How did a fraudulent application get approved?

This is not a hypothetical admissions joke. This happened to the victim. One documented case, eleven documented failures.

Failures at intake

1. No identity cross-check.

   A real Social Security number paired with a fabricated address, phone, and email was accepted with no verification that the SSN's owner submitted it. This was not unusual for the era: the U.S. Department of Education reports that fewer than 1% of FAFSA filers were required to verify identity during this period (sources).

2. A college that closed in 2014 was accepted as 2018–2019 attendance history.

   The application listed attendance at Anthem College in Phoenix, Arizona in 2018–2019. Anthem College — a for-profit chain — shut down in 2014. A check against IPEDS or PEPS, databases every financial aid office uses, would have flagged this instantly.

3. A lookalike email became the identity anchor.

   The fraudster's contact email copied the victim's real name with a letter replaced by a zero — the same trick as turning jondoe@outlook.com into jond0e@outlook.com (shown here as an illustrative example). It was accepted as the authoritative contact, so every notice and warning that might have surfaced the fraud went to the fraudster.

4. The foster-youth claim was accepted at face value.

   Claiming foster-youth status strips parental income from FAFSA scrutiny and fast-tracks independent-student treatment. It is a known ghost-student technique, and it was not verified.

5. Name and history anomalies went unnoticed.

   The application carried a casing anomaly in the surname and a claimed 25-year Mankato residency with a 2013 Bagley High School graduation — a biography inconsistent with any record tied to the actual SSN holder.

Failures after the fraud

6. Zero victim notification.

   Neither the school, the state system, the Department of Education, nor the servicer notified the real SSN holder at origination. Discovery depended entirely on a delinquency reaching a credit bureau fifteen months later — and only because the victim independently maintained credit monitoring.

7. First contact: no record under the victim's name.

   When the victim called, the institution could not find a student record under the victim's name, because the record existed under the victim's SSN with altered identifying data. The system indexes people in exactly the way this fraud defeats.

8. The verification paradox.

   The institution's initial victim process asked the victim to establish their identity through email and forms — the exact channel the fraudster had used to impersonate them. Credit where due: after pushback, Normandale agreed to live video verification with government ID review.

9. Counsel abruptly ended the victim's call.

   On May 12, 2026, Minnesota State Assistant General Counsel Daniel G. McCabe took the victim's call and abruptly ended it. This is documented contemporaneously in writing from the same day — his own produced email: "I did abruptly end my brief conversation with [the victim]. I informed him that the College was working on the issue, and he responded with hostility." (Bracketed text marks a redaction of the victim's name; the original names the victim.)

10. The metadata stonewall.

    Minnesota State withheld the timestamps, IP addresses, and audit logs of the fraudulent application from the victim, classifying them as "security information" under Minn. Stat. § 13.37. Its own produced internal email states: "We don't have to consider the threat actor the data subject." The state's position amounts to this: the data about how your identity was stolen is secret from you. That classification is now under challenge via a § 13.072 advisory opinion request.

    The classification arrived after the fact. Earlier in remediation, the institution had itself sent the victim an originating IP address in correspondence — the same category of data it later declared too sensitive to disclose. No policy is cited on the site claiming that disclosure was improper; the point is narrower and documented: the data was disclosable when the institution chose to disclose it, and "security information" once the victim formally asked.

11. No root-cause analysis.

    As of publication, Normandale and Minnesota State have offered no root-cause analysis, no remediation commitments, and no statement of what has changed at intake.

The contrast: the loan servicer fixed its part quickly

Aidvantage (Maximus) — the private servicer, the party with the fewest public-transparency obligations — accepted the identity-theft claim on the FTC and police reports and removed the fraudulent tradeline with comparatively little friction. The public institution responsible for the intake failure ended the victim's call, withheld the records of how the fraud was committed, and offered no root-cause analysis. In my view, it says something that the actor with the least accountability was the easiest to work with.

Minnesota context

Minnesota institutions appear by name in national ghost-student reporting. At Century College — also in the Minnesota State system — instructors found roughly 15% of one course's enrollees were fraudulent (source). The fraud in this case entered through Minnesota State's system-wide Universal Application, meaning the intake weakness was not one campus's error but shared infrastructure across dozens of colleges.

Next: how big this is nationally, and what to do if it happens to you.

The failures, quotes, and dates on this page match its structured data — what you read is what machines read. Documented facts are sourced in the timeline's documents section; satire is labeled where it starts. This site documents one victim's experience and is not legal advice.