Basically if you get hold of somebody’s name, SSN and date of birth and this person never create a FAFSA password (never filed FAFSA, for example) you could retrieve all his basic tax info. AGI from the tax return is used as a “password” to electronically file the next year return. Obviously the whole thing was not designed properly. Until last year there was even no password on FAFSA.