Dubbed Operation Ghostbusters, the investigation has resulted in charges against five defendants and the seizure of more than $750,000 in cryptocurrency linked to the wider scheme, which US authorities say involves networks associated with Kenyan nationals.

According to the US Department of Justice, perpetrators allegedly used stolen personal information belonging to American citizens to create fraudulent applications for federal student aid, enrol fictitious students in colleges and redirect the resulting payments to accounts controlled by people involved in the scheme.

The alleged fraudsters also used artificial intelligence (AI) to make the fictitious students appear legitimate, including by completing coursework and creating the impression that they were attending classes.

"If you steal American identities, if you steal taxpayer dollars, if you exploit programs meant to help students build a future, we will find you," Assistant Attorney General Colin M. McDonald said when announcing the first charges on October 29, 2026. "Whether you are in Nebraska, New Jersey, Virginia, or Nairobi, we will pursue you."

How the 'ghost student' scheme worked

The alleged scheme exploited the Free Application for Federal Student Aid (FAFSA), through which Americans apply for financial assistance to pursue higher education.

Investigators say perpetrators used stolen identities to submit fraudulent applications and enrol fictitious students in colleges and universities. The purported students, known as "ghost students", never attended the classes for which the financial aid was awarded.

According to the Justice Department, the fraudsters used what it described as "super intelligence" to complete coursework and maintain the appearance of genuine enrolment. The techniques allegedly included placing fake students in virtual classrooms to keep aid payments flowing.

"The goal is to keep the ghost student in school as long as possible. Semester after semester after semester stealing money from the taxpayers," McDonald said.

Once the funds were disbursed, the money was allegedly diverted through bank accounts controlled by the perpetrators and their associates, with some proceeds transferred overseas, including to Kenya.

The investigation dates back to at least 2021, when American colleges and universities began identifying fraudulent applications that resulted in student aid refunds being paid into accounts belonging to people other than the purported students.

The alleged scheme also exposed innocent Americans to financial harm, including the risk of unexpected student loan obligations and damage to their credit records after their identities were used without their knowledge.

Kenyan nationals among those charged

The investigation has produced cases in three US federal districts involving Kenyan nationals and alleged links to associates in Kenya.

In Nebraska, a federal grand jury indicted Francis Mogambi, a Kenyan citizen, on October 19, 2026, on five counts of theft of government money and five counts of aggravated identity theft.

Prosecutors allege that between November 2025 and May 2026, Mogambi worked with associates in Kenya to steal American identities, fraudulently enrol fictitious students and redirect federal student aid payments. He allegedly kept 30% of the proceeds and sent the remainder to his co-conspirators.

Court documents state that Mogambi received $2,000 a week and attempted to recruit another person into the scheme. The intended loss in his case was $20,000.

Mogambi, who arrived in the United States in May 2024 after winning the Diversity Visa lottery, was arrested following the indictment and is being held in custody pending trial.

In a separate Virginia case, prosecutors charged a Kenyan national with conspiracy to commit wire fraud and student aid fraud. The defendant allegedly received more than 700 fraudulent student aid refunds totalling approximately $1.44 million, then transferred at least $1.3 million through thousands of transactions to accounts in the United States and Kenya.

In New Jersey, three defendants have been charged with allegedly acting as money mules in a scheme involving more than $1 million in federal student aid. Prosecutors say they received the funds through US bank accounts before transferring money, after taking their share, to alleged co-conspirators in Kenya associated with a purported safari company.

The Justice Department said it would seek to charge two alleged co-conspirators based in Kenya as the New Jersey investigation continues.

US seizes $750,000 in cryptocurrency

The investigation has also prompted cooperation between American and Kenyan law enforcement agencies.

In September 2026, US officials travelled to Kenya to discuss extradition, prosecution and the recovery of funds allegedly stolen from American taxpayers.

With assistance from Kenyan law enforcement, investigators seized more than $750,000 from a cryptocurrency account belonging to a Kenyan national connected to the wider scheme. The Justice Department described it as the first international seizure of its kind in the history of its National Fraud Enforcement Division.

The seizure was not connected to Mogambi's individual case.

Investigators identified 830,840 potentially fraudulent Federal Student Aid identification numbers associated with nearly $130 million in September and October 2026, recommending that the Department of Education disable them. The figure represents aid associated with potentially fraudulent accounts, not confirmed losses.

The FBI has separately identified more than $32 million in losses from similar ghost-student schemes, with additional losses suspected. The Justice Department estimates that the wider fraud could exceed $200 million.

First Assistant US Attorney Theophani K. Stamos said investigators had uncovered hundreds of participants and referred cases to FBI field offices across the country.

"Student aid belongs to real students, the data always leaves a trail, and we will follow it wherever it leads," she said.

The Justice Department reported more than 40 open investigations across 26 FBI field offices and over 20 US attorneys' offices. Authorities say they are continuing to work with Kenyan counterparts to trace funds, recover assets and pursue alleged accomplices.

All charges remain allegations, and the defendants are presumed innocent until proven guilty in court.