Key Points
- A breach at BankMobile, the banking platform about 60 California community college districts use, affected roughly 65,000 student accounts.
- About 400 accounts had financial aid stolen, and some students have now waited more than a month for their refunds.
- The College Investor doesn’t believe any college should require students to use one payment processor or bank to receive their financial aid refunds and colleges should plan for better ACH processing of refunds.
A security breach at BankMobile has delayed financial aid refunds for thousands of California community college students. BankMobile told state community college officials that about 65,000 student accounts were affected by unauthorized data changes, EdSource reported. Roughly 1,000 accounts were accessed. Allegedly about 400 had their financial aid refunds stolen outright.
About 60 community college districts use BankMobile to pay out scholarships, school financial aid and federal financial aid refunds such as leftover Pell Grant funds.
State officials said a change BankMobile made to its account verification process in July created the vulnerability. Attackers used it to hijack student accounts and modify account information. In October, the California Community Colleges Chancellor’s Office told districts to halt electronic payments through BankMobile.
Would you like to save this?
We'll email this article to you, so you can come back to it later!
Why It Matters
A financial aid refund is the leftover financial aid a student receives after a college applies it to tuition and fees. For many students, this money is essential to pay for non-direct costs such as rent, gas, food and books.
EdSource reported that students were rationing gas, skipping meals and going without textbooks while they wait.
A 2023 state survey found more than two in three California community college students struggled to meet at least one basic need. Nearly half, 47%, faced food insecurity.
For the roughly 400 students whose funds were taken, EdSource reported the money may never be recovered.
How Did California Colleges Respond To The BankMobile Breach?
Districts across California’s community college system have handled the breach differently. Riverside Community College District paid about 3,400 direct deposit students by paper check starting Oct. 8, according to district controller John Geraghty. Riverside went back to direct deposit after BankMobile described stronger security protocols.
Los Rios Community College District went further, announcing it will move student disbursements and refunds from BankMobile to Nelnet.
| College Or District | What Changed | Status In Late October |
|---|---|---|
| Los Rios Community College District | Issued paper checks and told students to file claims with BankMobile | Leaving BankMobile For Nelnet |
| Riverside Community College District | Paid about 3,400 direct deposit students by paper check starting Oct. 8 | Direct Deposit Resumed |
| Butte College | Paid its Oct. 8 disbursements by paper check | Paper Checks |
| Long Beach City College | Handed out paper checks in person and by mail | Paper Checks |
| Los Angeles Pierce College | Paused disbursements, citing “unforeseen technical difficulties” | Students Still Waiting |
Communication has been uneven too. Butte College officials said they didn’t know whether any compromised accounts belonged to their students, but they switched to paper checks anyway.
Why Do So Many Colleges Use BankMobile?
Paying out refunds is compliance-heavy work that most colleges would rather not run themselves. Under BankMobile’s model, the college sends a student file and wires one lump sum. BankMobile then pays each student based on their refund choice, according to its refund management compliance handbook (PDF File). That takes check printing, returned payments and student calls off the financial aid office’s plate.
The service can stay cheap for colleges because students pay for it in other ways. BankMobile’s former parent bank, Customers Bancorp, said in its 2018 annual report that the business earned money largely from debit card interchange, deposit fees and university fees. It also warned that losing the small-bank exemption from federal debit fee caps could mean charging students more.
A 2022 Consumer Financial Protection Bureau report found nearly $13 million of about $15 million in yearly student account costs went to one provider, which Inside Higher Ed identified as BankMobile. Students paid a monthly fee if they had less than $300 in qualifying deposits, and financial aid refunds didn’t count toward that $300.
First Carolina Bank purchased BankMobile’s parent in early 2025, when it had about $3.1 billion in assets. That keeps the bank well under the $10 billion line where federal debit fee caps kick in. BankMobile brought First Carolina about $535 million in average low-cost deposits in the first quarter of 2026, S&P Global reported. Much of that money starts as students’ financial aid refunds.
California districts face an extra hurdle. Community college districts pay most bills through warrants on the county treasury, under California Education Code section 85266. Building in-house direct deposit for thousands of students on top of that system is a heavy lift. For districts paying out thousands of Pell Grants each term, outsourcing became the easy answer.
But we’re not going to sugarcoat it here at The College Investor: it’s not a great system for students.
So Why Do Students End Up Using BankMobile?
Federal rules are clear in that a college cannot require a student to open a bank account. However, that doesn’t mean they don’t have to create an account to jump through secondary hurdles to move their money to their preferred bank or even request a paper check.
For a college that uses BankMobile processing, students have to go through BankMobile even if they want to eventually use their own bank.
Students get a personal code and make their refund choice on BankMobile’s site, as San Mateo County Community College District explains. That includes students who want direct deposit to their own bank account, so their bank details are logged with BankMobile too. This account information is exactly what attackers modified in this breach.
The setup also nudges students toward BankMobile’s own checking account. A refund sent to a BankMobile Vibe account lands the same business day, while a transfer to a student’s own checking account typically takes one to two business days to post, Portland Community College tells students.
That’s the difference between an internal transfer and an ACH payment. Federal rules only require payments to a student’s existing account to be initiated as quickly, not to arrive as quickly.
Why Shouldn’t Colleges Require One Platform?
The College Investor sees two problems here, and colleges own both. On the processing side, a district that routes every financial aid refund through one vendor has no backup when that vendor fails. That’s how California students who chose direct deposit ended up waiting on paper checks this fall.
On the refund side, requiring every student to sign up through BankMobile isn’t a neutral choice when BankMobile’s own account is the fastest option. The CFPB has documented students being told their financial aid might arrive later if they skipped the college-sponsored account. Colleges should collect bank details through their own student portal and keep a way to pay students by ACH directly. Students should never need a third-party profile to receive leftover financial aid that already belongs to them.
Customer service makes the problem worse. Our guide to financial aid refund bank accounts and avoiding BankMobile reflects the complaints we hear most from students, especially long hold times and trouble updating account details. BankMobile’s Trustpilot review summary says customers frequently report spending hours on hold.
That’s one more reason to keep your money in one of the free college student checking accounts you picked yourself.
What Should Students Do Instead?
We generally recommend students open a free college checking account and choose direct deposit to it for their refunds.
After any breach, students should log in and confirm their refund preference and bank details haven’t been changed. Anyone whose details were changed should treat it like identity theft and contact both their college and BankMobile.
Scammers also pose as BankMobile and financial aid offices, so verify any “refund delayed” message with your college and watch for these common college scams.
How This Connects
The breach lands as federal oversight of college banking deals is shrinking. When the CFPB released its 2022 findings, the Education Department promised more staff to oversee these arrangements.
The department has since laid off 20% of its staff during the shutdown, and a judge had to block a plan to fire 90% of CFPB staff. That leaves colleges, and students, carrying more of the burden of vetting these vendors.
The administration is also looking to continue downsizing the CFPB and limit its enforcement of banks and payment processing services
What’s Next
Watch whether more districts follow Los Rios off BankMobile before spring disbursements.
The bigger open question is whether the roughly 400 students who lost money get it back. Students still waiting should ask their financial aid office about a paper check, and Los Rios has pointed students to its Basic Needs Center for food, housing and transportation help in the meantime.
If your refund still hasn’t arrived, here’s what to do when you run out of financial aid mid-semester.
The post BankMobile Breach Delays Financial Aid For Thousands Of California Community College Students appeared first on The College Investor.
