A Breach Froze Aid Refunds at California Colleges. Federal Rules Say Yours Can Go Straight to Your Own Bank.

If your college pays leftover financial aid through BankMobile, your money may have shown up late this fall, or as a paper check. Here’s what nobody put in the welcome packet: you never had to use BankMobile at all.

Federal rules say your aid refund can go straight to the checking account you already have. The school has to list that option first.

What broke

California community colleges got word of a BankMobile security incident in early October. Shasta College says it was notified on Friday, October 2. The state Chancellor’s Office then told colleges to pause disbursements through BankMobile while the problem was investigated.

The scale, according to BankMobile’s own communications with college officials as reported by EdSource on October 30: about 65,000 student accounts had data changed, roughly 1,000 were accessed, and about 400 had financial aid stolen. EdSource reports the attackers exploited a weakness in an account verification process BankMobile changed in July.

Riverside’s district moved about 3,400 students to paper checks on October 8. Butte College and Long Beach did the same. Los Rios is leaving BankMobile for Nelnet. In the meantime, a Pierce College student told EdSource she was “thinking about, ‘Is it worth buying this meal versus a textbook?’”

That’s a rough trade to force on someone over a vendor’s security hole.

The choice is yours by law

The refund card in your welcome packet looks official because your school picked the company. The money is still yours, and you choose where it lands.

Under 34 CFR 668.164, a school that pays refunds through a contracted servicer has to tell you in writing that you don’t have to open any account it offers. It has to present your existing bank account “prominently as the first option.” It can’t preselect anything. Sending money to your own bank has to be just as quick and no harder to set up. And you can change your choice at any time with written notice.

The school-linked account isn’t automatically bad. Federal rules also bar it from charging you to open it or for in-network ATM withdrawals. But putting your aid in a second account at a company you didn’t pick means one more login and one more place to get phished. NC State warned in September about texts impersonating BankMobile about aid refunds.

Verdict: your call, but if you already have a checking account you trust, that’s where we’d send it. Most students never knew they had the choice.

Do this before your next disbursement

Log into your refund account and check the refund selection and contact details. Shasta tells students that anything changed, unfamiliar or suspicious should go to BankMobile at 855-398-9443 first, then to the aid office.

Check your school’s disbursement calendar. Shasta pays Pell in four 25 percent chunks, and the fourth lands November 6, so don’t wait until the morning of.

If money moved without you, report it in writing, not just by phone. Under Regulation E, reporting within 60 days of the statement it shows up on protects you from later unauthorized transfers. Miss that window and the protection gets thinner.

Then confirm your mailing address with the aid office. A paper check is the fallback when electronic payments stop.

For the timing rules on the refund itself, see how the 14-day credit balance rule works, and find more on paying for school at our education hub.

How Candid Yak makes money. Some of the products we write about pay us if you apply or sign up through our links. That never changes our verdict, our rankings, or the numbers in this article. We call a bad deal a bad deal whether it pays us or not. Some brands shown in our comparison tools are placeholder examples while we finalize partner agreements, and we label them as such.