A Wisconsin man discovered a student loan on his credit report for Colorado Technical University, a school he said he had never attended. A police investigation later linked the unauthorized enrollment to college-aid checks that were allegedly deposited into another man’s bank accounts.
His experience is one example of the identity theft at the center of Operation Ghostbusters. On October 29, 2026, the Justice Department announced its first five defendants across federal cases in Nebraska, New Jersey and Virginia, along with the identification of 830,840 potentially fraudulent Federal Student Aid login IDs linked to nearly $130 million in aid.
Investigators say stolen identities were used to enroll people in online colleges and obtain federal grants or loans. After the schools received tuition and fees, refunds were allegedly sent to accounts controlled by people involved in the schemes rather than the people whose identities appeared on the applications.
The crackdown also includes a cryptocurrency seizure exceeding $750,000 with assistance from Kenyan authorities. The FBI separately says it has identified more than $32 million in losses in similar ghost-student schemes, while the nearly $130 million tied to flagged accounts has not been established as a confirmed theft total.
A Student Loan Appeared for a College He Had Never Attended
In a sworn Lincoln Police affidavit later submitted in federal court, an investigator described interviewing the Wisconsin man on July 10. The man said the unfamiliar student loan was how he learned of an enrollment at Colorado Technical University. He told police he had never enrolled, requested the aid or authorized Francis Smith Mogambi to cash a check issued in his name.
An Ohio man said a Grand Canyon University loan appeared on his credit report when he tried to buy a condominium, while a New York resident learned of a separate enrollment when he applied for a personal loan. Both said they had not authorized the borrowing, according to the affidavit.
A Roommate Reported Suspicious College Checks and Shared a Recording
The Nebraska investigation began in April 2026, when Mogambi’s roommate reported that checks from colleges were arriving in the names of other people. The roommate told investigators that Mogambi had discussed working with associates in Kenya to obtain stolen identities, enroll people in schools and cash the resulting checks.
According to the affidavit, the roommate shared a recording in which Mogambi allegedly discussed receiving roughly $2,000 a week and sending 70% of the proceeds overseas. Police obtained bank records and identified payments from institutions including Grand Canyon University, American Public University System, Colorado Technical University, Ultimate Medical Academy and Chemeketa Community College. The investigator reported $20,397 in known forged checks.
A Nebraska Indictment Lists Ten Federal Charges
A federal indictment filed October 20 in the District of Nebraska charges Mogambi with five counts of theft of government money and five counts of aggravated identity theft. The alleged transactions in the theft counts occurred between February and May 2026. The charging document identifies specific transactions, including a $1,954 student-aid payment in February and a $3,004 payment in April.
Mogambi was detained pending trial following an October 26 hearing. In its detention order, the court found that no release conditions would reasonably assure his appearance, citing factors including ties outside the United States and an unstable residential situation.
Three New Jersey Defendants Were Linked to Hundreds of Student Identities
In New Jersey, Mabed Patricia Utate-Alberto, Patricia Arisleydi Perez and George Arturo Alfau Mendez face a wire fraud conspiracy allegation. An FBI agent’s amended criminal complaint, filed October 20, describes bank accounts associated with Utate-Alberto receiving more than $1 million in student-aid refunds tied to over 300 purported students. The same complaint identifies more than $250,000 deposited into accounts associated with Perez and linked to at least 88 identities, and more than $119,187 in accounts associated with Alfau Mendez and linked to over 40.
Bank Transfers and a WhatsApp Screenshot Pointed Toward Kenya
The New Jersey complaint traces a July 28, 2023 deposit of approximately $2,351 in student aid into an Alfau Mendez account. Later that day, about $2,141 was transferred to a Commercial Bank of Africa account associated with a purported Kenyan safari business, according to the FBI agent’s account.
Payment company Wise questioned repeated international transfers involving Utate-Alberto. She described herself as a local agent collecting payments for a Kenyan tourism business and supplied invoices, but the FBI agent said an employment-record review found no connection between her work history and the travel industry.
The complaint also reproduces an October 2025 WhatsApp message that calculated deductions from a $250 receipt and stated that $226.51 would be sent through MoneyGram, with a $5.99 fee. The FBI agent interpreted the message as a discussion of how student-aid proceeds would be distributed and alleged that Perez subsequently made the transfer.
DOJ Announced New Charges and a Nationwide Aid-Fraud Investigation
Besides the Nebraska and New Jersey proceedings, prosecutors reported an October 21 indictment in Virginia, under seal at the time of the announcement, involving more than 700 allegedly fraudulent aid refunds totaling approximately $1.44 million. Officials said at least $1.3 million was transferred onward through accounts in the United States and Kenya.
DOJ says the wider effort involves more than 40 active cases across 26 FBI field offices. Officials also described fraudsters using artificial intelligence to make online coursework or attendance appear legitimate in some schemes. Investigators recommended that the Education Department disable the flagged Federal Student Aid IDs.
What to Do if a Student Loan Appears in Your Name
Someone who discovers a loan for a college they never attended can check their federal aid history through StudentAid.gov and contact the loan servicer. The Education Department’s Office of Inspector General advises people whose identities were used for federal aid to report the matter to its hotline, contact the credit bureaus about freezes and file an identity-theft report through IdentityTheft.gov.
Federal Student Aid also provides a false-certification loan-discharge application for eligible borrowers whose identities were stolen. A person seeking discharge must provide the required information and documentation for review. Keeping credit reports, loan notices, school-enrollment records and correspondence with the servicer can help establish that the borrowing was unauthorized.