ATLANTA — An Atlanta resident said she was denied her FAFSA loan for college because her identity was stolen.
Mercer Murphy provided documentation to 11Alive showing her student loan application was denied because of her credit.
“They said it was denied because of a credit situation," Murphy said. "That's how I found out that three different accounts had been opened in my name, $60,000 of attempted counterfeit checks.”
The Georgia State grad is pursuing her masters degree in social work at Fordham University.
"I want to go into immigration policy and immigration advocacy," she said.
But being denied for FAFSA put a wrench in her plans. She appealed the decision, but ended up having to pay the $10,000 for her upcoming semester out of pocket.
“Until it is off my record, I can't do anything," she said. "If I didn't come up with that money, I couldn't register. I made an online fundraiser and was able to put the rest on my credit card.”
Murphy said she's always been diligent about protecting her personal information.
"No passwords are the same, I am somebody who has two-factor authentication on everything," she said. "I know how to check for phishing links, all that stuff. It can happen to anyone, no matter how careful you are about it.”
Murphy said she doesn't know how her information was leaked. Experts said it's possible she never will.
“We're having upwards of a billion records leaked a year," said Patrick Kelley, CEO of Critical Path Security. “We can pretty much ascertain that every person that has ever been on the internet or created an account on the internet likely has been rolled into a data breach.”
Kelley said tracking down the source of those breaches can be nearly impossible.
“Even though we have state laws that say that we should be disclosing, we haven't really tested those in courts and the companies know that," Kelley said.
"Fewer than four out of five actually report that they've had a breach. They will create some pretty interesting ways to make sure that they don't have to disclose, such as telling companies like us that we are not to give them a final report, we're to provide it to the attorneys because there is attorney client privilege.”
That could leave people like Murphy blindsided and scrambling for solutions.
“I want to know what the next steps are and I don't have anyone that's answered that, I don't know if anyone can," Murphy said. "If I don't get this situation situated by August, I just won't have my degree. I can't apply to be a licensed social worker.”
Once the 11Alive Investigators started asking questions on Murphy's behalf, she said Equifax removed the fraudulent accounts and FAFSA approved her credit appeal.
In a statement, an Equifax spokesperson told 11Alive:
"Equifax plays an important role in the financial lives of consumers and we take that responsibility very seriously.
When a consumer files a dispute regarding information on their Equifax credit report, we provide the results of the investigation within 30 days. Investigations are conducted in conjunction with the lenders or service providers that reported the information on the credit report to Equifax.
To protect against identity theft, we recommend consumers review their credit reports regularly. Consumers can access a free copy of their Equifax credit report with their free account at myEquifax.com. Additionally, consumers can request a copy of their credit reports from the Nationwide Credit Reporting Agencies (NCRAs) every week through the end of 2023 at www.annualcreditreport.com.
For victims of identity theft, we recommend keeping a security freeze or fraud alert on their credit reports. Fraud alerts can be placed on consumers credit reports for free with any of the NCRAs. Once you place an alert with one of the NCRAs, that NCRA will send your request to the other two."
Murphy has since since frozen her credit, something she now knows might’ve prevented the fraud if she’d done it sooner.
"I initially thought that I meant like freezing my credit cards or like debit cards and that I couldn't use it and that's not what I meant," she said. “Since it's [now] frozen, they cannot open any more accounts. But I'm still left wondering what other accounts are out there. It is such a violating feeling.”
Kelley said it's important to take stock of all the accounts and profiles you have.
“It's a good time to go through your passwords and go through your services and get rid of some of the things that you don't need," she said. "Don't give away information that you don't think the whole world needs to see.”
Federal law should protect applicants from being denied a FAFSA loan due to bad credit, but there may be some exceptions.
The Department of Education said Thursday they are investigating Murphy's case, and why she was denied.
If you'd like to see if your information may have been compromised, you can use websites like Have I Been Pwned.
Apple also has a feature in security settings that shows which of your passwords may have been compromised. In your iPhone settings click "passwords," and then "security recommendations."
Regardless, experts said consumers should assume their information is out there somewhere, and protect themselves accordingly by freezing their credit and being careful about what they share.
You can learn more about Murphy's story or donate to her online fundraiser here.