Ghost Students: Five Charged Over Fake-Student Aid Fraud, $750K in Crypto Seized

On Thursday 29 October 2026, at the US Attorney's Office in Alexandria, Virginia, the Justice Department announced the first results of an investigation it calls Operation Ghostbusters. Five people were charged in three states over schemes in which, prosecutors say, stolen American identities were enrolled at colleges as "ghost students": students who exist only on paper, never sit in a classroom, and still collect federal financial aid. The money, the department says, flowed to Kenya. Some of it was turned into cryptocurrency, and more than $750,000 of that crypto has been seized with the help of Kenyan law enforcement.

The five cases add up to about $2.9 million in alleged intended losses. That is the small end of the story. The FBI says it has tied more than $32 million in losses to specific suspects in similar schemes, and the Justice Department estimates the wider fraud at well over $200 million. In September and October 2026, investigators flagged 830,840 federal student aid accounts as potentially fraudulent, linked to nearly $130 million in aid. Those accounts are suspected, not proven fake, and the department has recommended that the Education Department disable them.

"These are not isolated errors. This is organized fraud at scale," said Colin M. McDonald, the Assistant Attorney General who leads the department's National Fraud Enforcement Division. None of the five has been convicted, and all are presumed innocent unless proven guilty.

How a ghost student gets paid

In the United States, a student who wants government help with college fills in the Free Application for Federal Student Aid, known as the FAFSA. Students from poorer families can receive Pell grants, which never have to be repaid, and federal student loans. The money goes to the college first. The college takes its tuition and fees and sends what is left, called a refund, to the student's bank account to pay for rent, books and food.

Prosecutors say the fraudsters turned that refund into a cash machine. They bought Americans' personal details, very often belonging to people who had finished high school and gone straight to work. Those people had never applied to college, so they had no reason to check for a student record in their name. The fraudsters used the details to fill in aid applications and enrol the fake students, typically in online courses. When the refund came, it landed in a bank account the fraudsters controlled.

Colleges drop students who never show up, so the ghosts had to look busy. McDonald said the fraudsters used artificial intelligence to fill in applications, complete coursework and even make a fake student appear present in a virtual classroom. "It looks like the ghost student is actually completing the class," he said. The aim, he said, was to keep each ghost enrolled semester after semester, drawing aid every time.

At least one identity-theft victim, a man who graduated from high school but never went to college, found a student loan in his own name. Crypto Media Zone does not name victims.

The five accused

New Jersey. In a criminal complaint filed on 20 October 2026, prosecutors charged three people: Mabed Patricia Utate-Alberto, Patricia Arisleydi Perez and George Arturo Alfau Mendez. The Justice Department describes them as knowing money mules, meaning people who let their US bank accounts be used to receive stolen money and pass it on. Prosecutors say that from about March 2021 to at least January 2026 the three received federal student aid obtained with stolen identities, took a cut, and sent the rest overseas to two people in Kenya linked to a company selling safari trips. One of the three allegedly received more than $1 million in deposits tied to more than 300 fake student accounts. The intended loss in the case is about $1.5 million. All three were arrested and have not yet entered pleas. The two people in Kenya have not been charged; prosecutors say they intend to charge them.

Nebraska. On 19 October 2026 a federal grand jury in Nebraska indicted Francis Mogambi, a Kenyan citizen, according to the Justice Department. He faces five counts of theft of government money and five counts of aggravated identity theft. Prosecutors say that from November 2025 to May 2026 he worked with associates in Kenya to enrol stolen identities at colleges, had the aid redirected to himself and kept 30% of the proceeds. The intended loss in his case is about $20,000, the smallest of the three cases. He pleaded not guilty and is detained until trial. Each aggravated identity theft count carries a mandatory two years in prison on top of any other sentence.

Virginia. On 21 October 2026 a grand jury in the Eastern District of Virginia indicted a Kenyan national on charges of conspiracy to commit wire fraud and student aid fraud. The indictment is sealed and the name has not been released. Prosecutors say this defendant received more than 700 federal aid refund deposits worth about $1,439,548 and moved at least $1.3 million to accounts in the United States and Kenya.

Where the crypto comes in

Sending stolen dollars abroad through banks leaves a paper trail and invites questions. Cryptocurrency offers a quicker road. A common tool is the stablecoin, a digital token built to stay worth one US dollar, which works like a digital dollar. Stablecoins are bought and sold on crypto exchanges, which work much like online brokers. Dollars can be turned into stablecoins in one country and back into local cash in another, with no international bank wire in between.

In September 2026, the Justice Department says, US investigators working with Kenyan law enforcement seized more than $750,000 in cryptocurrency from an account belonging to a Kenyan national connected to the scheme. The department called it the first international seizure of its kind in its fraud division's history. It has not named the account holder, the coin or the exchange. A seizure is not a conviction, and the owner can still contest it.

A problem years in the making

Ghost students are not new. California's community college system says nearly a third of all its applicants in 2024 were fraudulent, and its colleges reported paying about $13 million in federal and state aid to fake students over a single year. Colleges in Minnesota and Nevada reported the same pattern: online classes filling up with "students" who vanished once the aid arrived.

In June 2025, the Education Department under Secretary Linda McMahon ordered colleges to check a government-issued ID, in person or on a video call, for about 125,000 first-time aid applicants enrolled for the summer, while it built a permanent screening system. The department now says its fraud checks have stopped more than $2 billion in attempted theft. California's community colleges have moved to require identity checks for every student.

Operation Ghostbusters began with the FBI's Richmond Field Office and federal prosecutors in the Eastern District of Virginia. It has since grown into more than 40 open cases across 26 FBI field offices, with more than 20 US Attorney's offices involved. Under Secretary of Education Nicholas Kent and senior FBI officials stood beside McDonald at the announcement. Officials said more arrests are likely.