US prosecutors have charged five people over alleged student aid fraud that used stolen American identities to claim college funding and send some proceeds to Kenya. Some victims had never been to college, prosecutors say.
The US Justice Department (DOJ) announced the charges on 29th October 2026 under Operation Ghostbusters. The cases span Nebraska, Virginia and New Jersey. Investigators also announced the seizure of more than USD 750,000, or about KES 97,374,000, in cryptocurrency connected to the investigation. The amount seized is separate from the total alleged fraud.
The cases concern “ghost students”: fake college enrolments created with stolen identities to collect financial aid. Prosecutors identify two charged defendants as Kenyan. The other three defendants’ nationalities are not stated in the announcement, and all five remain presumed innocent.
How the aid refunds work
The alleged fraud exploits a legitimate feature of US student finance. Students apply for federal support through FAFSA, the Free Application for Federal Student Aid. That support can include loans, which must be repaid, and grants, which generally do not have to be repaid.
The money initially goes to the college. Once tuition and fees have been paid, any eligible balance is refunded to the student for other educational and living expenses.
In its July warning about student aid fraud, the US financial intelligence agency FinCEN describes criminals using stolen personal details to enrol fake students and divert those refunds. The identity belongs to the victim, while someone else controls the money.
FinCEN says intermediaries known as money mules can receive the payments and move them through other accounts, money-transfer services or cryptocurrency. For the person whose identity was used, the consequences can include debts they never applied for and problems obtaining genuine financial aid.
The warning also describes AI-generated documents and coursework completed by chatbots or paid people to keep fake students enrolled. These are methods identified across student aid fraud; the DOJ announcement does not establish which AI tools, if any, each defendant used.
The vulnerability predates generative AI. An Education Department inspector general report dated 26th September 2011 warned that fraud rings were exploiting online education and weaknesses in identity checks.
Where Kenya enters the cases
In Nebraska, Kenyan citizen Francis Mogambi is accused of retaining 30% of fraud proceeds and sending the rest to associates in Kenya. His indictment includes five counts each of theft of government money and aggravated identity theft, an offence involving the use of another person’s identity during certain crimes.
A separate Virginia indictment concerns an unnamed Kenyan national accused of receiving more than 700 fraudulent aid-refund deposits. Prosecutors say money subsequently moved to accounts in both the US and Kenya.
In New Jersey, Mabed Patricia Utate-Alberto, Patricia Arisleydi Perez and George Arturo Alfau Mendez were arrested on a criminal complaint. They allegedly received aid payments in US accounts, kept a share and transferred money to associates in Kenya connected to a purported safari company. Prosecutors say they intend to charge two Kenya-based associates as the investigation continues.
The DOJ names Kenya’s Directorate of Criminal Investigations, Asset Recovery Agency and Office of the Director of Public Prosecutions among its partners. Earlier this week, we covered Kenya’s participation in Operation Serengeti III, another international cybercrime operation.
The cases also raise questions about checks at online colleges and payment providers. The US Education Department introduced real-time identity screening within FAFSA on 26th April 2026. Applicants classified as high risk must present government identification and complete a live camera check. The department acknowledges that legitimate students can also be flagged.
The DOJ announcement does not name the safari company or identify the crypto platform involved in the seizure. It also does not give a complete total for money received in Kenya. Those details would help establish who received the proceeds and how the funds moved.
Join the discussion