The Ghost Students Who Cost $130m and Never Sat an Exam
That is the direction the current caseload points in. It is not where the United States stands in 2026. What stands there instead is an aid programme that pays out on enrolment, and an investigation trying to arrive before the money leaves the country. The investigation is called Operation Ghostbusters. Its headline figure is $130m in taxpayer funds lost to the scheme. The mechanism behind that figure fits into one line: steal an identity, enrol a student who does not exist, collect the aid that follows the enrolment. Everything else in the case file is detail attached to that line.
The detail is broad. Federal prosecutors have returned five indictments involving Kenyan nationals. More than 40 investigations remain open. Those cases run across 26 FBI field offices, which means the map of the alleged scheme is not a single city but a grid. At a news conference on 29 October 2026 announcing the first charges, Assistant Attorney General Colin M McDonald, who heads the Justice Department’s National Fraud Enforcement Division, put the pattern into two sentences: “These are not isolated errors.” “This is organized fraud at scale.” [1] The word organized is doing real work. It separates a lone applicant who lies on a form from a supply chain that buys identities in bulk, enrols them, and moves the proceeds offshore. It also explains the operation’s name: it hunts students who are not supposed to exist.
Then there is the count that measures exposure rather than loss. Investigators identified 830,840 potentially fraudulent Federal Student Aid identification numbers in September and October 2026, and recommended that the Department of Education disable them. The aid attached to those accounts comes to nearly $130m. The gap between “potentially fraudulent” and “confirmed loss” is not bureaucratic hedging. It is the difference between a suspicion that has been flagged and a dollar proved to have left the Treasury. A second figure suggests how routine the front end of the fraud had become. Nearly a third of community college applicants in California in 2024 were identified as fraudulent. One third is not a rounding error at the edge of a system; it is a signal that the front door was left open.
The supply side explains why the scheme is cheap to run. Identities were sometimes sold online for between $4 and $8. Fraudsters targeted low-income Americans who had never had the opportunity to attend college, which is to say people unlikely to notice a college account opened in their name until a bill arrived. Hundreds of people have been affected after their personally identifiable information was stolen and used to access federal student aid. The victims were not selected because they were careless, but because they were quiet.
A Name on the Roster, a Wire to Nairobi
The image that captures the scheme is a name on an online class roster, with no photograph, no attendance record and no questions asked. The account submits coursework. It posts in the discussion thread. It is graded. The student behind it does not exist. The Justice Department describes the tool that keeps this apparition alive as “super intelligence,” used to fill out college applications and complete coursework so that the fake student looks like a real one completing a class. Some operations go further and create the appearance of a fake student inside an online classroom, enough to convince a school that a person is present. McDonald framed the logic in a single sentence: “The goal is to keep the ghost student in school as long as possible. Semester after semester after semester stealing money from the taxpayers.” [1] Duration is the product. Every additional semester is another disbursement.
The money does not stay in the classroom. If the Department of Education is successfully deceived, the aid money goes to the college where the ghost student is enrolled. Tuition and fees are deducted. The leftover federal funds are then deposited directly into bank accounts controlled by the fraudsters. From there the money moves through domestic money mules and out of the country, sometimes through fronts, including a purported safari company in Nairobi. Two cases show the volumes at the tail end of that chain. In Virginia, prosecutors allege a Kenyan national received more than 700 fraudulent student-aid refunds totalling approximately $1.44m, with at least $1.3m subsequently transferred through thousands of transactions to accounts in the United States and Kenya. In New Jersey, three people have been charged with acting as money mules in a scheme to obtain more than $1m in federal student aid, keeping a portion and sending the rest to alleged co-conspirators in Kenya.
One defendant shows how small a single slice can be. Francis Mogambi, a Kenyan national, arrived in the United States in May 2024 after winning the Diversity Visa lottery, a programme that gives people from around the world a chance to become permanent residents. On 19 October 2026 a grand jury in Nebraska indicted him on five counts of theft of government money and five counts of aggravated identity theft. Prosecutors allege that between November 2025 and May 2026 he worked with associates in Kenya to steal the identities of US citizens and use them to enrol fictitious students in American colleges. Once the fake students were enrolled, he allegedly diverted their financial aid payments to himself, keeping 30 % and sending the remainder to his associates in Kenya. The intended loss in his case was $20,000. Court documents say he received $2,000 a week and tried to recruit another person, telling that individual he needed a business that would let him cash larger cheques without paying taxes. He was arrested shortly after the indictment and is being held in custody pending trial; he has not commented on the allegations.
The cost lands on people who never entered a classroom. A stolen identity can surface years later as a student loan balance, a collection notice, a credit file in ruins. McDonald described one such file: “His identity was stolen, his credit is now at risk, and his name is on the bill.” He set out the fuller version of the same story: an American citizen who graduated high school and went straight to work to provide for his family, who never applied to college, never enrolled in classes and never asked for federal student aid, and who one day found his name attached to a loan from a school hundreds or thousands of miles away. The fraud does not only remove money from the Treasury. It installs a debt in the record of a person who was never asked.
When the Wire Ends in Nairobi
Enforcement has crossed the Atlantic in both directions. In September 2026, US officials travelled to Kenya to work with local law enforcement on extraditions, prosecutions and the recovery of money allegedly stolen from American taxpayers. With the help of Kenyan investigators, US authorities seized more than $750,000 from a cryptocurrency account belonging to a Kenyan national connected to the wider scheme. The Justice Department described it as the first international seizure of its kind in Kenya. That seizure was not connected to Mogambi’s individual case, which places it in the broader network rather than in a single indictment. McDonald set out the reach in plain terms: “Whether you’re in Nebraska, New Jersey, Virginia, or Nairobi, we will pursue you and bring you to justice.” He added, of the programme under attack: “If you steal American identities, if you steal taxpayer dollars, if you exploit programs meant to help students build their future, we are resolved to find you and prosecute you.” The penalties are designed to be heavier than the profit. If convicted, Mogambi faces a mandatory prison term of at least 10 years, according to the Justice Department. The structure matters for the economics of the crime. A scheme that nets $20,000 in intended loss and pays a mandatory decade inside is a scheme whose expected return collapses the moment detection becomes likely.
The timeline complicates the politics. Investigators estimate the scheme has been operating since 2021, potentially reaching several hundred million dollars in taxpayer losses, and McDonald’s account places the investigation’s serious phase as beginning in April 2026. Under Secretary of Education Nicholas Kent blamed the previous administration for having taken off fraud safeguards. What can be dated is the conduct in the charged cases, which in Mogambi’s indictment falls between November 2025 and May 2026.
