hey, ninety percent’s pretty good right? I’d take that, that’s an A minus.” But in our world, that’s horrible. Imagine that you’re dealing with fifty thousand applications to your district and they’re all coming to you, being passed on looking as if they’re legitimate, and five thousand of those are not legitimate applications. They’re able now to go through that same process that every legitimate student goes through, and now they may not surface. You know, it’s like having termite damage, right, you get them into the structure, they don’t necessarily surface until it’s something that’s really critical that lets you know that they’re there. And in this case, they make it through the initial registration, they get into courses, they complete their application process, and they don’t begin to appear until they’re not showing up in class, that coincidentally coincides with right after there’s been a disbursement in those financial aid dollars. So, you know, it’s the heartbreaker because you look at that and, if you’re good, if you’re really, really good and you’ve been able to come up with your own processes to weed some of that out, maybe you’re looking at the information that’s coming in through that application process and you raise your own red flags by looking for patterns that seem to indicate that there could be fraudulent activity. But again, why should I have to make that investment at my individual district when we could make that investment at the highest level and be able to surface that and prevent all of us from having to expend those dollars? 

Larry: Well that also gets clouded because you’ve got some legitimate students that are coming in at the last minute, they have a death in the family, they’ve got challenges, etc., and now all of a sudden that’s a legitimate student that now looks fraudulent but may not be.

Fred: Absolutely. 

Larry: That’s a lot of dust that gets kicked up.

Fred: It does, and it does cloud all of that. I mean, if you’re trying to serve students that perhaps are homeless, if you’re trying to serve students that are recent immigrants, whatever the case might be, there’s any sorts of legitimate reasons what somebody may not be able to answer or have the data that’s necessary in order to go through the system automatically. But again, that’s what those resource specialists are supposed to be there to assist. They’re supposed to assist the legitimate students who are having those challenges, not be internet security fraud police. And that’s the unfortunate outcome.

Ben: I think you mentioned it a few times Fred, but what’s that ideal state look like? With your experience, and leveraging the system in many different colleges that are doing things manually, and some may have better practices than others just because they have more resources than others. We know one’s got people in it; the other ones are very rural. How do you leverage the many to help solve this across the system, and then even build a foundation of a standard practice that can be continually improved and automated?

Fred: Well, I think there’s actually a fairly straightforward answer to that. And it is, there are times when individuals should be individual in their actions and in their resources that they use. But there are times when systems need to absolutely have system thought and system practices. To be able to have both an identity and access management solution as well as an ID proofing solution makes the most sense to me. If we actually made the small investment from a dollar perspective in terms of having those tools in place, think about how much better not only the security would be, but the user experience would be. To be able to have a single credential that you would use as a student, or heck, even as an employee of the state system. Because we have many instructors who are adjunct or part-time instructors who work at multiple institutions, who have to have multiple credentials in order to do that. Doesn’t it make sense instead to look at our system and say let’s establish who you are, let’s establish what your role is, let’s give you access to the systems based on that role within your institutions, and let’s also make sure that as anybody’s applying and going through the process. You know, you think about what an instructor goes through in the fingerprinting process, the life scan process. We’re not even talking about anything as arduous as that, we’re just talking about being able to see what database is out there, actually could assist us, in determining whether these are legitimate, and if there is any flag then how do we quickly get humans to do the investigation that’s necessary to get them through that process as quick as possible. If we do that, we make that small investment, use the right technology, and do it with the right framework, then what we actually end up with at the very end is a person who’s gone through the system who’s much more satisfied, because now they only have one set of credentials that they keep with them and go to any, and use at any of the institutions either they’re attending or they’re working at, and on top of that, they can rest assured that their digital resources are protected. That they’re not going to be the subject of somebody doing impersonation or trying to gain access or take services away from them that they could potentially need.

Larry: Hey Fred, what is the average student loan? Let’s say student loan and grant together? 

Fred: It can vary widely, but, you know, it’s not uncommon for those amounts to be seven to ten thousand dollars. And I’m talking about individual, not in total, financial aid package. A total financial aid package is going to be dictated upon where is it that you’re looking to attend, what is the cost of rent, what is the cost of food, the cost of fuel, all of those things. It can go into that, but it’s not uncommon, for example, with Cal grants, as well as with other student loan packages, it’d be fifteen, twenty thousand dollars for that individual student. And that’s per year, so it’s not necessarily huge amounts of money by some people’s standards, but if you do that over and over again, it quickly adds up. 

Larry: Yeah, because I was just looking at some of the numbers that you had mentioned before. If it’s a ten percent fraud rate over a million applicants, that’s a hundred thousand applicants. If each one gets ten thousand dollars apiece, that’s a billion dollars.

Fred: Yup, pretty soon you’re talking about real money, right?

Larry: Yeah, an extra billion dollars I’m sure California could use to help educate their population. 

Fred: Absolutely. And, just again, from the perspective of what is the goal actually within that entire system? The goal is to get students access to education. What we’re doing is in essence saying that ten percent of our population, not only that ten percent that are fraudulent applicants, those ten percent that actually make it into the system, that actually can get away with stealing these resources, that’s just the amount of cash, if you will, that ends up in the pocket. That doesn’t even calculate the level of labor that it takes within the district that they’re spending internally in order to respond to this and to combat that. So, again Larry, I’d say almost double that because you’ve got to look at what the resource cost is for that individual district, those colleges, to be able to respond and deal with that, and that’s a huge, huge burden that’s currently beared by our institutions. 

Larry: Overlay the comment before that this is a national problem. I believe that California represents roughly about one-fifth of the public education students across the nation. So, you’re looking at a very conservative five to six billion dollars nationally.

Fred: Yeah, easily. And you would think that there would be an appetite to deal with that. You would think there would be an appetite to actually solve that sort of challenge, and, you know, that’s certainly the hope with podcasts like this and speaking to those people who are in the decision-making seats. One, it’s not going away, you can’t just simply ignore it and pretend that it doesn’t exist because it’s going to bite you. And, you know, you see it in different articles that surface from time to time. I’ve dealt with individual cases that received local newspaper coverage, because, again, they were individuals, they were people who figured this out. You know, quite frankly, if you read a New York Times article about financial aid fraud, I think the unfortunate thing that most people walk away with is, “It’s pretty easy to get away with it, so why don’t I just do it myself?”

Ben: Yeah, right, yup.

Larry: Yeah, that’s the sad part. It’s going to the wrong parties.

Fred: Yes.

Larry: Fred, thank you for your expertise and your time, we certainly appreciate it. Ben, I appreciate the help co-hosting, and look forward to working with you again in the near future. Thanks everyone. Take care.

Narrator: Thank you for listening to this episode of the FraudKast. If you’re interested in learning more, head over to our website at FraudKast.com for more episodes, transcripts, and social media links. And remember, that’s FraudKast with a K, not a C. And to stay current on what’s occurring in the world of fraud, be sure to check out FraudoftheDay.com.