DOJ Charges Five and Seizes $750,000 in Crypto in 'Operation Ghostbusters' Student-Aid Fraud Crackdown

Since the Treasury Department's Financial Crimes Enforcement Network warned banks about student-aid refund fraud in July, federal agencies have steadily built toward a prosecutorial push. It arrived Thursday, when Assistant Attorney General Colin McDonald announced the first results of "Operation Ghostbusters" at a news conference in Alexandria, Virginia.

McDonald runs the Justice Department's National Fraud Enforcement Division. He said five defendants are charged and that investigators seized more than $750,000 in cryptocurrency tied to a network associated with Kenyan nationals. He called it the first international seizure of its kind in Kenya.

"These are not isolated errors," McDonald said. "This is organized fraud at scale."

How the scheme works

The alleged method is simple in outline. Criminals steal the identities of real Americans, often people who never went to college, and use them to create fraudulent Free Application for Federal Student Aid (FAFSA) accounts and enroll "ghost students" at schools.

The Education Department sends the aid to the school. After tuition and fees come out, the leftover money goes to bank accounts the fraudsters control. According to the Justice Department, the refunds were diverted to accounts controlled by foreign actors and facilitated by U.S.-based money mules, including Kenyan nationals.

McDonald said some rings use artificial intelligence to fill out applications and complete coursework. Others create the appearance of a fake student in an online classroom so schools believe a real person is present. The aim, he said, is to keep the ghost student in school for as long as possible, "semester after semester after semester."

He described one victim: a man who went to work out of high school to support his family, never applied to college, and later found a loan in his name from a school hundreds or thousands of miles away. "His credit is now at risk, and his name is on the bill," McDonald said.

The charges

In Nebraska, a federal grand jury indicted Francis Mogambi, identified as a Kenyan national, on charges of theft of government money and aggravated identity theft, McDonald said.

In New Jersey, three residents are charged with conspiracy to commit wire fraud in a scheme tied to $1.3 million in Education Department money, NJ.com reported. The charges allege they acted as money mules and moved most of the cash to accounts of two people tied to a Kenyan safari company. Lawyers for the three were not yet listed, the outlet reported. Prosecutors also described a Nairobi safari company as one of the fronts used to move funds.

The Justice Department's announcement says the three New Jersey defendants have been arrested pursuant to a criminal complaint, and that two co-conspirators located in Kenya are associated with a safari company. The government says it will seek to charge those co-conspirators as the case continues.

In the Eastern District of Virginia, a federal grand jury returned a multi-count indictment charging a Kenyan national with conspiracy to commit wire fraud and student aid fraud, according to the Justice Department. It alleges the defendant acted as a U.S.-based money mule in a scheme to steal over $1.4 million in student aid.

The U.S. Attorney's Offices for the Eastern District of Virginia, Nebraska and New Jersey joined the announcement. All charges are allegations, and every defendant is presumed innocent unless proven guilty.

McDonald said the Justice Department has sent a team to Kenya to work the case on the ground.

What is proven and what is estimated

The operation covers more than 40 open cases across 26 FBI field offices. Investigators believe the scheme has operated since at least 2021, "potentially reaching several hundred million dollars" in taxpayer losses, McDonald said. That is an estimate, not a tally.

The documented figure is smaller. FBI Assistant Director Heith Janke of the Criminal Division said the bureau has identified more than $32 million in losses, with millions more suspected, in similar ghost-student schemes.

Treasury has its own number. FinCEN told Fox Business it identified approximately $270 million in suspicious activity across more than 20,000 potentially suspicious transactions dating back to February 2026. Financial institutions have filed nearly 100 suspicious activity reports since the July alert. Treasury said those figures reflect activity reported by financial institutions and do not represent the full scope of student aid fraud, and that FinCEN provided the information to law enforcement as tip-and-lead material. Suspicious activity is not proven fraud.

The stakes are large. The federal student aid program is $131 billion a year, according to the FinCEN alert. Education Under Secretary Nicholas Kent said the department has saved taxpayers more than $2 billion in attempted student aid theft under President Trump and Secretary Linda McMahon.

Why it scaled

FinCEN's alert separates two patterns. In ghost-student cases, the identity is built from stolen personal information, sometimes with AI to defeat verification. In straw-student cases, real people knowingly hand over their own information for a fee and the fraudsters collect the refunds.

Jason Williams of the Education Department's Office of Inspector General has pointed to the pandemic shift to online learning as the turning point. "When the pandemic [hit], everybody went to online learning. Well, by doing that, it really did open the door," he said. Remote enrollment removed in-person verification checkpoints that once made large-scale identity fraud harder to pull off.

What comes next

McDonald framed Thursday as the opening round. "This is not the end of Operation Ghostbusters," he said. "This is just the beginning." He added: "Whether you are in Nebraska, New Jersey, Virginia, or Nairobi, we will pursue you."

What remains open is how much of the several-hundred-million-dollar estimate investigators can tie to specific defendants and accounts. For now, the FBI's identified figure sits at $32 million, against 40-plus open cases and a team working in Kenya.