DUO's student-grant fraud checks indirectly discriminated: a rule-based risk profile, six times more home-visit selection for non-European students, and a EUR 61m repayment

Verification status: CHECKING. The claims below are drawn only from sources fetched and quoted this session; the checker sets the badge, and the war-room never sets verified. This is a post-mortem of a government selection system, not a client-outcome win, and the system was not AI: the ministry describes it as rule-based.

The problem

Students in the Netherlands who live away from their parents can receive a higher grant, the uitwonendenbeurs, and the government records that “in 2009 bleek dat er misbruik werd gemaakt van de uitwonendenbeurs” (in 2009 it emerged the grant was being abused), so “in 2012 is de controle daarom aangescherpt” (in 2012 the check was tightened) [source]. The question was how DUO, the student-finance agency, chose whose address to check. The case surfaced on 21 June 2023, when NOS op 3 and Investico reported that lawyers had supported 376 students accused of grant fraud over ten years, and that “bij 367 van hen, in vrijwel alle gevallen dus, ging het om studenten met een migratieachtergrond” (367 of them, virtually all, had a migration background) [source]. That is a lawyer survey, not a population measure, and Erasmus Magazine’s account of the same reporting records that 32 of 70 lawyers approached shared information ([source]). Investico’s own account gives the same count: “De 32 advocaten die gegevens deelden, deden er de afgelopen tien jaar samen 376. In 367 daarvan beschuldigde DUO een student met een biculturele of migratieachtergrond als fraudeur” (the 32 lawyers who shared data handled 376 together over ten years; in 367 of them DUO accused a student with a bicultural or migration background of fraud) [source].

What was built

DUO did not buy a model. “Tot 2023 is gecontroleerd met behulp van een risicoprofiel dat selecteerde op basis van drie criteria die neutraal werden geacht: leeftijd, onderwijssoort en afstand tot het adres van de ouders” (until 2023 checks used a risk profile selecting on three criteria considered neutral: age, type of education and distance to the parents’ address) [source]. The minister’s letter to parliament describes two steps: the three criteria gave each student a risk score and a ranked list, which staff then went through to select students for desk review and home visits; the system “was gebaseerd op regels (een regel-gebaseerd algoritme)” and “was niet zelflerend en maakte geen gebruik van kunstmatige intelligentie” (was rule-based, not self-learning, and used no artificial intelligence) ([source]). The Dutch Data Protection Authority (AP) independently describes the same inputs: “DUO gave students a ‘risk score’ by looking at type of education, distance between addresses, and age” [source]. The scale, as the ministry gives it: “Tussen 2012 en 2023 hebben ongeveer 26.800 studenten een huisbezoek gehad. Bij ruwweg een derde daarvan is misbruik geconstateerd” (between 2012 and 2023 about 26,800 students had a home visit; abuse was found in roughly a third) [source]. The AP counts differently: it “estimates that between 2013 and 2022, DUO selected 21,500 students and checked them for fraud” [source]. The two figures cover different years and different steps, so they are shown side by side here, not reconciled.

The outcome

On 1 March 2024 the minister wrote, on the basis of a PwC study: “Op basis van dit onderzoek concludeer ik dat er sprake is geweest van indirecte discriminatie” (on the basis of this research I conclude there was indirect discrimination) [source]. The government’s release states that students living in neighbourhoods with many residents with a migration background had a greater chance of being checked, that origin data played no role, and that “het kabinet biedt hiervoor haar excuses aan” (the cabinet apologises) ([source]). One mechanism it names: students living closer to their parents were more likely to be selected, while children of parents with a migration background more often stay living nearby [source].

A follow-up DUO commissioned from the Algorithm Audit foundation, linking CBS migration-background data, measured the size. The November 2024 letter to parliament reports that students with a non-European migration background were “tijdens de geautomatiseerde selectie twee keer zo vaak als hoog risico” labelled (twice as often labelled high risk during the automated selection) and “zes keer vaker handmatig geselecteerd voor een huisbezoek” (six times more often selected manually for a home visit) than students of Dutch origin [source]. The manual step amplified the automated one. DUO adds that “86% van de studenten die in bezwaar gaan” (86% of students who lodged an objection) had a non-European migration background [source].

Weakest load-bearing source. The twice and six-times multiples and the 86% come from an audit DUO itself commissioned, and they reach this page only through the ministry’s letter and DUO’s own press page: first-party figures, given against the government’s interest, but not independently re-measured. The underlying CBS-linked data is not public, so no outside party has recomputed them. Even the regulator does not supply its own multiple: the Autoriteit Persoonsgegevens attributes the indirect-discrimination finding to the minister, who “concluded this himself, based on research” [source]. The discrimination finding itself does not rest on DUO alone.

The regulator went further than the ministry. On 11 November 2024 the AP concluded that “the way in which DUO did this was discriminatory and therefore unlawful,” because “there was no objective justification for those criteria,” and it adds that “DUO has never evaluated the functioning of the algorithm” [source]. The two accounts differ: the AP calls the criteria direct discrimination on education type, distance and age, plus indirect discrimination on background ([source]), while the ministry states that “geen directe discriminatie” was found as regards origin data [source].

The same day, the cabinet reversed every decision. The evidence gathered in these checks “had niet gebruikt mogen worden” (should not have been used), so the decisions are unlawful and are being undone; it covers “ruim 10.000 (oud-)studenten” (more than 10,000 current and former students) checked between January 2012 and June 2023, and “het kabinet reserveert hiervoor in totaal € 61 mln” (the cabinet reserves EUR 61 million in total) [source]. The letter itself splits it: reversals “bedragen ruim 47 miljoen” (amount to more than 47 million) and “voor de uitvoeringskosten wordt op dit moment 14 miljoen gereserveerd” (14 million is currently reserved for implementation), and gives the cohort as “naar verwachting 10.000 studenten” (an expected 10,000 students) [source]. Erasmus Magazine reported in April 2025 that DUO had written to affected students that the operation could “perhaps even take several years” ([source]). The EUR 61 million is a reservation, not a recorded payout.

The before and after on selection: “sinds juni 2023 vindt het controleproces voorlopig uitsluitend plaats door middel van een willekeurige (aselecte) steekproef” (since June 2023 the check has provisionally been run only by random sample) [source].

How this was verified. Method: every figure is quoted verbatim from a source fetched live on 2026-10-06 and saved to sources/, each with a web.archive.org snapshot. Mechanism, scale, findings and repayment are from the Dutch government’s parliamentary letters (Kamerstukken II 24724 nr. 220 of 1 March 2024 and nr. 243 of 11 November 2024) and the matching rijksoverheid.nl releases (Tier 1). The selection criteria and the unlawfulness finding are independently corroborated by the Autoriteit Persoonsgegevens (Tier 1, independent regulator). The repayment split is also reported by Erasmus Magazine (Tier 2). The origin of the case is from NOS (Tier 2), with Investico’s own write-up and Erasmus Magazine (Tier 2) on the same reporting. Conflicts (26,800 home visits vs 21,500 selected; “ruim” vs “naar verwachting” 10,000; direct vs indirect discrimination) are shown, not merged. The PwC report and the Algorithm Audit report were not readable in this environment, so their findings are cited only as quoted in the minister’s letters. No confirmation was sought from DUO or the ministry. Round 2 (2026-10-07): the AP’s full investigation report sits behind a bot check and web.archive.org was offline, so it could not be read; the AP release reachable here attributes the disparity finding to the minister rather than measuring it.

Related case files

• The Dutch childcare-benefits scandal and its EUR 2.75m DPA fine: the same regulator, the same country and a fraud risk profile that discriminated by origin; the cabinet explicitly names that recovery operation as the lesson for this one.
• The Dutch DPA’s fine on the Tax Administration for unlawful algorithmic risk profiling: the AP applying the same “no objective justification” test to a government selection algorithm.
• The Hague court’s SyRI judgment on a welfare-fraud algorithm: a Dutch court ending a state fraud-detection system, where this case ended by ministerial reversal instead.
• Michigan’s MiDAS unemployment-fraud algorithm and its settlement: a government fraud-detection system whose decisions had to be unwound and paid back at scale.