On July 24, 2026, FinCEN issued an Alert urging financial institutions to detect, prevent, and report suspicious activity connected to fraud schemes targeting student aid programs administered by the Federal government. According to FinCEN, fraud rings use stolen and fraudulent identities and other tactics to unlawfully acquire funds from Federal student aid programs, resulting in losses to Federal student aid programs and real students facing difficulties enrolling in classes.
As described in the Alert, fraud rings exploit Federal student aid programs using one of the following schemes:
Fraudsters steal personally identifiable information to create “ghost students”. Fraudsters create "ghost students" by using stolen personally identifiable information (PII) to impersonate legitimate students or by generating synthetic identities that combine stolen PII with fabricated information to bypass identity verification. Victims, including minors, are typically unaware that their identities are being used to obtain federal student aid.
Fraud rings leverage complicit “straw students” to obtain federal student aid. Straw students are individuals who knowingly provide their personal information to fraudsters in exchange for payment, allowing fraudsters to enroll them in school and collect federal student aid refunds. In some cases, corrupt school employees facilitate these schemes by recruiting straw students and manipulating educational records.
In addition, corrupt staff at educational institutions can act as insiders for fraud schemes, taking advantage of their positions to defraud Federal student aid programs.
Fraudsters involved in ghost or straw student schemes often direct federal student aid refunds to accounts with no apparent connection to the named student, with payments commonly received through ACH transfers from educational institutions or their payment intermediaries. After obtaining the refunds, the funds are often laundered through money mules, shell companies, or fraudulent accounts.
FinCEN has identified the following red flag indicators to help financial institutions detect, prevent, and report potentially suspicious activity related to Federal student aid fraud:
A customer who has no previous history of, or customer profile information that would be consistent with, enrollment at an educational institution receives a student aid refund, especially where the stated recipient of the refund listed in the transaction reference is an individual with no known connection to the customer. These funds are then rapidly transferred to another account via P2P or wire transfers, used to purchase digital assets, or used in transactions with online money services businesses that typically process international funds transfers.
A customer uses funds received from a student aid refund to quickly purchase digital assets, which the customer then rapidly transfers to another digital asset wallet for no business or apparent lawful purpose.
Multiple unrelated students use the same account for the deposit of federal student aid refunds.
A customer’s account receives multiple student aid refunds, for no business or apparent lawful purpose, especially if the stated recipients listed in the transaction reference are unrelated individuals with no known connections to the customer. These funds may then be rapidly transferred to other accounts via P2P or wire transfers, used to purchase digital assets, or used in transactions with online money services businesses that typically process international funds transfers.
A newly established customer account is funded solely by student aid refunds and lacks other financial activity. These funds may then be rapidly transferred, in whole or part, via P2P or wire transfers to other accounts, used to purchase digital assets, or used in transactions with online money services businesses that typically process international funds transfers.
A business account receives multiple student aid refunds—especially if the stated recipients listed in the transaction reference are individuals with no known connections to the customer— for no business or apparent lawful purpose. These funds may be rapidly transferred to other accounts held by business entities or used in transactions with online money services businesses that typically process international funds transfers.
A customer receives multiple P2P or wire transfers from accounts that recently received student aid refunds, for no business or apparent lawful purpose.
Multiple accounts that receive a student aid refund are accessed from the same out-of-state or international IP address or the same device.
Multiple accounts are created online within a short timeframe at a financial institution and receive student aid refunds on a one-to-one basis (i.e., one account receives one refund). These funds, in whole or part, may be rapidly transferred to other accounts via P2P or wire transfers, used to purchase digital assets, or used in transactions with online money services businesses that typically process international funds transfers.
FinCEN’s press release can be found here.
The full Alert can be found here.