Modernizing Identity in Higher Education

A real-world look at fraud risks and identity verification challenges in colleges and universities Higher education institutions may not be doing enough to protect digital identities as they move more academic and administrative services online.

This issue came to the forefront in a national survey conducted by the Center for Digital Education (CDE) on digital identity practices in higher education. The research collected responses from 74 higher education officials in September 2024.

We asked leaders how they apply digital identity verification, which technologies and techniques they use, and where they encounter the biggest challenges. An analysis of our findings underscores the reality that many colleges and universities are ill-equipped to confront modern identity threats.

The State of Identity on Campus

Our research and analysis points toward one central takeaway: Higher education leaders should do more to fight identity fraud.

Institutions often struggle to balance online user experience, academic freedom, and fraud protection, says Lydia Payne-Johnson, a CDE senior fellow and director of data governance, compliance, and identity management at George Washington University in Washington, D.C. In a competitive higher education environment, user experience may get more attention than fraud mitigation.

Yet, higher education is a target-rich environment for fraudsters. Universities issue email accounts to alumni that may go unused for years. Scammers exploit these accounts to build synthetic identities. Parents and students often use outdated and potentially vulnerable verification techniques to access campus systems and make payments. These issues heighten the need for modern identity protection and fraud-fighting tools.

“Higher ed needs to do quite a bit of work to catch up,” says Payne-Johnson, who formerly worked in the financial sector, where advanced identity authentication and anti-fraud tools are commonplace.

Processes and services where institutions are most likely to apply digital identity verification

Respondents selected all options that apply.

• Only about half of CDE survey respondents said their institutions use digital identity verification for crucial processes like registration, enrollment, and admissions, and financial transactions.
• The percentages are even lower for core functions such as learning management systems, online exams, and student health systems.

In addition, institutions often use labor-intensive monitoring and manual document reviews to spot fraudulent enrollment activities. These methods are insufficient in a rapidly evolving threat environment, according to CDE Director Brian Cohen.

Unused alumni email accounts and weak identity practices are fueling growth of a new threat known as "ghost students," which are synthetic identities created to bilk institutions out of student loan and government grant funds.

“Fraudsters will use college EDU accounts to perpetuate additional schemes because EDU domains are seen as trustworthy,” says Jordan Burris, public sector general manager with Socure, a leading provider of identity solutions.

More than half of survey respondents (53%) said they use more than one identity verification method, and more than a fifth (21%) said they use three or more methods, reflecting the complexities of identity verification. In addition, campuses may rely on legacy identity methods that are ineffective or difficult to use.

On the other hand, risk-based verification — one of the most promising defenses against advanced tactics like ghost students — was used by just 12% of survey respondents.

Most common tactics for detecting identity-related security threats during student enrollment

Respondents selected all options that apply.

Most common digital identity verification methods in higher education

Respondents selected all options that apply.

Risk-based applications examine the context of a user attempting to be authenticated. AI algorithms calculate a risk score by comparing real-time, contextual data to a massive database of known fraud behaviors. This process dramatically improves verification outcomes.

Greater use of automation and risk-based verification methods helps institutions strengthen data protection, reduce pressure on internal staff, and improve online user experience — all of which ranked as top identity challenges for higher education leaders.

Modern identity verification solutions are also more inclusive than traditional methods, an important consideration for higher education institutions.

Top student identity challenges for institutions

Respondents selected up to five answers.

Identity Theft on Campus

College campuses are fertile ground for identity thieves. Jim Jorstad, a CDE senior fellow and former CIO at the University of Wisconsin-La Crosse, has seen his share of identity vulnerabilities.

From first-year undergrads to retirees, members of campus communities often use passwords that are easy to guess. They also share passwords and logins. And they’re vulnerable to social engineering scams.

Not all fraud is digital, however. Criminals will sneak into dorm buildings, walk into unlocked rooms, and grab documents containing personal information. They’ll even dig through trash for vital data.

How can campuses fight identity fraud? “It all comes down to training,” Jorstad says. Everyone needs consistent, continuous guidance on:

• Keeping documents with vital data out of sight
• Protecting online accounts with strong passwords and never sharing ID credentials
• Shredding sensitive documents
• Avoiding links from unknown sources
• Understanding how fraudsters exploit trust

The Case for Modernizing Digital Identity

GW’s Payne-Johnson says higher education officials are awakening to identity threats.

Here are the biggest benefits of modernizing your institution’s digital identification technologies and processes.

Reduced staff workload and improved efficiency

Higher education IT teams don’t have enough bandwidth or experience to stop determined, pervasive fraudsters. Modern identity platforms use AI to assess identity fraud risk in real time, allowing most transactions to be conducted safely and effectively with less load on university staff.

Better user experience

Fast, accurate, and friction-free identity verification is a differentiator in an environment where institutions often compete for students and faculty talent.

Evaluating Solution Capabilities

Modern identity verification and anti-fraud solutions provide a great user experience while validating identity documents, detecting fraudulent behavior, and assessing risk.

Look for these features and tools when modernizing identity and anti-fraud systems:

• AI and other advanced automations that analyze every user in real time, assess the validity of their data and devices, and apply a fraud-risk score.
• Multifactor authentication and single sign-on.
• Biometrics and liveness confirmation.

Stronger security

Modern identity solutions combine liveness checks with risk-based identity verification to protect against fraud and deepfakes. This layered approach provides the most robust defense against identity fraud.

Reputation protection

When data breaches or identity thefts appear in the news media, the people who hold the purse strings take notice. Lack of modern security and identity tools can also make it difficult for institutions to get cybersecurity insurance.

Identity Modernization Best Practices

These tips will help institutions modernize identity practices and avoid common pitfalls.

1. Create an identity strategy. A strong plan keeps modernization on track.
2. Focus on UX. Prioritize the user experience from beginning to end.
3. Start with pilots. Take an incremental, data-driven approach that monitors performance and documents effectiveness.
4. Focus on the future. Continuously invest in staff training, security testing, and adapting to new risks and opportunities.

Campus Communities Need More Protection

Our research suggests many colleges and universities aren’t doing enough to fight fraud and protect identities. To fight fraud and protect data, colleges and universities need to adopt identity best practices and learn from other industries that have more experience and resources.