Updated March 30 to reflect news that the IRS tool will now be down until Oct. 1.
Just as millions of students were facing financial aid deadlines this month, the federal government disabled a tool that made it easier for families to fill out the single most important form—the Free Application for Federal Student Aid.
On March 10, the Internal Revenue Service announced that its “data retrieval tool”—which allowed families to automatically import their tax data into their federal aid application, or FAFSA—would be suspended for “several weeks” as a “precautionary step” to protect taxpayers’ data security. Late Thursday came news that the tool would be shut down until at least Oct. 1.
The pause was sparked by “concerns that information from the tool could potentially be misused by identity thieves,” the IRS said earlier this month. “At this point, we believe the issue is relatively isolated, and no additional action is needed by taxpayers or people using these applications,” the agency added in the March 10 announcement.
The IRS and the Department of Education declined to provide further details about the concerns. But security of the aid application has long been a concern. Last year, for example, the Department of Education added an extra step for anyone who wanted to register a username and password to start a FAFSA.
The outage is of most concern to residents of states with looming deadlines. While most states’ deadlines have already passed, residents of Mississippi must file their FAFSA by March 31, the Kansas deadline is April 1, Delaware’s is April 15, and Massachusetts and Maine residents have a May 1 deadline.
The National College Access Network, an organization of nonprofits that help students apply to college and find financial aid, said Thursday that the tool’s extended outage will mean students and families will have to hand-enter information from their tax forms, and will have to provide much more documentation to schools if they happen to be selected for the financial aid equivalent of an audit—a process called “verification.”
Some schools demand verification for more than a third of all students.
John Pouey, an information security officer at a New Orleans financial institution and member of the information security trade association ISACA, said earlier this month that while he wasn’t familiar with any specific threats or attacks on the IRS or Department of Education, the tax information that is being transmitted is of great value to hackers. “It could be enough information to steal an identity,” he told MONEY.
The 2017-18 FAFSA has been available—most of the time with a working automatic tax information tool—for anyone to fill out since Oct. 1. The Department of Education said about 12 million students and parents had filed their FAFSAs by Dec. 31 this year. But millions of students could still be affected by this. Last year, almost 20 million Americans filed a FAFSA. (Here are 7 legal ways to squeeze more money from the FAFSA.)
The move also adds another hurdle for student borrowers currently applying for the federal government’s income-driven repayment plans. As long as the data retrieval tool is disabled, anyone applying to cap their federal student loan payments at no more than 10% of their disposable income, will have to provide paper documentation of their income.
Anyone filling out the FAFSA now must gather their 2015 tax filings and manually fill in information such as their adjusted gross income, income tax paid, tax credits, etc. The IRS notes that those who can’t find their 2015 tax forms can ask the IRS to send them a copy of their tax transcript.
But Carrie Warick, director of policy and advocacy for NCAN, said she tried to request her own transcript earlier in March, but gave up after five online applications were rejected because of difficult verification requirements and technical problems. “I couldn’t find our auto loan number remotely from my office, and my Internet browser timed out while loading the ‘send code to mobile phone’ page,” she said.
Those who can’t get an online transcript must wait five to 10 business days to get print version in the mail, she said.