{
"slug": "consequence-tiered-student-record",
"topic_id": "TOPIC-168",
"cluster": "Higher Education, Research & Credential Identity",
"tier": "Tier A",
"title": "The refund destination field: higher education's cheapest theft",
"summary": "Changing where thousands of dollars of aid is deposited requires the same authentication as changing a mailing address. The student may not discover the diversion until the term is over, and the debt remains theirs.",
"lede": "Somewhere in your student information system is a field that redirects a five-figure disbursement. It sits in the same profile screen as the preferred-name setting, governed by the same permission, protected by the same password.",
"date": "2025-10-22",
"category": "Vertical",
"author_id": "solene-beaumont-adjei",
"tags": [
"student refund",
"direct deposit fraud",
"student portal",
"bursar",
"account takeover",
"SIS"
],
"image_title": "Consequence Tiered Student Record",
"schema": "Article",
"key_takeaways": [
"Student information systems model banking details as profile attributes because self-service was introduced to reduce bursar workload. No consequence tiering was applied.",
"The student bears the debt even when the disbursement was stolen, which makes this unusually harsh compared with consumer payment fraud.",
"Tier the fields by dollar value at risk; in most systems fewer than five fields carry nearly all of it."
],
"body": [
{
"type": "h2",
"text": "A Tuesday in the bursar's office"
},
{
"type": "diagram",
"kind": "compare",
"alt": "One record, two very different consequence classes",
"caption": "Most SIS designs apply one authorisation model to both columns.",
"nodes": [],
"left": {
"title": "Ordinary profile",
"items": [
"Preferred name",
"Mailing address",
"Emergency contact",
"Communication preferences"
]
},
"right": {
"title": "Payment-consequential",
"items": [
"Refund bank account",
"Direct deposit details",
"Third-party payer authorisation",
"Tax withholding elections"
]
}
},
{
"type": "p",
"html": "The student came in during the second week of the spring term because her rent payment had bounced. Her aid had disbursed on schedule. The refund had gone out on schedule. To an account she had never seen."
},
{
"type": "p",
"html": "Her portal password had been in a credential-stuffing list since a breach at an unrelated service two years earlier. Someone logged in, changed one field, and waited. The portal sent a change notification to her student email address, which she checked roughly weekly, and which by then was also compromised."
},
{
"type": "p",
"html": "The institution's position was that the change was made from her account. Her position was that she did not make it. Both were true. She still owed the loan."
},
{
"type": "h2",
"text": "Why the field ended up in the profile screen"
},
{
"type": "p",
"html": "Self-service refund enrolment was a genuine improvement. Before it, students queued at the bursar's office with a voided cheque, and staff keyed the details. Moving it online reduced queues, errors and staffing cost."
},
{
"type": "p",
"html": "The modelling decision followed the interface. Banking details went where other student-supplied details go: the profile. Nothing in that decision considered that one of these fields moves money and the others do not."
},
{
"type": "h2",
"text": "Tiering the student record"
},
{
"type": "p",
"html": "Run this against your own SIS. List every field a student can change, and rank by the dollar value a wrongful change can move or destroy."
},
{
"type": "table",
"head": [
"Tier",
"Value at risk",
"Fields",
"Authorisation warranted"
],
"rows": [
[
"T1",
"Full disbursement value",
"Refund destination, direct deposit details",
"Student-held credential, full detail rendered, notification with delay"
],
[
"T2",
"Moderate financial or academic",
"Enrolment changes affecting aid, withdrawal, payment plan setup",
"Student-held credential"
],
[
"T3",
"Privacy",
"Directory information disclosure, FERPA release settings",
"Session, with notification"
],
[
"T4",
"None",
"Preferred name, notification preferences, theme",
"Session"
]
]
},
{
"type": "p",
"html": "The exercise usually produces one or two T1 fields, which is precisely why it is affordable. Nobody is proposing a credential gesture for changing a preferred pronoun."
},
{
"type": "h2",
"text": "The notification problem"
},
{
"type": "p",
"html": "Institutions rely on change notification as a compensating control, and it is better than nothing. Its weakness in this specific fraud is that the notification channel — the student email address — is frequently compromised in the same credential-stuffing event."
},
{
"type": "p",
"html": "If notification is part of the design, send it to every enrolled authenticator and to a channel the student controls independently, and build in a delay so a notification that arrives has time to be acted on."
},
{
"type": "h2",
"text": "What this costs an institution with thin IT staffing"
},
{
"type": "p",
"html": "Be realistic. A regional public institution with four people in IT is not deploying an identity platform. The work that matters:"
},
{
"type": "ol",
"items": [
"Identify the T1 fields. An afternoon.",
"Add a credential requirement at that one change point. A scoped integration, not a platform.",
"Enrol students at an existing touchpoint — orientation, first aid counselling, first portal login of the term.",
"Fund the assisted path in the bursar's office, which already exists physically.",
"Measure diversion reports and re-issuance before and after."
]
},
{
"type": "h2",
"text": "Why institutions make students whole anyway"
},
{
"type": "p",
"html": "Many do, and the reason is not generosity. A student whose aid was stolen cannot pay tuition, will likely withdraw, and the institution loses the enrolment, the retention metric and the goodwill — while the federal debt follows the student regardless."
},
{
"type": "p",
"html": "That means the loss is frequently absorbed by the institution in practice even where policy says otherwise. Which makes prevention a straightforward cost comparison rather than a moral argument."
},
{
"type": "h2",
"text": "A consequence tier model for a student record"
},
{
"type": "table",
"caption": "Four tiers and their gates",
"head": [
"Tier",
"Fields",
"Gate"
],
"rows": [
[
"Cosmetic",
"Preferred name, communication preferences",
"Session"
],
[
"Contact",
"Address, phone, emergency contact",
"Session plus notification"
],
[
"Access",
"Credential enrolment and recovery",
"Bound assertion"
],
[
"Payment",
"Refund destination, deposit details",
"Bound assertion plus a hold"
]
]
},
{
"type": "h2",
"text": "Objections and honest limits"
},
{
"type": "p",
"html": "“Students will not tolerate friction.” They will tolerate it once, on the field that pays them, and they already tolerate more friction than this to reset a password."
},
{
"type": "p",
"html": "“Our SIS does not support per-field authorisation.” Most do not natively. The gate can sit in front of the endpoint rather than inside the product, which is a smaller change than a vendor request."
}
],
"faq": [
{
"q": "Is the student really liable for a stolen disbursement?",
"a": "The federal loan obligation attaches to the borrower. Institutional practice on making students whole varies, and many institutions do so for enrolment and retention reasons even where not required."
},
{
"q": "Would MFA on the portal solve this?",
"a": "It helps considerably and is worth deploying. It does not address a session compromised after login, and it applies the same strength to every field rather than to the one that moves money."
},
{
"q": "What about students who change banks mid-term?",
"a": "That is the normal case the control must handle smoothly — a credential gesture and a notification delay, not a trip to the bursar."
},
{
"q": "How do we enrol students who never come to campus?",
"a": "Remote enrolment at first portal login, with an assisted telephone path. Fully online programmes need this designed deliberately rather than inherited from the on-campus flow."
},
{
"q": "Why tier by consequence rather than record type?",
"a": "Because a single record contains fields whose misuse ranges from cosmetic to a direct payment redirect."
},
{
"q": "How many fields are payment-consequential?",
"a": "Usually three or four — refund destination, deposit details, third-party payer authorisation and withholding elections."
},
{
"q": "What if the SIS cannot gate per field?",
"a": "Put the gate in front of the endpoint. It is a smaller change than a vendor feature request."
}
],
"sources": [
{
"t": "FinCEN advisories and alerts",
"u": "https://www.fincen.gov/resources/advisoriesbulletinsfact-sheets"
},
{
"t": "34 CFR Part 668 — Student Assistance General Provisions",
"u": "https://www.ecfr.gov/current/title-34/subtitle-B/chapter-VI/part-668"
},
{
"t": "Federal Student Aid — program integrity resources",
"u": "https://fsapartners.ed.gov/knowledge-center"
}
],
"related": [
{
"slug": "aid-lifecycle-control-map",
"title": "Ghost students",
"category": "Vertical"
},
{
"slug": "accessible-payment-authorization",
"title": "Benefit payment redirection",
"category": "Compliance"
},
{
"slug": "payout-field-control",
"title": "Marketplace seller payout redirection",
"category": "Vertical"
}
],
"image": "https://cdn.twc.sh/images/igcache/Consequence%20Tiered%20Student%20Record/1500_900/blog.jpg",
"wordcount": 895,
"url": "/blog/consequence-tiered-student-record.html",
"reading_time": "4 min read",
"seo_title": "The refund destination field in higher education",
"meta_description": "Changing where thousands of dollars of aid is deposited requires the same authentication as changing a mailing address.",
"hub": {
"slug": "topics/credential-identity",
"title": "Education and credential identity"
},
"answer": "The refund destination. A student information system treats address, phone and bank details as one class of profile data, but only one of them causes money to move. Tiering by consequence rather than by record type is the cheapest change available.",
"answer_q": "Which student record field is worth the most to an attacker?",
"glossary": [
{
"term": "Consequence tiering",
"def": "Assigning authorisation strength by what a change causes rather than by which record it belongs to."
},
{
"term": "Student information system",
"def": "The system of record for enrolment, academic and financial data."
},
{
"term": "Out-of-band notification",
"def": "A message through a channel the changing session cannot reach."
}
],
"checklist": {
"title": "Tiering an existing student record",
"id": "tier",
"desc": "Four steps.",
"steps": [
{
"name": "List fields by what changing them causes.",
"text": "Not by which screen they live on."
},
{
"name": "Find the payment-consequential set.",
"text": "Usually three or four fields."
},
{
"name": "Put a bound assertion in front of those endpoints.",
"text": "In front of the SIS if it cannot do it natively."
},
{
"name": "Notify out of band and hold the first payment.",
"text": "Two cheap additions that close the timeline."
}
]
},
"cta": {
"title": "Where this fits in Manav",
"html": "Manav binds the authorising person to the exact record or disbursement being authorised, and produces a receipt an auditor, a regulator or a receiving institution can verify without contacting the issuer.",
"href": "../docs.html",
"label": "See issuance receipts"
}
}