orware

Quick question…did your account have a history and past positive reviews from any purchases you had made in the past?

I have a long-standing account and rarely buy on eBay nowadays (I’m trying to recall if I’ve ever sold anything…if I have it was maybe only one item but I don’t even recall if it sold or not).

Recently, I was looking into buying a used gaming PC via eBay to save a few bucks and I ended up completing a “Buy it now” purchase quickly without looking more into the seller (or their location). The location wasn’t a big deal (Paris, France) but that mainly meant the shipping would take longer. What ended up being more concerning was the 0 rating for the seller, which immediately make think “oh crap”. I reached out to the seller just to see if I could get a response with no quick reply, but I sent one short follow up the next day when I didn’t receive a response and shared my concern and waited another day before reaching out to eBay about the concern I had about the seller (especially because by this point the original listing was gone and then it even seemed like the seller’s account too). I used the live chat option and the person there was very helpful and got the process started and mentioned to reach back on Friday (about 3 days later), but later that same day my refund was issued and the case closed which I was grateful for.

But it did make me wonder of what might be an apparent difficulty for newer accounts to sell successfully on the platform? (Kind of like stories I’ve heard about liquor licenses being grandfathered in for certain locations in cities, whereas it may be more work for a new location to apply for one…maybe newer sellers can easily be flagged? The inability to dispute the situation when you are obviously willing/able to communicate with the eBay staff however is the sad part in your story since legitimate individuals should always have recourse to be heard in these large tech platforms).

Another note…based on what I know, most colleges are suffering from low enrollment too, and even though funding isn’t solely based on the the student count on census date anymore (which is usually about 1-2 weeks into a semester…and faculty is supposed to drop students that don’t come on the first day of class typically)…since now the formula is more complex with “success” related factors added (numbers of degrees / certificates awarded plus some other ones I don’t directly recall right now.

This leads to number of students still being a pretty big factor in the funding received for the year. From Administrators I would say if any are worth their salt, ignoring any sort of fraud would be a no-no so I’m hoping that’s not a common situation being observed. On the other hand, losing a substantial percentage of your current budget due to a loss of students can be pretty tragic for the staff working on the campus. Budget reserves can usually be dipped into for a period of time, but what most folks don’t know or realize is that compared to private businesses where the cost of employees may be only a fraction of what the business brings in profit, most CCCs are likely spending 80-90% of their budgets on salaries and benefits for their staff (in some cases the % may be more, in some cases it may be less). This makes it extremely difficult most of the time to weather a big loss in students because if budget reserves get expended, and student numbers don’t improve, that’ll mean some sort of layoff process…which also provides those employees with reinstatement rights too for a considerable period of time afterward).

It’s interesting to see this thread crop up here, as I’ve only recently left CCC system for a job in tech after being in IT within the system for about 14 years.

This particular issue over the last year or so has gotten worse, with more eyeballs on it, once actual money became involved (before it was still an issue but on a smaller scale mostly for the free edu emails we tend to issue, along with other freebies that can help enable, such as free credits for Azure or other services).

Even in the previous cases, I was annoyed/upset because in my mind the first line of defense the colleges have is preventing these fake users from being able to submit an application successfully in the first place, since the OpenCCCApply application (which I believe is used by all ~115 CCCs) was allowing the submissions in the first place…and since we mostly bring that application data into the individual colleges, not many triggered a “hold” on our end.

Yes, CCCTechCenter (which helps manage the team which maintains the OpenCCCApply system) have done a few things over this past year that are mentioned in the article already (but based on the article I can’t tell 100% if it is really indicating the issue is still rampant in the more recent semesters…one of the changes was adding usage of an IP reputation checker in for example, but there are likely ways around that too for these folks who actually don’t seem to actually use bots…maybe they use actual people instead based on what I’ve seen, such as the YouTube video shared in the article).

What I found really annoying by it all is that while the problem originated from the systems being provided to the colleges from the state level (OpenCCCApply mainly), the individual colleges are now on the hook to gather a bunch of mostly useless data, and go on silly adventures such as investigating IP address info within our other systems (like Canvas) to help find or report the fraudulent activity.

I think I saw FAFSA mentioned a few times but I don’t think there is a ton of fraud coming from the FAFSA application too directly…but in this past year many of the colleges have been putting COVID relief funds they’ve received (to help get students/staff back on campus) and using those to pay for fees or provide an extra amount for books, etc. which isn’t something that will continue forever (in fact, I think for this summer this will already have ended, or it will be the last semester where it will be offered).

In most cases, once the incentive is taken away, or the bar to get it is made higher, these folks creating the fraudulent accounts will generally move on (or target schools that don’t implement some of the 2nd layer fixes at the college level…unfortunately while the CCCTechCenter tries its best, it doesn’t typically fully acknowledge its role in creating some of these situations, and I almost lol’ed when I saw towards the end of the article I saw they are looking to get more funding to “modernize” it, yet again, considering a lot of effort / time / money already has gone into creating the current OpenCCCApply system not that long ago from the previous system, which was pretty bad in comparison).

Overall though this particular situation is at the same both more complex and simpler than folks may think, once you have some more details (more complex because there is a lot about what’s going on in the CCCs the HN community isn’t aware of, along with super strict regulations that have to be followed within the individual Financial Aid departments at each school, otherwise they win not be able to provide federal aid monies to students if they weren’t doing so, making that avenue for fraud a lot more less likely than the scenario I shared above on how the COVID relief monies have been being used instead to provide an incentive to get students back in the classroom…along with the solution being simpler since we already have a central application process that should be the system that keeps these applications from ever reaching the individual colleges, but it fails in that regard…that along with removing the financial incentive currently present, should reduce the fraud levels considerably…although there are likely a few more complexities even I am unaware of…I would just appreciate it if the search for fraud wouldn’t get pushed onto the individual colleges in these situations where a system wide protection should have prevented the situations in the first place, mainly because it causes a ton on unneeded busy work at the colleges keeping IT System Analysts and other technical folks from focusing on other, probably more important, internal projects).

Excuse any typos…I wrote this small novel on my phone.

Check out my comment above here in this same thread which basically confirms exactly what you just shared here...this is the same tactic I was observing being used with fake student accounts sharing with outside external Gmail addresses which then appeared to take over the Shared Drives being created in GSuite, allowing for TBs and TBs to be added in to the drives by outside users. It seems like a big problem to me...but at the moment I don't think Google is providing good enough tools for Admins to see/eliminate these situations very quickly/easily.

Just coming out of a higher education position I held for about 10 years...we were really only using GSuite for Education on the periphery of everything else we were doing (which was all Microsoft-based). So we were really only setting up the needed GSuite integrations to give some access for students/faculty/staff to use the GSuite apps if they wished, so the "unlimited" storage side of things was an extra bonus.

While our actual students/staff have not abused the unlimited-ness at all, there's been a big trend in recent years for fake spam/bot type accounts to submit online applications (particularly for the inexpensive community college level here in California) which would allow for those fake people to get issued accounts within the college systems (typically giving them a student email account).

In essence though, one bad account could in turn create multiple shared drives it seems, and then from there grant access to other external Gmail accounts and swap the ownership to them, while still leaving the unlimited storage capabilities in place (at least that's been my perception of what I had seen in our instance). Before I left recently, I had seen pages upon pages of shared drives in our GSuite Admin area of Shared Drives that were terabytes large (one as high as 100 TB or some ridiculously high number like that)...with very little mitigation options being provided by Google to help avoid that from occurring in the first place (aside from taking the extreme measure of locking things down after the fact...but cleaning up that existing mess seemed to not have a solution...supposedly there were going to be some new tools released early this year to help out, but not sure if those are available yet).

Suffice to say...some bad apples are making it hard for all of the good people to take advantage of what was otherwise a wonderful offering for educational institutions (having administered many systems over the years...it's always nicer to not have to worry about license limits and other baloney like that since it simplifies things for what is usually an already overloaded IT staff).

I could clearly see all of the bad accounts abusing our instance...if only there was an easy way to filter all accounts > 2 TB and then delete them I could have reduced our storage usage down considerably for Google.

That multiplied by hundreds of institutions where this may have occurred during the pandemic and I can see how storage usage could have went up dramatically on Google's end...but I think that Admins in those institutions would be more than happy to clean things up if they had the tools/ability to do so.