Ghost student fraud: what DOJ's Operation Ghostbusters revealed
Ghost student fraud explained: how stolen identities were used to divert U.S. student aid, who DOJ charged in Operation Ghostbusters and what victims can do.
On October 29, 2026, the U.S. Justice Department announced Operation Ghostbusters, a crackdown on "ghost student" fraud: criminals use stolen identities to enroll students who do not exist and collect federal student aid. According to the DOJ release, five people were charged in three federal districts and investigators flagged 830,840 potentially fraudulent FSA IDs tied to nearly $130 million in aid.
What is ghost student fraud?
Using a victim's name, date of birth and Social Security number, fraudsters create an FSA ID, file a FAFSA and enroll the "student" at a school, often a community college with online classes. When aid is disbursed, the refund left after tuition goes to bank accounts opened in other people's names. DOJ says the groups even completed coursework to keep the money flowing. Many victims learned they were enrolled at schools hundreds of miles away. The scheme dates back to at least 2021.
Who was charged and how much was stolen?
| District | Defendants | Intended loss |
|---|---|---|
| New Jersey | 3 U.S.-based money mules (arrested) | $1.5 million |
| Eastern District of Virginia | 1 Kenyan national | $1.4 million (700+ refund deposits) |
| Nebraska | 1 Kenyan citizen | $20,000 |
The FBI has identified more than $32 million in losses, with over 40 open cases across 26 field offices, and DOJ cites estimates above $200 million. It also seized more than $750,000 in cryptocurrency from an account tied to a Kenyan national (EDVA). Charges are allegations; defendants are presumed innocent.
How did the money leave the U.S.?
Refunds landed in accounts opened in others' names; U.S. money mules moved the funds to accounts controlled abroad, including in Kenya. It is textbook laundering through mule accounts; see our money laundering section. Stolen identities fuel the scheme, which is why our identity theft guide matters here, and government-impersonation and benefit fraud keep growing in the FBI IC3 data.
Why are colleges and federal aid a target?
Three factors stand out. Huge volumes of leaked personal data make it easy to open accounts in someone else's name. Online enrollment often involves little in-person verification. And the money is public and large: Under Secretary of Education Nicholas Kent said the Department has prevented more than $2 billion in attempted student aid theft. The FBI Richmond Field Office led the case after a referral from the Education Department's Office of Inspector General, working with the State Department, Customs and Border Protection and Kenyan authorities; DOJ officials traveled to Kenya in September to pursue extradition and asset recovery.
How do I know if my identity was used for a fake enrollment?
Warning signs include letters or emails from a college you never applied to, notices about student loans you did not request, student-debt collection calls, or a hard inquiry from a school on your credit report. The FBI says it has already mailed letters to identified victims. Schools should also watch for clusters of applications sharing the same IP address, phone number or bank account.
What to do
- Got an FBI letter? Follow its instructions or contact your local FBI field office.
- Report to the Education Department OIG via its hotline complaint form.
- Freeze your credit at all three bureaus and file at IdentityTheft.gov.
- Never lend your bank account or accept "jobs" receiving and forwarding money.
More charges are expected. Follow updates on the Cyber Target radar.