US Government Launches Investigation into FAFSA Fraud Involving Fake Students and Stolen American Identities, Warns Kenyan Suspects
The United States government has intensified its crackdown on a suspected international financial aid fraud network linked to Kenyan nationals accused of using stolen American identities to obtain millions of dollars in government-funded student loans and grants.
The investigation, conducted under an operation dubbed Operation Ghostbusters, targets individuals allegedly creating fictitious students and enrolling them in American colleges and universities to access federal education assistance.
US authorities say the suspects exploited the Federal Student Aid programme by submitting fraudulent applications using personal information belonging to unsuspecting American citizens. The money was allegedly obtained through student financial aid refunds before being transferred to bank accounts controlled by criminal networks, including associates operating outside the United States.
On Thursday, October 29, 2026, the US Department of Justice announced the first major enforcement actions arising from the investigation. Authorities revealed that five defendants had been charged across three federal districts and that more than $750,000, approximately KSh97 million, in cryptocurrency had been seized from an account belonging to a Kenyan national connected to the alleged scheme.
The announcement also carried a strong warning to individuals suspected of participating in the fraud, particularly those believed to be operating from outside the United States.
Assistant Attorney General Colin M. McDonald, who heads the Justice Department’s National Fraud Enforcement Division, said American authorities would pursue individuals regardless of where they were hiding.
“If you steal American identities, if you steal taxpayer dollars, if you exploit programs meant to help students build a future — we will find you. Whether you are in Nebraska, New Jersey, Virginia, or Nairobi, we will pursue you,” McDonald warned.
The statement signals a growing determination by American law enforcement agencies to pursue international financial crimes through cooperation with foreign governments and investigative institutions.
How the alleged FAFSA fraud scheme operated
At the centre of the investigation is the Free Application for Federal Student Aid, commonly known as FAFSA.
The programme is administered by the US Department of Education and allows eligible students to apply for financial assistance to support their higher education.
Through the programme, qualifying students can access different forms of financial support, including federal grants and loans. The assistance is intended to help students from different financial backgrounds meet the costs of attending colleges and universities.
However, investigators allege that criminal networks discovered ways to exploit the system by creating applications for individuals who were not genuine students.
The suspects allegedly obtained personal information belonging to American citizens and used it to establish fraudulent Federal Student Aid accounts.
Using the stolen identities, they reportedly submitted applications and enrolled fictitious students in colleges and universities across the United States.
These individuals, commonly described as ghost students, were allegedly presented as genuine applicants seeking financial assistance despite not actually intending to pursue their studies.
Once the applications were approved and the institutions processed the financial aid, tuition payments were deducted before the remaining funds were released as refunds.
Investigators allege that the refunds were subsequently diverted into bank accounts controlled by the criminal network.
The money was then allegedly moved through different financial channels, including bank transfers and cryptocurrency transactions, making it possible to transfer proceeds to associates operating overseas.
The US Department of Justice says some of the alleged schemes involved American-based money mules who received the fraudulent financial aid refunds before forwarding the money to their foreign associates.
The investigation suggests that the operation relied on individuals performing different roles across several locations, allowing the alleged fraud to continue while making it difficult to identify the people ultimately controlling the proceeds.
Investigators uncover more than $200 million in suspected fraud
The scale of the investigation has raised serious concerns within the US government, with authorities estimating that the wider ghost student fraud schemes could have caused losses exceeding $200 million.
According to the Federal Bureau of Investigation, investigators have so far identified more than $32 million in losses from similar ghost student schemes, with additional cases and suspected losses still under investigation.
The figures demonstrate the extent to which criminals can exploit digital financial systems and government assistance programmes when they obtain access to sensitive personal information.
The Justice Department also revealed that investigators identified approximately 830,840 potentially fraudulent Federal Student Aid identification accounts associated with nearly $130 million.
Following the discovery, investigators recommended that the Department of Education disable the potentially fraudulent accounts during September and October 2026.
The action was intended to prevent suspicious accounts from being used to obtain additional financial assistance while investigations continued.
Authorities believe the suspected fraud has been taking place since at least 2021, with community colleges and universities across the country identifying suspicious applications and financial aid refunds.
The investigation has expanded beyond individual cases into a nationwide effort involving more than 40 open cases across 26 FBI field offices and more than 20 US Attorneys’ Offices.
This demonstrates that Operation Ghostbusters is not limited to one university, state or group of suspects. Instead, investigators are examining a broader network of individuals allegedly exploiting the federal student assistance system.
Kenyan nationals allegedly played key roles in the network
One of the most significant aspects of the investigation is the alleged involvement of Kenyan nationals in the suspected international fraud network.
According to the Justice Department, investigators uncovered connections between individuals operating in Kenya and associates based in the United States.
In one case involving the District of New Jersey, prosecutors allege that three defendants conspired with individuals located in Kenya to obtain more than $1 million in federal student assistance through fraudulent applications.
The American-based defendants allegedly acted as money mules, receiving funds through US bank accounts before transferring the proceeds overseas after retaining a portion of the money.
The Justice Department identified the three defendants as Mabed Patricia Utate-Alberto, also known as Mabed Alberto Utate, Patricia Arisleydi Perez and George Arturo Alfau Mendez, also known as George Alfau.
All three were arrested following the filing of a criminal complaint.
According to prosecutors, two additional co-conspirators located in Kenya are associated with a purported Kenyan safari company. American authorities indicated that they would seek to charge the Kenyan-based individuals as the investigation progresses.
Another case involves a Kenyan national charged in the Eastern District of Virginia.
According to the indictment, the individual allegedly conspired with fraudsters in Kenya to obtain and use stolen American identities to submit fraudulent FAFSA applications.
The suspect allegedly acted as a money mule in the United States and used multiple bank accounts across different financial institutions to receive more than 700 fraudulent federal student aid refund deposits.
The deposits reportedly totalled approximately $1.44 million.
Investigators further allege that the suspect conducted thousands of wire transfers and money service transactions, moving at least $1.3 million through accounts in the United States and Kenya.
The case illustrates how investigators believe financial aid fraud proceeds were moved across borders using multiple accounts and transaction channels.
Kenyan citizen Francis Mogambi charged in Nebraska
Another major development involves Francis Mogambi, a Kenyan citizen charged in the District of Nebraska.
According to the Justice Department, a federal grand jury returned a ten-count indictment against Mogambi on October 19, 2026.
He faces five counts of theft of government money and five counts of aggravated identity theft.
Prosecutors allege that between November 2025 and May 2026, Mogambi fraudulently obtained federal student financial assistance using stolen identities belonging to American citizens.
The indictment further alleges that he worked with associates in Kenya to obtain personal information belonging to US citizens, use the identities to fraudulently enrol the victims in educational institutions and redirect federal student aid payments.
According to the prosecution, Mogambi allegedly retained 30 per cent of the proceeds and transferred the remaining money to associates in Kenya.
Court documents cited by the Justice Department also allege that he attempted to recruit another individual into the scheme.
Investigators claim he openly discussed aspects of the alleged operation, including receiving approximately $2,000 weekly and seeking to establish a business that could help him cash larger cheques without attracting tax obligations.
Mogambi was arrested after being charged and detained pending trial following a court assessment of his risk of non-appearance and the potential threat he posed to the public.
The Justice Department also disclosed that Mogambi entered the United States on May 15, 2024, after winning the Diversity Visa lottery and was subsequently issued a permanent resident card.
The charges against him form part of the wider investigation into the alleged exploitation of American financial assistance programmes.
US authorities seize KSh97 million in cryptocurrency
The seizure of more than $750,000 in cryptocurrency represents another important development in the investigation.
The Justice Department described the recovery as the first international seizure of its kind in Kenya in the history of its National Fraud Enforcement Division.
The seizure followed cooperation between American investigators and Kenyan law enforcement agencies.
According to the US government, representatives from the Justice Department’s Fraud Division and partner agencies visited Kenya in September 2026 to discuss cooperation on extradition, prosecution and the recovery of assets allegedly stolen from American taxpayers.
The visit also focused on strengthening collaboration between the two countries in tackling financial crimes involving digital assets and international money transfers.
Investigators subsequently received assistance and intelligence from Kenyan law enforcement partners, which helped them identify and seize cryptocurrency connected to the alleged fraud.
The recovery demonstrates the increasing importance of international cooperation in investigating financial crimes involving digital currencies.
Unlike traditional bank transfers, cryptocurrency transactions can involve multiple digital wallets and platforms operating across different jurisdictions.
However, investigators can use blockchain analysis, financial intelligence and information from cryptocurrency service providers to trace suspicious transactions and identify individuals associated with particular accounts.
The US government says it intends to continue following the money and pursuing individuals suspected of participating in the network.
Kenyan agencies join the American investigation
The investigation has also brought several Kenyan institutions into the international enforcement effort.
The Justice Department confirmed that its operation involves cooperation with Kenya’s Directorate of Criminal Investigations, the Asset Recovery Agency and the Office of the Director of Public Prosecutions.
The agencies are expected to support investigative activities, financial tracing, asset recovery and possible prosecution of individuals found to have participated in criminal activities within their respective jurisdictions.
The involvement of Kenyan institutions is particularly important because some of the alleged proceeds were reportedly transferred to individuals and accounts in Kenya.
Investigators may need to establish the identities of people receiving the money, examine financial transactions and determine whether assets were acquired using proceeds from the suspected fraud.
The two countries may also rely on established legal cooperation mechanisms when pursuing suspects, seeking evidence or requesting the recovery of assets located outside their respective territories.
The Justice Department has emphasised that it intends to work with international partners to recover American taxpayer money and bring individuals hiding abroad to justice.
For Kenya, the case highlights the growing importance of cooperation with foreign law enforcement agencies as cybercrime and financial fraud increasingly cross national borders.
Why the investigation matters to American students and taxpayers
The alleged scheme has raised concerns because it targets financial assistance programmes designed to support students who genuinely need help accessing higher education.
Federal student aid plays an important role in helping millions of Americans meet the costs of college and university education.
When criminal networks obtain money through fraudulent applications, the funds are diverted from their intended beneficiaries.
The US government argues that every dollar stolen from the programme is money that cannot be used to support a genuine student.
The scheme also creates additional administrative costs for educational institutions and government agencies, which must spend resources identifying fraudulent applications, investigating suspicious transactions and recovering money.
There is also the problem of identity theft.
American citizens whose personal information was allegedly used to create ghost student accounts may discover that applications or educational records have been generated in their names without their knowledge.
Some victims may have never attended college but could find themselves associated with institutions they have never visited.
Such cases can create confusion and potentially affect personal financial records, credit histories and future applications for education assistance.
The FBI says investigators have encountered victims who were surprised to learn that their identities had allegedly been used to enrol them in colleges hundreds of miles away.
The government has therefore urged individuals who believe their identities may have been compromised to report the matter through the Department of Education’s Office of Inspector General.
Government tightens controls on student financial aid
Operation Ghostbusters also comes amid increased scrutiny of the systems used to distribute federal student assistance.
The discovery of hundreds of thousands of potentially fraudulent identification accounts has prompted authorities to review how applicants are verified and how institutions monitor student participation.
The Department of Education is expected to continue working with law enforcement agencies and educational institutions to identify suspicious applications and prevent fraudulent payments.
The investigation has also highlighted the need for stronger identity verification procedures and improved monitoring of financial aid disbursements.
Colleges and universities play an important role in identifying suspicious applications because they are involved in confirming enrolment and processing financial assistance.
Institutions must therefore ensure that applicants are genuine students and that financial aid refunds are released through legitimate procedures.
Authorities are also examining how technology, including artificial intelligence tools, may have been exploited to make fictitious students appear active in online learning environments.
The Justice Department alleges that some fraudsters used artificial intelligence to complete coursework and maintain the appearance that ghost students were participating in their studies.
This suggests that the investigation is not only about stolen identities but also about the exploitation of digital education systems.
As universities increasingly rely on online learning and automated administrative processes, the government faces the challenge of ensuring that technology is not abused to obtain public funds illegally.
A warning to suspected fraudsters operating from Kenya
The warning issued by Assistant Attorney General Colin McDonald has placed individuals suspected of participating in the alleged scheme on notice that their geographical location will not necessarily protect them from investigation.
By specifically mentioning Nairobi alongside American cities, the Justice Department made clear that it intends to pursue alleged international conspirators beyond US borders.
The seizure of cryptocurrency linked to a Kenyan national further demonstrates that investigators are already working with local authorities to trace suspected proceeds and identify individuals connected to the network.
The operation could therefore lead to additional charges, arrests and asset recovery actions as investigators examine more financial transactions and identify other suspected participants.
However, the announcement of charges against five defendants does not mean that every Kenyan national associated with the investigation has been charged or found guilty.
The Justice Department has indicated that investigations remain ongoing and that further enforcement actions may follow.
All individuals facing charges are entitled to due process, and the allegations must be established in court.
What happens next?
Operation Ghostbusters is expected to continue as American investigators examine suspected fraudulent applications, financial transactions and connections between individuals operating in different countries.
The Justice Department has indicated that it will continue working with Kenyan law enforcement agencies to trace the proceeds of the alleged fraud, recover assets and pursue individuals suspected of involvement.
The investigation may also result in additional criminal charges as prosecutors examine evidence gathered across the different federal districts.
For Kenya, the case serves as a reminder that financial and cyber-related crimes can have international consequences, particularly when stolen identities and government assistance programmes are involved.
It also demonstrates how international cooperation can help investigators follow money across borders and identify individuals allegedly involved in complex financial schemes.
Ultimately, the success of Operation Ghostbusters will be measured by the ability of authorities to establish responsibility, recover stolen public funds and prevent similar schemes from exploiting vulnerable citizens and government programmes.
As the investigation expands, the message from Washington is clear: American authorities intend to pursue those suspected of stealing taxpayer-funded student assistance, even when the alleged activities extend as far as Nairobi.
