Applications are submitted through the OAAP (Online Admissions Application Portal). and Enrollment/Admissions staff manually review these applications.

A college may deem an application suspicious based on repetitive patterns identified by the college. These patterns continue to evolve and colleges should use professional judgment when relying on current patterns to move applications through the “Deemed Fraudulent" process.

Below is a list of potential flags that could indicate that the applications/accounts are fraudulent. Please understand that this is NOT an exhaustive list, as we are dealing with criminals committing fraud and potentially using stolen identities. Therefore, as soon as patterns are identified, they are likely to change. However, here are some items that have been seen in association with Fraudulent Applications:

• Multiple applications submitted at the same time.
• Multiple submissions from same IP address or IP addresses outside of typical countries the college receives applications from.
• Last four digits of credit card numbers with multiple payments on the same day or within a few days for different accounts.
• Atypical DOB for usual population of students.
• SSNs beginning with 1234.
• Multiple students with the same address or phone number.
• Missing phone numbers.
• Addresses outside the normal service area for the college.
• Addresses with missing apartment numbers.
• Addresses to houses/buildings/lots for sale.
• Outlook emails.
• Email with random digits in between characters.
• Emails with random digits/characters at the end.
• Recurring mailing address.
• Recurring email address used by other accounts deemed fraudulent.

If a college suspects an application/account may be fraudulent, the following steps must be taken:

1. College applies the SXI Service Indicator to the student's account as they investigate.
2. College contacts the student to schedule an in person or virtual meeting for the student to verify their identity. The SXI Service Indicator must remain on the account until the student's identity is verified.
3. The student submits a valid Government issued Photo ID to verify their identity in one of the follow ways:
   • Student appears in person with valid Government issued photo ID, OR
   • Student appears virtually with camera on and presents valid Government issued Photo ID and submits an electronic copy of the same ID post meeting.
4. College reviews the student's ID documentation to determine whether it is acceptable.
   Additional Recommendations from ARC: College performs additional verification of the ID through other means of verification, such as online DMV check and/or with local police force if available.
   • Deemed Authentic: If the ID documentation the student provides is determined as a valid Government ID and matches the student information reflected on the application, the college should proceed by submitting a ticket to ctcLink Support to report the student as verified.
   • Deemed Fraudulent: If the ID documentation the student provides is suspected of being fraudulent, is contradictory, or the student refuses to verify their identity in person or virtually with their camera on, the college should proceed by adding an SXF Service Indicator and follow the steps to report this student as fraudulent to SBCTC ctcLink Support and other applicable agencies.
5. If the college has not received a response from the student, the SXI Service Indicator remains on the student's account. Do NOT apply an SXF Service Indicator solely due to no response from the student.

If a college has deemed a student fraudulent because they have refused to verify their identity or submitted suspicious, contradictory, or fake information that rises to the definition of fraud, the college must take the following steps to flag the student as fraudulent and report them to ctcLink Support. Do NOT apply an SXF Service Indicator solely due to no response from the student.

The college may need to take additional steps to report the student as fraudulent to other internal and external stakeholders. See the MITIGATING ENROLLMENT FRAUD: INSTITUTIONAL PRACTICES & REPORTING OBLIGATIONS document for additional details.

1. College Local Security Administrator (LSA) locks the account on the Distributed User Profile (General tab):
   • If the account exists in HCM, locking it within this pillar will also lock it in other pillars.
   • If the account does not exist in HCM, lock the account in the CS pillar.
2. College applies SXF Service Indicator to student accounts they have deemed as fraudulent.
3. College submits a ctcLink Support ticket in Solar Winds that includes the EMPLID(s) involved and specifies the criteria you determined the application/student to be fraudulent.
   • Ticket request type: ctcLink Support > Campus Solutions > CS Fraudulent Accounts.
   • Tickets must specify the criteria by which the accounts were determined to be fraudulent. For each ticket, attach a spreadsheet with the EMPLIDs and names of up to 500 accounts that your college has determined to be fraudulent.
   • If SBCTC receives a fraudulent ticket for a student who already has an SVR “Student Verified” Service Indicator on their record, SBCTC ctcLink Support will connect the applicable colleges for additional research and review before SBCTC ctcLink Support makes any changes to the student.
4. The SBCTC CS Core ctcLink Support team will change the EMPLID(s) to begin with “XF” to further identify the EMPLID as fraudulent and will lock down the OAAP account.

If your college reviewed a suspended application and deemed it as fraudulent, perform the following steps:

1. College updates the Constituent Status to Canceled (See 9.2 OAAP Suspense Management).
2. College submits a ctcLink Support ticket in Solar Winds that includes the Application Number and specifies the criteria used to determine fraud (Ticket request type: ctcLink Support > Campus Solutions > CS Fraudulent Accounts). Since the application was canceled before an EMPLID was created, SBCTC will need the Temp ID Number to take action on this ticket.
3. SBCTC will lock down the OAAP account associated with the reported Application Number.

Colleges can run query QCS_SR_SHARED_RPT_FRAUD_STDNTS to return a list of their students who were processed as fraudulent accounts.

This query has an optional checkbox prompt to return students that have an SXF Service Indicator assigned by your college. Leaving this prompt unchecked will return a list of students who do not have an SXF Service Indicator assigned by your college. If the student does not have an SXF Service Indicator assigned by your college, it is an indication that you share this student with another college (or colleges) who reported the student as fraudulent to SBCTC.

The query returns high-level Yes/No information if the student has any enrollment activity, student financial activity, and/or has an ISIR at your college. Colleges will need to utilize other queries or search methods within ctcLink to find detailed information in these areas. The query will also return a list of shared institutions the student also has activity at but does not display details of that activity.

Please note this query does not identify students you need to report to SBCTC as fraudulent. The students being returned in this query have already been reported as fraudulent to SBCTC and have been processed as fraudulent (i.e., EMPLIDs have been updated, to begin with, XF, User Profiles are locked, and OAAP Accounts are locked.).

If you are unable to find and run this query, it is likely because you do not have one or more of the required security roles. College staff should consult their supervisors if they believe they should be able to run this query and are currently unable to do so.

For additional information on the query records and fields, please refer to metaLink.