FinCEN issued a nationwide alert in July about fraud rings stealing federal student aid through fake enrollments. The Department of Education says it prevented $1 billion in fraud last year. The 2027-28 FAFSA just opened.
Last week, a Houston college graduate named Melanie Marti logged into her StudentAid.gov account and found a notification she did not expect: her FAFSA had been approved. She had not applied. Someone had taken over her account, obtained her transcripts, and filed a FAFSA in her name.
Her experience is part of a pattern large enough to prompt a federal response, and the institutions whose names appear on the fraudulent applications are absorbing the damage. In California in 2024, nearly one in three community college applications was flagged as likely fraudulent. On July 24, 2026, the Treasury Department’s Financial Crimes Enforcement Network issued a nationwide alert about organized fraud rings using stolen and synthetic identities to create “ghost students”: fabricated enrollees who exist only long enough to collect federal aid and disappear. The schemes target roughly $120 billion in student aid distributed annually to approximately 13 million Americans, and federal investigators have uncovered more than $350 million in ghost student fraud over the past five years.
The mechanics are straightforward. Fraud rings use stolen identities to enroll at institutions with open admissions and online programs, with AI-generated documents clearing verification and AI chatbots completing coursework to maintain the appearance of attendance. Once enrolled long enough to qualify for aid refunds, the money disappears through mule networks and cryptocurrency.
Why ghost student fraud is a university brand problem
The fraud does not just cost the federal government. It costs the institutions whose names are attached to it.
University impersonation was already a documented problem before the ghost student surge, with institutions seeing their names, logos, and web presence replicated by attackers for years. Ghost student fraud adds a new dimension: the university’s brand is not just being copied on a fake website. It is being used as the infrastructure through which federal money is stolen. When a ghost student enrolls at a community college using a stolen identity, that college’s name appears on the FAFSA, on the enrollment records, and on the disbursement. The institution becomes associated with the fraud whether it detected it or not.
The impersonation extends across multiple channels. Fake college websites replicate real universities down to program descriptions, faculty pages, and enrollment portals, and the Department of Education has warned that some exist solely to collect tuition payments and personal information. Phishing emails posing as financial aid offices create urgency around supposed disbursement problems to steal credentials and banking details. FSA ID harvesting campaigns impersonate the Federal Student Aid office to capture login credentials for StudentAid.gov, the same portal Melanie Marti discovered had been compromised in her name. And Bitdefender documented SMS campaigns in August 2026 impersonating government education programs, promising recipients between $6,500 and $8,000 in grants and routing them to credential harvesting pages that collect Social Security numbers, dates of birth, and banking information.
For the student who loses money or credentials to someone impersonating their university’s financial aid office, the distinction between the institution and the attacker blurs. The institution’s authority is what made the message believable, and the trust damage lands on the university’s brand long after the fraud is discovered.
The federal response and the FAFSA window
The federal response has been swift. Since April 26, the Department of Education has been screening every FAFSA in real time, flagging high-risk applications for identity verification through government ID and live camera checks, with roughly 300,000 previously submitted applications selected for heightened review. The House passed the No Aid for Ghost Students Act 249-172 on June 10, requiring identity fraud screening for every FAFSA submitted from October 1 onward, though the bill is still awaiting Senate action.
The timing matters. The weeks following the FAFSA opening are historically peak season for financial aid phishing, and families are now actively entering sensitive information into government systems and expecting communications from universities and aid programs, which is exactly the environment these campaigns exploit.
The Bottom Line
Ghost student fraud turns universities into unwitting participants in federal aid theft, and the brands those institutions have spent decades building are the collateral. The impersonation infrastructure, fake enrollment sites, phishing emails bearing university names, credential harvesting pages mimicking government portals, is detectable and removable. But only if someone is monitoring for it, and for most institutions, nobody is.
Key Takeaways
Ghost student fraud involves using stolen or synthetic identities to create fake student enrollments at educational institutions, file FAFSA applications, and collect federal financial aid refunds. FinCEN issued a nationwide alert about these schemes on July 24, 2026. Fraud rings use AI-generated documents to pass identity verification and AI chatbots to complete coursework. Federal investigators have uncovered over $350 million in ghost student fraud over the past five years.
Fake college websites built to collect tuition payments and personal information. Phishing emails impersonating university financial aid offices to steal credentials and banking details. FSA ID harvesting campaigns that impersonate the Federal Student Aid portal. SMS scholarship scams and education grant scams promising thousands of dollars to lure victims to credential harvesting pages. And student loan scam texts offering forgiveness programs that do not exist, which spike around FAFSA opening dates.
The federal student aid system distributes approximately $120 billion annually to roughly 13 million students. The Department of Education estimates it prevented about $1 billion in aid-related fraud in 2025. In California, nearly one in three community college applications in 2024 was flagged as likely fraudulent. FinCEN, the FBI, and the Department of Education’s Office of Inspector General are coordinating a national response.
The Department of Education has been screening every FAFSA application in real time since April 26, 2026, flagging high-risk submissions for identity verification through government ID and live camera checks. Approximately 300,000 applications were selected for heightened review. The House passed the No Aid for Ghost Students Act on June 10, 2026, requiring identity fraud screening for every FAFSA submitted from October 1, 2026 onward. The bill awaits Senate action.
Ghost student fraud turns universities into unwitting participants in federal aid theft. When a ghost student enrolls using a stolen identity, the institution’s name appears on the FAFSA, the enrollment records, and the disbursement. Fake college websites replicate real institutions to collect tuition and personal information. Phishing emails impersonate university financial aid offices to steal credentials. The trust students and families place in these institutional brands is what makes each of these attacks work, and the reputational cost lands on the university whether it detected the fraud or not.
