As students settle into the academic year, colleges and universities are managing a growing identity challenge that extends far beyond enrollment. Students access financial aid, online courses, and other campus services throughout the year, creating repeated moments when institutions need confidence that the person behind a digital account is who they claim to be.
The problem has become serious enough to draw attention beyond campus IT departments. In March, Gartner warned that colleges and universities were facing record levels of fraudulent student applications, exposing weaknesses in how institutions establish identity. And in April, the U.S. Department of Education introduced real-time, risk-based identity screening for every FAFSA applicant. A subsequent review flagged approximately 300,000 previously submitted 2026-27 FAFSA applications for additional verification based on suspected fraud indicators.
AI makes it easier than ever for fraudsters to create convincing fake documents, synthetic identities, and manipulated images at scale. But colleges can’t solve that problem by asking every legitimate student to provide more personal information.
The challenge for higher education is to get better at establishing trust while becoming more selective about the data it asks students to share.
More identity checks should not mean more student data
Consider how many times a student may be asked for personal data during their college experience. It can begin during enrollment and financial aid applications, then continue when they create digital accounts, access online courses or take remotely proctored exams. Each interaction requires the student to prove some combination of who they are and whether they are eligible to access a particular service.
Too often, establishing identity means handing over the same sensitive information repeatedly. But there is an important distinction between needing to know something about a student and needing to collect all of the information associated with their identity. An institution may not need a student’s exact date of birth, home address, or every other piece of information printed on a driver’s license to make a particular decision.
Data minimization protects more than the student experience. Every additional piece of personal information an institution or third party collects becomes information that must be stored, managed and secured. Reducing unnecessary collection can reduce the burden on colleges and limit the amount of sensitive information exposed if an institution or one of its systems is compromised.
Instead of “How much information can we collect to prove this person is legitimate?” colleges should ask a different question: “What do we actually need to know for this interaction?”
Identity verification is only one moment
Organizations historically approached digital identity as a checkpoint. A person presents an ID, takes a selfie or provides another credential, and the system determines whether that information appears legitimate. These checks are important, but they only provide a snapshot of an identity at a particular moment. A legitimate identity can later be compromised, a fraudster can change devices, or an account can begin behaving differently weeks or months after it was created. Sophisticated fraud attempts may also combine legitimate information with fabricated details to make an identity appear convincing.
That’s why schools must also consider the context around an interaction, including whether document, device, biometric, and behavioral signals are consistent with what they would expect from a legitimate student.
This broader approach to identity intelligence helps campuses scrutinize where there are signs of risk, rather than adding more steps for every student. The point is not to collect more information. It’s to make better use of the signals already available so schools can understand the risk surrounding an identity without asking students to share more personal data than necessary.
Students should not have to prove the same thing over and over
There’s another part of the identity problem that higher education needs to address: Students repeatedly establish facts about themselves that have already been established elsewhere. This creates user friction and frustration as data is continuously shared to verify a student’s identity.
A reusable digital identity offers another approach. Instead of starting from zero every time a student encounters a new service, certain trusted identity attributes can be established and then reused only when they are needed. The student can prove the relevant fact without sharing all of the underlying information again.
The same principle can apply more broadly. A service should receive the information necessary to make its decision, rather than automatically receiving every piece of information available about the person.
For students, that can mean fewer repetitive identity checks and less unnecessary sharing of personal information. For institutions, it can mean reducing the amount of sensitive data moving through systems while still maintaining confidence in the people accessing them.
But reusable identity cannot mean verifying someone once and trusting that identity forever. Reusable identity has to be integrated with identity intelligence, which reassesses the risk signals and trust factors in an ongoing manner. This way, significant changes can either trigger additional checks or streamline the process, ensuring the consistency of the level of assurance.
Match the check to the risk
Not every campus interaction carries the same consequences, and institutions shouldn’t treat them as if they do. A routine, low-risk interaction shouldn’t necessarily require a student to pull out a government-issued ID. A suspicious attempt to access financial aid or make a sensitive account change may warrant a much higher level of assurance.
The Department of Education’s new FAFSA process offers a timely example of that distinction. Its 2026 system evaluates applicants using risk-based identity screening, allowing lower-risk applicants to proceed without providing additional identity information while requiring higher-risk applicants to complete additional identity confirmation.
That same principle should guide identity decisions across the student experience: Match the amount of information and level of assurance required to the actual risk of the interaction.
Collect less, understand more
The pressure on colleges is unlikely to ease. And as generative AI and other tools make convincing identities easier to manufacture, colleges will need better ways to distinguish legitimate students from fraudsters. Colleges must examine where they ask students to repeatedly prove the same information, which services truly need access to sensitive identity data and where a verified attribute would be enough.
Alix Melchy is VP of AI at Jumio.
- How higher ed can fight fraud without collecting more student data - October 12, 2026
- 5 leadership priorities to become AI-ready - October 9, 2026
- Learner agency comes first in AI-driven digital literacy - October 7, 2026