New FAFSA Security Rules Cause Hassles For Some College Aid Applicants

The U.S. Department of Education’s tough new security rules designed to prevent hackers from stealing sensitive personal and financial information from financial aid applicants are starting to draw complaints from some high school counselors.

They say the new ID and password requirements for the Free Application for Federal Student Aid (FAFSA) are so strict that they're causing delays and frustration for people rushing to file applications in time for early deadlines.

“It is fine for security,” says Ann Hendrick, director of a nonprofit college advising organization based in Jackson, Miss. And if students and parents exactly follow the instructions for getting a Federal Student Aid ID and password (which you need to start a FAFSA), the application is reasonably quick, she says. But she adds that many parents and students are finding that small-seeming mistakes are leading to time-consuming hassles.

Resetting a forgotten ID or password, for example, “can be a lengthy, complicated process,” Hendrick says. One reset option requires families to wait 30 minutes. Mistakenly using a nickname instead of their name as it appears on a Social Security card on either the ID application or the FAFSA can also cause long delays, counselors said.

Any delays on finishing a FAFSA—which is the most important and most commonly used financial aid application—can potentially cost students thousands of dollars in college financial aid because some states and colleges award aid on a first-come, first-served basis.

Elizabeth Morgan, spokeswoman for the National College Access Network, a membership organization of nonprofit college counseling agencies, said that while everybody supports better security, the Education Department appears to have chosen a solution that is “much more cumbersome than what’s used by banks,” for example. And, she noted, the people who need financial aid the most are the least likely to have the tech know-how, smartphones, or even email accounts, needed to make the ID and aid application easier. (Here's a cheat sheet to the FAFSA's 12 trickiest questions.)

One online security expert, Al Pascual, research director and head of fraud security at Javelin, praised the department for trying to improve the security on student financial aid application information, but said government’s technological solutions tend to be “a little bit antiquated” compared with those of leading tech companies such as, say, Apple’s Touch ID fingerprint reader.

Department of Education spokeswoman Dorie Nolt said the agency had needed to improve security, has not received many complaints, and was in fact seeing signs that most applicants are breezing through. “It takes, on average, seven minutes to create an FSA ID,” she said. Nolt added that one million people created IDs in the first week of January. The new FSA ID system was launched last May, but many families are confronting the new system only now because January is the start of the financial aid application season for the 2016-17 academic year. She said the department had posted lots of tutorials, including this FSA ID video.

NEWSLETTER: COLLEGE_PLANNERSign up for COLLEGE_PLANNER and more View Sample

Counselors, security experts and federal aid officials had these four pieces of advice for anyone preparing to apply for a FSA ID and a FAFSA:

• Check your Social Security cards or documents. Copy the names and numbers for the student and parent down exactly in the FSA ID application and the FAFSA. If they don’t match, you’ll get an error message, and your application will not be processed.
• If you don’t want to use an email account... You are not required to have an email account to apply for an FSA ID or FAFSA. You can choose to answer “challenge questions” instead. But make sure you pick questions and answers that you'll remember months or years from now since you’ll be using the information on future FAFSAs and federal student loan dealings. Hendrick says families who get those wrong have to jump through many hoops to prove their identity.
• If you apply using email accounts... Students and parents must apply for their own IDs and passwords using their own email accounts. Parents and students cannot share the same email account. NCAC officials also advise applicants to use a long-lasting email address that you'll have easy access to. High school students lose their k12 addresses when they graduate, so students shouldn’t use that address in their application. Instead, use an email address such as a Gmail account you’ll be checking frequently for the next five or 10 years.
• Store your ID and passwords. If you don’t think you’ll remember your FSA ID or password on your own, Pascual suggests using a password manager service such as LastPass, or, if nothing else, write them down and stow them somewhere you'll be able to find them when you need to file the 2017-18 FAFSA. Pascual suggests that students who write the information down keep the paperwork in their parents’ home, because he says young people are four times more likely to have their identity compromised by someone they know than are average consumers.

This story was changed 1/26/16 to correct the data on the relative likelihood of young people's identity theft by acquaintances.