← Back to blog Higher Education April 6, 2026 · 8 min read

New DoE Identity Verification Requirements for FAFSA: What Universities Need to Know

What are the new DoE identity verification requirements?

The Department of Education now requires first-time FAFSA applicants to verify their identity with a government-issued photo ID. Here's what changed, what NIST IAL2 means, and what your institution should be doing about it.

What Changed

Starting with the current FAFSA cycle, the Department of Education requires first-time federal student aid applicants to present a government-issued photo ID — either in person or via live video — as part of the identity verification process. This is a direct response to the ghost student fraud crisis that has cost the federal student aid system billions of dollars.

The requirement references NIST SP 800-63-3 Identity Assurance Level 2 (IAL2) as the technical standard for identity proofing. Federal Student Aid (FSA) has contracted with IAL2-certified providers to handle the centralized FAFSA identity verification.

But the federal requirement is only part of the picture. Regional accreditors, state systems, and institutional risk officers are independently raising the bar for enrollment identity verification — particularly for online and distance education programs.

What Is NIST IAL2?

NIST Special Publication 800-63-3 defines three Identity Assurance Levels for remote identity proofing. IAL2, the level referenced by the DoE, requires:

• Identity evidence collection: At least one government-issued photo ID (STRONG evidence) plus one additional piece of evidence (address verification, utility bill, or database check)
• Document authenticity validation: The submitted ID must be checked for tampering, expiration, and forgery
• Biometric verification: A live selfie must be compared against the photo on the ID document, with a false match rate of 1-in-500 (0.2%) or better
• Liveness detection: Presentation attack detection to prevent photos, video replays, masks, and deepfakes from bypassing the biometric check
• Address confirmation: A verification code sent to the applicant's phone or email to confirm they control the contact information associated with their identity

In practice, this means: the applicant photographs their government-issued ID, takes a live selfie, and confirms a code sent to their phone or email. The system verifies the document is real, the face matches, and the person is physically present.

What This Means for Your Institution

The centralized FAFSA identity verification handled by FSA's contracted provider covers the federal aid application process. But this does not cover your institution's own enrollment verification needs:

• Admissions identity verification: Confirming that an applicant is a real person before you allocate institutional resources (course seats, lab access, housing, advising time)
• Distance education compliance: Accreditors (HLC, SACSCOC, ACCJC) require institutions to describe how they verify student identity in online programs. "We rely on FAFSA" is not a sufficient answer for students who don't file FAFSA or for non-Title IV programs.
• Institutional aid protection: State grants, institutional scholarships, and fee waivers are disbursed based on enrollment — not FAFSA. Ghost students claiming these resources are not caught by federal verification.
• Ongoing verification: FAFSA verification happens once, at application. It does not verify that the person attending class in week 8 is the same person who enrolled in week 1.

The Gap Between Federal Verification and Institutional Need

The DoE requirement is a floor, not a ceiling. It addresses the narrowest slice of the problem: "Is the person filing this FAFSA who they claim to be?" It does not address:

• Cross-institutional fraud: A ghost student can pass FAFSA verification at School A and simultaneously enroll at Schools B, C, and D under different identities. The federal system cross-references SSNs via NSLDS, but with a multi-day lag that fraud rings exploit. And synthetic SSNs bypass the check entirely.
• Enrollment-level identity binding: Even after passing FAFSA, there is no requirement that the person who shows up to class (or logs into the LMS) is the same person who filed the application. This is the gap that ghost student operations exploit for institutional and state aid.
• Fraud pattern detection: FAFSA verification is per-application. It does not detect coordinated submissions from shared devices, email patterns, or phone numbers that indicate organized fraud rings.

What Should Institutions Do?

The institutions that are ahead of this curve are implementing identity verification at their own enrollment boundary — independent of, and complementary to, the federal FAFSA process. This means:

1. Add identity proofing to your admissions workflow. Government-issued ID verification with biometric face matching and liveness detection, integrated into your application portal or SIS. This can be IAL2-aligned, matching the federal standard.
2. Consider cross-institutional fraud detection. Single-institution verification catches fake IDs. Cross-institutional matching catches the same face enrolling at multiple schools under different names — the core ghost student pattern that costs the system billions.
3. Document your fraud prevention measures. Accreditors are asking. The DOE OIG is asking. Having a documented, auditable identity verification process is no longer optional for institutions with significant online enrollment.
4. Plan for the next enrollment cycle. Fraud rings target enrollment windows. Deploying verification mid-semester is disruptive. The time to evaluate and implement is now, before the next admissions surge.

How Verifa Helps

Verifa's Know Your Student (KYS) is an identity verification and fraud detection platform built specifically for higher education. It provides:

• IAL2-aligned identity proofing — government-issued ID verification, biometric face matching, liveness detection, OTP address confirmation, and proof of address. Configurable workflows enforce IAL2 requirements automatically.
• Cross-institutional fraud detection — the same face, document, device, email, or phone appearing at multiple consortium schools is detected in real time. No other tool does this.
• Ghost Student Score — an education-specific fraud score (0-100) that combines all signals and accounts for legitimate dual enrollment. Your financial aid staff gets a single actionable number, not raw data.
• Fraud ring detection — when one ghost student is confirmed as fraud, Verifa traces every connected session across institutions via shared signals, unraveling the entire ring.
• Privacy by design — schools never see each other's student data. All cross-institutional matching happens via mathematical face embeddings and cryptographic hashes, not shared PII.

The DoE requirement is a starting point. Verifa goes beyond it — catching the fraud patterns that federal verification alone cannot see.

Ghost students and the $180M question covers the fraud these rules are responding to, and how to detect and stop ghost student fraud is the operational playbook. For the identity concepts themselves, what is KYC? explains them as financial services applies them.