[Wactclc-alma] Fraudulent student accounts

Wed Jan 12 13:27:39 PST 2022

I don't have the exact dates, but here's more info from our eLearning Director:

Overview

Over the weekend, eLearning fielded multiple concerns about the number of non-active students in Canvas from faculty. Based on the number of concerns filed, I conducted an extensive amount of research, which lead to finding 133 potentially fraudulent accounts in our system. Currently, there does not seem to be a security risk regarding access to backend data. However, it has been determined that this may be an attempt at getting Financial Aid money. Similar issues have been reported to SBCTC (State Board of Community and Technical Colleges) from other WA colleges.

Patterns Aligned with Accounts

  1.  ctcLink Accounts were manually created.
  2.  Accounts used Outlook or Hotmail email addresses with similar naming structures (use of 8, 33, and other numbers in the middle of the address).
  3.  Winter 22 was the first and only quarter aligned with these accounts.
  4.  Accounts had similar ID numbers based on when they were created (within three days of each other mostly).
  5.  Canvas - Mostly no activity in Canvas, though we did have a few login and complete quizzes; when this happened different students logged in minutes apart and used the same IP address.
  6.  Accounts were enrolled in a similar set of courses.
  7.  Some accounts had the same address.
  8.  No account had a phone number.
  9.  Attempts to apply for Financial Aid were made.
  10. No payment had been made.

How I found the Data (Patterns Started Quickly Emerging)

  *   Ran current enrollment report from ctcLink - filtered by email provider and no phone number.
  *   Looked up every one of those users (113) in Canvas and looked for activity level and IP Address if ever logged in.
  *   Compared and looked up addresses - many were houses on the market.
  *   Discovered patterns listed above.

What Are We Doing About This?

I've taken logistical lead to help the team through this. I am collaborating with Enrollment Deans, Financial Aid, Faculty, ctcLink/data teams, and IT. Here is our plan:

  *   Notified appropriate stakeholders - conducted a meeting to review data and develop a plan.
  *   Immediately suspended suspected accounts in Canvas.
  *   Dropping students for non-payment and non-participation.
  *   Researching Financial Aid implications.
  *   Reported to State Auditor.
  *   Documenting all data connection.

From: Wactclc-alma <wactclc-alma-bounces at lists.ctc.edu> On Behalf Of Abby Koehler
Sent: Wednesday, January 12, 2022 12:46
To: WACTCLC Alma Discussion <wactclc-alma at lists.ctc.edu>
Subject: Re: [Wactclc-alma] Fraudulent student accounts

Do you know when the accounts were created by any chance, Kirsti?
Thanks for the heads-up,
abby

abby koehler
she/her/hers
Systems Librarian
Whatcom Community College
360.383.3287

From: Wactclc-alma <wactclc-alma-bounces at lists.ctc.edu<mailto:wactclc-alma-bounces at lists.ctc.edu>> On Behalf Of Guidry, Wade
Sent: Wednesday, January 12, 2022 11:03 AM
To: WACTCLC Alma Discussion <wactclc-alma at lists.ctc.edu<mailto:wactclc-alma at lists.ctc.edu>>
Subject: Re: [Wactclc-alma] Fraudulent student accounts

CAUTION: This email originated from outside your organization. Exercise caution when opening attachments or clicking links, especially from unknown senders.

Just FYI, you can expire any set of patrons (fraudulent or otherwise) pretty easily if you have a list of those primary IDs.

Simply create a managed set of those users and run them through the update/notify users job to set their expiration date in bulk.

Wade Guidry
Library Consortium Services Manager, WACTCLC
wadeg at bigbend.edu<mailto:wadeg at bigbend.edu>
(509) 760-4474
http://www.wactclc.org<https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.wactclc.org%2F&data=04%7C01%7C%7Ca94c379cd3334726801608d9d60ca4e7%7C02d8ff38d7114e31a9156cb5cff788df%7C0%7C0%7C637776172095227127%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=LMfgqHnn9zGsQxKnNUFeHawRXijtatPRsyq5eRNgE6s%3D&reserved=0>

From: Wactclc-alma <wactclc-alma-bounces at lists.ctc.edu<mailto:wactclc-alma-bounces at lists.ctc.edu>> On Behalf Of Thomas, Kirsti
Sent: Tuesday, January 11, 2022 5:56 PM
To: WACTCLC Alma Discussion <wactclc-alma at lists.ctc.edu<mailto:wactclc-alma at lists.ctc.edu>>
Subject: [Wactclc-alma] Fraudulent student accounts

Hey folks,

Our Student Services and eLearning staff recently identified just over 100 student accounts that seem to be fraudulent. The accounts seem to have been created for the purpose of obtaining money from Financial Aid.  All of the accounts identified are registered for classes this quarter.

Kevin Bowersox-Johnson, the eLearning director at Seattle Colleges, has contacted SBCTC and the State Auditor. He also sent an email out to the statewide eLearning Committee with details of how he was able to identify the fraudulent accounts.

Interestingly, one of the things Kevin discovered is that most of the address provided by these fraudulent accounts belong to properties up for sale.

I don't think there's much of a threat to the libraries from these accounts, but I'm going to be working with Kevin Bowersox-Johnson and our IT staff to flag/deactivate any of these accounts in Alma.

That's probably going to be a manual job for now, but we're going to work on figuring out how to update Alma user records when the accounts have been flagged as fraudulent in ctcLink. That may not happen until Spring Quarter or later.  I'll share details with Wade when I have them.

You all might want to contact your eLearning folks.

Kirsti S. Thomas
Library Technical Services Manager
Seattle Colleges
kirsti.thomas at seattlecolleges.edu<mailto:kirsti.thomas at seattlecolleges.edu>

CAUTION: This email originated outside of the Seattle Colleges' email system. Do not click links or open attachments unless you recognize the sender and know the content is safe. Questions? Contact IT Services at x6333 (Central), x3630 (North), x5844 (South) or email ITHelp at seattlecolleges.edu<mailto:ITHelp at seattlecolleges.edu>.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ctc.edu/pipermail/wactclc-alma_lists.ctc.edu/attachments/20220112/2dbe5db3/attachment-0002.html>