Ghost Students...Real Risk. FinCEN Warns of Student Aid Fraud Schemes Targeting Colleges and Universities

On July 24, 2026, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network issued FIN-2026-Alert004, in conjunction with the Department of Education’s Office of Inspector General and the FBI, regarding fraud schemes targeting federal student aid. Although FinCEN's alert is directed primarily to financial institutions and their fraud-reporting obligations, it contains valuable guidance for colleges and universities, as many of the fraud indicators arise during the admissions, enrollment, and student aid administration processes.

As back-to-school season gets underway, be sure to keep these three main types of student aid fraud on your radar.  

1. Ghost Students – People who enroll using fraudulent or stolen identities and enroll in courses, often participating just enough to remain enrolled and trigger aid disbursements, sometimes using AI-generated submissions or other automated tools to avoid detection.
2. Complicit Students – People who knowingly allow their identities to be used for fraud. These “straw students” collude with fraudsters for a fee, allowing fraudsters to enroll in educational institutions and collect refunds in their names, with no intent of attending courses.
3. Insider Fraud – Staff taking advantage of their insider knowledge. Employees, particularly those in admissions or financial aid, may recruit straw students to ensure their acceptance and aid qualification.

The increasing availability of AI-enabled identity and content-generation tools may make certain fraud schemes more difficult to identify and investigate. To make sure you aren’t caught unaware, be on the lookout for:

• Unusual enrollment patterns or significant increases in applications from unexpected geographic regions

• Same information used for multiple unrelated accounts. This might look like:

• • Multiple refunds going to the same bank account
  • Multiple students using the same home address, but without any reason to believe they are related or legitimate roommates
  • The same names and identity documents being used for multiple students

• Student aid refunds, but no other financial activity
• Rapid fund transfers, particularly to digital assets, such as cryptocurrency or non-fungible tokens (NFTs)
• Multiple accounts accessed from the same IP address, particularly if it is international
• Multiple accounts created online in a short timeframe

Beyond financial losses, fraudulent enrollments can create operational challenges for institutions. Some colleges have reported courses filling with fraudulent students, making it more difficult for legitimate students to register for classes and increasing administrative burdens on admissions, registrar, information technology, and financial aid personnel.

Now, if you come across suspected student aid fraud, where do you even start? Here are some considerations:

1. Consult institutional leadership and counsel regarding appropriate reporting obligations and whether notification to law enforcement or regulatory authorities is warranted.
2. Coordinate with affected financial institutions, loan servicers, and payment processors as appropriate. Financial institutions may have independent obligations to file Suspicious Activity Reports under the Bank Secrecy Act.
3. Consider reporting suspected fraud to the U.S. Department of Education Office of Inspector General through its fraud-reporting channels.
4. Evaluate whether federal student aid regulations require the return of funds, including compliance with Return of Title IV Funds (R2T4) requirements where applicable.
5. Review potentially applicable cyber, crime, errors and omissions, or other insurance coverage and provide timely notice where coverage may be implicated.

For those institutions that wish to be proactive in this area, consider providing information on your website for people who may be victims of student aid fraud. Consider providing information on how to report suspected fraud to your institution, credit reporting agencies, and steps they may take if they believe they are a victim of identity theft.

Institutions should also consider whether suspected fraud involves identity theft, unauthorized access to institutional systems, misuse of personal information, or other cybersecurity concerns that may trigger additional internal investigation and compliance obligations.

This article does not constitute legal advice, so if this situation arises on your campus, please contact legal counsel to discuss your specific situation.