The US Justice Department announced charges against five people on October 29 in an alleged student aid fraud scheme that used stolen American identities to enroll fake college students and divert federal funds. The department says fraudsters used AI to sustain those enrollments, potentially leaving identity theft victims facing loan repayment demands and damaged credit for courses they never took.
In its announcement of Operation Ghostbusters, the DOJ also disclosed the seizure of more than $750,000 in cryptocurrency linked to a network associated with Kenyan nationals. Investigators identified 830,840 potentially fraudulent Federal Student Aid IDs relating to nearly $130 million during September and October 2026 and recommended that the Department of Education disable them. Those are account identifiers flagged for suspected fraud, rather than a count of confirmed victims or proven losses.
The alleged scheme affects colleges administering federal aid and Americans whose identities were used without their knowledge, particularly high school graduates who never attended college. Investigators believe the fraud has operated since at least 2021, and more than 40 cases remain open across 26 FBI field offices and more than 20 US Attorneys’ Offices.
How fake enrollments turn into payments
Ars Technica’s report, drawing on the DOJ announcement and officials’ press conference, describes a process beginning with the purchase of personally identifiable information—data that identifies an individual. Fraudsters allegedly use that information to submit the Free Application for Federal Student Aid, known as FAFSA, and seek admission to universities and community colleges.
Aid first pays the institution’s tuition and fees. Any remaining amount is refunded, creating an opportunity to route money into accounts controlled by fraudsters. US-based money mules, people who receive and move funds for others, allegedly helped send the proceeds overseas.
Officials say AI helps maintain the deception after enrollment by filling out applications, completing coursework and creating the appearance of attendance in virtual classrooms. Assistant Attorney General Colin M. McDonald said the aim is to keep a fake student enrolled across successive semesters so payments continue.
The DOJ says targeting people who have never attended college frustrates the Education Department’s ability to cross-check applicants. Some known victims reported having only a high school diploma, yet discovered records showing attendance at distant institutions. Ars reported that victims may learn about the fraud only when the government seeks repayment years later, after their credit has suffered.
The Department of Education’s Office of Inspector General detected the patterns that prompted the FBI Richmond investigation. Investigators then traced payments through US and foreign bank accounts and cryptocurrency wallets. First Assistant US Attorney Theophani K. Stamos said suspicious patterns identified through data analysis provided leads for further inquiries and indictments.
Three cases behind the announcement
The five defendants face allegations in New Jersey, Virginia and Nebraska. The charges remain allegations, and all defendants are presumed innocent unless proven guilty.
In New Jersey, prosecutors accuse Mabed Patricia Utate-Alberto, also known as Mabed Alberto Utate; Patricia Arisleydi Perez; and George Arturo Alfau Mendez, also known as George Alfau, of acting as knowing money mules between approximately March 2021 and at least January 2026. The criminal complaint alleges they received more than $1 million in fraudulently obtained student aid, retained a share and transferred the rest to conspirators in Kenya associated with a purported safari company. The DOJ lists intended losses of $1.5 million. All three were arrested, and prosecutors said they intend to charge two alleged co-conspirators in Kenya.
A Virginia indictment returned October 21, under seal, charges a Kenyan national with conspiracy to commit wire fraud and student aid fraud. Prosecutors allege the defendant received more than 700 fraudulent student aid refund deposits totaling approximately $1,439,548 through accounts at several financial institutions. Thousands of subsequent wire transfers and money-service transactions allegedly moved at least $1.3 million to accounts in the United States and Kenya.
In Nebraska, an October 19 indictment charges Francis Mogambi, a Kenyan citizen, with five counts each of theft of government money and aggravated identity theft. The DOJ lists $20,000 in intended losses and says the charges carry mandatory minimum sentences totaling 10 years. Mogambi was arrested and detained pending trial.
Prosecutors allege that between November 2025 and May 2026, Mogambi used stolen identities to enroll people in educational institutions and redirect aid checks to himself, keeping 30% and sending the remainder to associates in Kenya. Court documents also allege he tried to recruit another participant, said he received $2,000 a week and sought a business through which he could cash larger checks without paying taxes.
The DOJ reports more than $32 million in identified losses across similar ghost student schemes, with millions more suspected, and estimates the broader fraud at well over $200 million. Stamos separately said investigators had uncovered hundreds of participants and hundreds of millions of dollars in stolen funds, generating approximately 50 referrals to 26 FBI field offices.
US officials visited Kenya in September to advance extradition, prosecution and asset recovery efforts. The DOJ credited Kenyan law enforcement intelligence and assistance with the cryptocurrency seizure, which it described as the first international seizure of its kind in the Fraud Division’s history.
Identity checks also create work for colleges
The Education Department says new fraud controls have prevented more than $2 billion in attempted student aid theft. Its online identity checks require applicants to present government-issued identification to a camera in real time. Automated systems assign risk ratings, and applications flagged as high risk are rejected, leaving institutions responsible for follow-up verification.
Ars reported concerns from student aid advocates that false flags, proposed college application fees and the cost or availability of identification could impede low-income applicants. Checks can also apply when students correct FAFSA submissions, potentially delaying money needed for tuition, books and other expenses.
MorraLee Keller of the National College Attainment Network told Inside Higher Ed that some students lack a driver’s license and may need time and money to obtain alternative identification. National Association of Student Financial Aid Administrators president Melanie Storey has asked the department to quantify how much in-person verification colleges will still need to conduct. FAFSA executive director Aaron Lemon-Strauss could not provide a number when asked in April.
Technical failures have also affected screening. In August, the Education Department acknowledged that an issue between June 29 and July 6 prevented fraud evaluation results from being shared with certain FAFSA forms; it subsequently reprocessed those applications.
Lemon-Strauss recommended that universities remain alert to legitimate students mistakenly flagged and act to preserve their access to aid. For people who suspect their identities were used in this scheme, the DOJ directs reports to the Department of Education’s Office of Inspector General hotline complaint form at oig.ed.gov/oig-hotline/complaint-form. The FBI has sent letters to many identified victims: recipients should follow those instructions and contact their local FBI field office with questions or concerns.
