Operation Ghostbusters: the ‘ghost students’ who stole US college aid with stolen identities

They never sat in a lecture, never handed in an essay, and never set foot on campus. But on paper, they were college students — hundreds of thousands of them — collecting grants and loans from the United States government. On Thursday 29 October, the US Justice Department announced the first charges in the investigation into the scheme, codenamed Operation Ghostbusters, and said the fraud could be worth well over $200 million.

Five people have been charged in three states, and investigators have seized more than $750,000 in cryptocurrency from an account linked to the scheme in Kenya. The department said it had also identified 830,840 potentially fraudulent student aid accounts linked to nearly $130 million, and recommended that the Education Department disable them. More than 40 cases are now open across 26 FBI field offices.

The target was the Free Application for Federal Student Aid, known as FAFSA, the form low-income Americans use to claim federal college aid.

At a glance

What happened: The US Justice Department charged five people in Virginia, New Jersey and Nebraska in the first cases from Operation Ghostbusters, an investigation into fake “ghost students” created with stolen identities to claim federal student aid.

Why it matters: Investigators believe the fraud has run since at least 2021 and could be worth well over $200 million; 830,840 suspect aid accounts linked to nearly $130 million have been flagged for disabling.

What happens next: More than 40 cases are open across 26 FBI field offices, court proceedings begin in the three charged cases, and the Education Department must decide what to do with the flagged accounts.

What the Justice Department announced

The announcement was made by the Justice Department’s National Fraud Enforcement Division, working with the US Attorney’s Offices for the Eastern District of Virginia, Nebraska and New Jersey. It was the first set of results from Operation Ghostbusters, which the department described as a nationwide investigation into a large-scale student aid fraud scheme.

“If you steal American identities, if you steal taxpayer dollars, if you exploit programs meant to help students build a future — we will find you. Whether you are in Nebraska, New Jersey, Virginia, or Nairobi, we will pursue you,” said Assistant Attorney General Colin M. McDonald.

Three defendants were arrested in New Jersey, one was indicted in Virginia, and one was indicted and arrested in Nebraska. The department also announced the seizure of more than $750,000 in cryptocurrency from an account belonging to a Kenyan national connected to the scheme. Officials said it was the first international seizure of its kind in the Fraud Division’s history, and that it was made possible with help from Kenyan law enforcement.

The investigation began with a referral from the Education Department’s inspector general to the FBI’s office in Richmond, Virginia. The FBI said it had already uncovered hundreds of participants and hundreds of millions of dollars in stolen funds, and had sent about 50 referrals to 26 FBI field offices across the country.

How the alleged scam worked

The scheme was simple in design and difficult to spot. First, the fraudsters got hold of stolen personal information belonging to US citizens. Then they used those details to submit fake FAFSA applications, creating student aid accounts in the victims’ names. Next, they enrolled these fake “ghost students” in colleges and universities. Finally, when the college received the federal aid and deducted tuition and fees, the leftover money — the refund — was paid out. That refund was the prize.

The refunds were sent to bank accounts controlled by intermediaries in the United States, known as money mules. The mules kept a cut and sent the rest overseas, mostly to accounts in Kenya, according to prosecutors. The ghost students never attended a single class.

What made the fraud harder to catch was the way the fake students were kept looking real. The Justice Department said the fraudsters used what it called “super intelligence” — artificial intelligence tools — to place ghost students in classrooms and complete their coursework. The AI did the assignments and created the appearance of a student taking part in online classes, keeping the aid flowing semester after semester.

The victims were chosen carefully. According to the Justice Department, the fraudsters exploited Americans who had never been to college, because that made it harder for the Education Department to cross-check the applications against real student records. Many of the known victims had only finished high school. They were shocked to learn that, on paper, they had attended a college hundreds of miles from home.

The New Jersey case: money mules and a safari company

The largest of the three cases was filed in New Jersey, where three people were charged with conspiring to commit wire fraud. They are Mabed Patricia Utate-Alberto, Patricia Arisleydi Perez and George Arturo Alfau Mendez. All three were arrested.

Prosecutors say that from March 2021 until at least January 2026, the three acted as witting money mules in the United States. They used US bank accounts to receive federal student aid money obtained through false FAFSA applications made with stolen American identities. After taking their cut, they transferred the funds overseas to co-conspirators in Kenya who were associated with a purported Kenyan safari company.

The intended loss in the New Jersey case was put at $1.5 million, and prosecutors said the group obtained more than $1 million in federal student aid funds. According to the criminal complaint, filed on 20 October, the three received hundreds of deposits of federal money over five years. One of them received more than $1 million in deposits linked to more than 300 fraudulent student accounts.

The Virginia case: more than 700 refunds

In the Eastern District of Virginia, a federal grand jury returned a sealed indictment on 21 October charging a Kenyan national with conspiracy to commit wire fraud and student aid fraud. The defendant has not been named publicly.

According to the indictment, the defendant conspired with fraudsters in Kenya to use the stolen identities of US citizens to submit false FAFSA applications and steal more than $1.4 million in student aid. Acting as a US-based money mule, the defendant used multiple bank accounts at several financial institutions to receive more than 700 fraudulently obtained federal student aid refund deposits, totalling about $1,439,548, and then moved at least $1.3 million to accounts in the United States and Kenya.

The Nebraska case: a $2,000-a-week cut

The third case was filed in Nebraska, where a federal grand jury returned a ten-count indictment on 19 October against Francis Mogambi, a Kenyan citizen. He was charged with five counts of theft of government money and five counts of aggravated identity theft, and was arrested and detained pending trial.

Prosecutors said that between November 2025 and May 2026, Mogambi fraudulently obtained federal student financial aid using stolen identities. He worked with associates in Kenya to steal the identities of US citizens, use them to enrol American victims in educational institutions, and redirect federal financial aid cheques to himself. He kept 30 percent of the proceeds and sent the rest to his co-conspirators in Kenya.

Court documents said Mogambi tried to recruit another person into the scheme and openly shared details of the conspiracy, telling that person he received $2,000 a week and needed a business so he could cash larger cheques and avoid paying tax. The intended loss in the Nebraska case was put at $20,000, far smaller than the other two cases, but Mogambi faces 10 years in mandatory minimum prison time because of his use of stolen identities. He arrived in the United States on 15 May 2024 after winning the Diversity Visa lottery, and was issued a visa and a Permanent Resident Card shortly afterwards, according to the Justice Department.

How big is the problem? The numbers, explained

Several large figures have been reported in this case, and they measure different things. The five charged cases involve about $2.9 million in alleged fraud, according to ConsumerAffairs — roughly $1.5 million in New Jersey, $1.4 million in Virginia and $20,000 in Nebraska.

A much bigger figure comes from the investigation itself. In September and October 2026, investigators identified 830,840 potentially fraudulent Federal Student Aid IDs linked to nearly $130 million, and recommended that the Education Department disable them. These accounts are flagged as suspect, not proven fraud.

Then there is the overall scale. The Justice Department estimates that the fraud has cost well over $200 million since 2021. The FBI, meanwhile, said it had identified more than $32 million in losses in similar ghost student schemes so far, with more suspected. Finally, the Education Department said its new detection tools had prevented more than $2 billion in attempted student aid theft — money that was never paid out, because suspect applications were caught in time.

The Kenya connection

Kenya sits at the centre of this investigation. The Justice Department said the stolen funds were routed through US bank accounts to foreign actors, including Kenyan nationals, and that the scheme was run with co-conspirators in Kenya.

In September, representatives from the Fraud Division and its partner agencies visited Kenya to promote extradition, prosecution and the return of assets stolen from US taxpayers. Working with Kenyan law enforcement partners, investigators seized more than $750,000 from a cryptocurrency account belonging to a Kenyan national connected to the fraud. Officials described the seizure as the first international seizure of its kind in the Fraud Division’s history.

What to do if your identity was used

Most victims in this case had no idea their identities had been used until investigators contacted them. The FBI has sent letters to many identified victims. Anyone who receives such a letter should follow the instructions in it, and anyone unsure whether a letter is genuine can verify it directly with their local FBI field office.

For everyone else, consumer experts and the Justice Department recommend a series of checks, even for people who never attended college.

First, review your records at StudentAid.gov. Sign in and examine your loans, grants, FAFSA activity and enrolment history, and look for unfamiliar schools, applications or payments. If you cannot access your account, or you discover that your Social Security number is attached to an account you did not create, contact Federal Student Aid on 1-800-433-3243.

Second, check your credit reports from all three bureaus — Equifax, Experian and TransUnion — at AnnualCreditReport.com, where free reports are available weekly. Look for student loans and other accounts you never opened.

If something looks suspicious, contact Federal Student Aid, the school’s financial aid office and any loan servicer involved. Explain that you suspect identity theft, ask for an investigation, and ask how to dispute unauthorised loans or correct fraudulent aid records. Save statements, screenshots and correspondence. Then report the suspected fraud to the Education Department’s inspector general through its hotline complaint form, and file an identity theft report at IdentityTheft.gov, where the Federal Trade Commission provides a recovery plan and documentation to help dispute fraudulent accounts.

Finally, freeze your credit with each of the three credit bureaus. Freezes are free and help prevent additional credit accounts from being opened in your name. Secure your StudentAid.gov account with a new, unique password and review its contact information and two-step verification settings.

What happens next

The three charged cases will now move through the courts in New Jersey, Virginia and Nebraska. The charges are allegations, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Beyond those cases, the investigation is still expanding. With more than 40 open cases and hundreds of participants already identified, officials said this round of indictments was just the start. Further charges are expected, including against the two Kenyan co-conspirators in the New Jersey case. The Education Department must also decide what to do with the 830,840 potentially fraudulent aid IDs that investigators recommended disabling.

Colleges are weighing new defences of their own, while Congress considers legislation to make the Education Department’s new fraud-detection tools permanent.

Frequently asked questions

What is a “ghost student”?

A ghost student is a fake student created on paper using a stolen identity. Fraudsters submit a FAFSA application in the victim’s name, enrol the fake student in a real college, and collect the federal aid refund. The “student” never attends class, and artificial intelligence tools are used to fake classroom participation and complete coursework so the aid keeps flowing.

How much money is involved in Operation Ghostbusters?

It depends on what is being counted. The five charged cases involve about $2.9 million in alleged fraud. Investigators flagged 830,840 potentially fraudulent aid accounts linked to nearly $130 million. The overall fraud is estimated at well over $200 million since 2021.

I never went to college. Could my identity still have been used?

Yes. That is exactly who the fraudsters targeted. The Justice Department said the scheme exploited Americans who had never been to college, because that made it harder for the Education Department to cross-check applications against real student records.

How do I check if I was affected?

Check your records at StudentAid.gov for unfamiliar schools, applications or payments, and check your credit reports from Equifax, Experian and TransUnion at AnnualCreditReport.com. If you find something suspicious, contact Federal Student Aid, the school’s financial aid office and your loan servicer, report it to the Education Department’s inspector general through its hotline complaint form, and file an identity theft report at IdentityTheft.gov.

What happens to the people who have been charged?

The five defendants face trial in New Jersey, Virginia and Nebraska. The charges are allegations, and the defendants are presumed innocent until proven guilty beyond a reasonable doubt. In Nebraska, Francis Mogambi faces 10 years in mandatory minimum prison time because of his use of stolen identities.

Will the 830,840 flagged aid accounts be disabled?

The Justice Department recommended that the Education Department disable them, after investigators identified the accounts in September and October 2026. The final decision rests with the Education Department, and it had not been announced when the charges were unveiled.

Conclusion

Operation Ghostbusters is the first public result of a fraud investigation that stretches from community colleges across the United States to bank accounts and a safari company in Kenya. Five people have been charged, more than $750,000 in cryptocurrency has been seized, and more than 830,000 suspect aid accounts have been flagged. But the numbers suggest the charged cases are only the visible part of a much larger fraud, one that ran for at least five years.

For the victims, the damage is personal as well as financial: a college record they never earned, a loan they never took, and a debt they may only discover when a letter arrives.

This article is for general information and education only. It is not legal or financial advice.

Sources

– https://www.justice.gov/opa/pr/justice-department-unveils-indictments-nationwide-ghost-student-fraud-scam-linked-kenyan (US Department of Justice, 29 October 2026)

– https://www.insidehighered.com/news/government/student-aid-policy/2026/10/30/doj-makes-arrests-fafsa-ghost-student-scheme (Inside Higher Ed, 30 October 2026)

– https://www.consumeraffairs.com/news/operation-ghostbusters-targets-student-aid-fraud-built-on-stolen-identities-103026.html (ConsumerAffairs, 30 October 2026)