Revealed: How Kenyans got involved in US ‘ghost student’ Ksh97M fraud scheme

A US investigation into a nationwide student financial aid fraud scheme has exposed alleged networks linked to Kenyan nationals accused of exploiting stolen identities and fraudulent college applications to obtain taxpayer-funded education assistance.

The United States Department of Justice (DOJ) has announced indictments against five defendants in an investigation dubbed Operation Ghostbusters, along with the seizure of more than Ksh97.4 million in cryptocurrency.

US Assistant Attorney General Colin McDonald warned that authorities would pursue those involved regardless of their location.

“Today, we are announcing the first results of Operation Ghostbusters — a nationwide effort to stop a major fraud scheme targeting federal student aid, low-income Americans, and the American taxpayer,” McDonald said.

“The Department is charging five defendants and announcing the seizure of more than $750,000 in cryptocurrency tied to this scheme through a network associated with Kenyan nationals. This is the first international seizure of its kind in Kenya,” he added.

Ghost student fraud involves criminals using stolen or fabricated identities to register fictitious students at American colleges and universities to obtain financial assistance.

The scheme targets the US Federal Student Aid programme, which provides grants and loans to eligible students through applications submitted using the Free Application for Federal Student Aid (FAFSA).

Fraudsters exploit the system by submitting applications using personal information belonging to unsuspecting American citizens.

Once colleges enrol the fictitious students and approve their financial aid, they process tuition payments, releasing the remaining assistance as refunds.

The money is allegedly diverted into accounts controlled by criminal networks instead of reaching genuine students.

According to US investigators, the networks involve individuals performing different roles across countries, allowing the fraud to be coordinated remotely.

The operation begins with obtaining personal information belonging to US citizens. Criminals use the details to create accounts and submit financial aid applications without the knowledge or consent of the individuals concerned.

Fraudsters use stolen identities to enrol supposed students in American educational institutions, including through online learning platforms.

The DOJ says criminals have used artificial intelligence to maintain the appearance that fictitious students are participating in classes and completing coursework, allowing fraudulent accounts to remain active while financial aid is processed.

Individuals based in the US allegedly receive financial aid refunds through their bank accounts on behalf of the wider networks.

These intermediaries, known as money mules, reportedly retain an agreed portion before transferring the remaining funds to associates overseas.

Investigators say proceeds are transferred through bank accounts, money service businesses and cryptocurrency platforms to associates operating in Kenya.

Some Kenyan associates are allegedly connected to a purported local safari business used by the network.

The five defendants face charges arising from separate investigations in Virginia, Nebraska and New Jersey.

In Virginia, a Kenyan national was indicted over an alleged conspiracy involving more than Ksh181.9 million in intended student aid losses. Prosecutors say the defendant received over 700 fraudulent financial aid refunds totalling approximately Ksh187.1 million and facilitated transfers of at least Ksh168.9 million to accounts in the US and Kenya.

In Nebraska, Kenyan citizen Francis Mugambi was indicted on five counts of theft of government money and five counts of aggravated identity theft. Prosecutors allege he worked with associates in Kenya to steal American identities, fraudulently enrol students and redirect financial aid. He allegedly retained 30 per cent of the proceeds before sending the remainder to his associates.

In New Jersey, three defendants were charged over an alleged conspiracy to obtain more than Ksh129.9 million in federal student assistance using stolen identities. The money was allegedly transferred to Kenyan associates linked to a purported safari business.

All defendants are presumed innocent until proven guilty in court as US authorities pursue them.

The DOJ announced the seizure of more than Ksh97.4 million in cryptocurrency from an account belonging to a Kenyan national allegedly connected to the fraud network.

The operation was conducted with assistance from Kenyan law enforcement agencies and described as the first international seizure of its kind in the history of the DOJ’s National Fraud Enforcement Division.

Investigators also identified 830,840 potentially fraudulent student aid identification accounts associated with nearly Ksh16.9 billion in suspected fraud during September and October 2026.

The wider investigation estimates that ghost student schemes may have cost American taxpayers more than Ksh26 billion, with over 40 cases being pursued across 26 FBI field offices and more than 20 US attorney offices.

The investigation has expanded beyond American borders, with US authorities cooperating with Kenya’s Directorate of Criminal Investigations (DCI), Asset Recovery Agency (ARA) and Office of the Director of Public Prosecutions (ODPP).

The partnership is expected to support investigations, asset recovery, prosecution and possible extradition proceedings involving individuals suspected of coordinating the schemes from Kenya.

McDonald issued a further warning to suspects operating outside the US.

“If you steal American identities, if you steal taxpayer dollars, if you exploit programmes meant to help students build a future, we will find you. Whether you are in Nebraska, New Jersey, Virginia, or Nairobi, we will pursue you,” he said.

The investigation remains ongoing, with authorities examining fraudulent applications, financial transactions and international networks to identify additional suspects and recover public funds.