As college students return to universities for the fall semester, a payment scam is lurking on campus.

Fraudsters are stealing identities or creating fake ones to create “ghost students.” These false identities apply for financial aid from a university or through the federal government. If the fraudster successfully bypasses university or government verifications, payments are disbursed and start moving through the financial system.

“That's where financial institutions really become a critical line of defense,” said Crystal Trout, a managing director focused on financial crime compliance in the tax and accounting firm Baker Tilly’s risk advisory practice. “The fraud has already happened, but it hasn't ended.”

The Treasury Department’s Financial Crimes Enforcement Network issued an alert July 24 warning payment processors and financial institutions “to be vigilant in detecting, identifying, and reporting suspicious activity connected to fraud schemes targeting [the Education Department’s] Office of Federal Student Aid (FSA) programs.” 

That followed an announcement in April in which the Education Department implemented real-time identity fraud detection within the Free Application for Federal Student Aid form, better known as FAFSA. The department cited a “need to respond to the significant scale of recent fraud activity” as the reason for the implementation.

The Education Department said it intercepted $1 billion in attempted financial aid theft last year. 

Signs of a scam

Student aid scams occur in a variety of ways. Fraudsters can assume fake identities and pose as students applying for admission and student aid. They sign up for classes and aid, but once they receive payment, they disappear, said Emily Griffin, director of the financial crimes practice for the credit rating agency Moody's, in its analytics unit. Students need to remain enrolled for at least 60% of the enrollment period to receive aid, so fraudsters have worked around this requirement by using artificial intelligence to complete coursework, FinCEN said.

“Straw students” are another type of scheme. The individuals give their personal information to fraudsters, and the scammers enroll in universities and collect financial aid issued in the complicit students’ names, according to the FinCEN alert. Straw students may keep a portion of the aid, incentivizing them to participate in the scheme. 

Another way is that a scammer deceives a student or parent into sending a payment directly to them. Bad actors may set up a fake payment portal, making it look like the student or parent is paying the university, but it’s actually just a way for scammers to obtain their payment information, said Griffin.

Jen Martin, head of consumer fraud and claims at Citizens Bank, said the fraud primarily targets the Federal Student Aid program, which sends about $120 billion in funding each year. Individual universities are seeing fraud and funds loss as well, according to Griffin, as are state and city colleges.

The increase in online education has opened more doors to fraud, and AI is only making the situation worse, Griffin said. Groups can execute more high-scale attacks, using AI agents to repeatedly replicate an application process. 

“That allows them to blitz the system,” by submitting so many applications that it overwhelms the application portal, she said. 

Tuition payments have also evolved. PayPal announced last month that its peer-to-peer payment tool, Venmo, has directly integrated with some schools' payment portals, meaning that students and parents have the option to pay for tuition using Venmo. Schools such as Kansas State University and Michigan State University were among the initial participants.

While the inherent speed of P2P payments isn’t an issue, monitoring and risk controls need to operate at the same speed, Trout said. 

The stakes are high if a scammer succeeds. Not only are funds for students in need of financial aid lost, but “these fake students are taking up a seat in classes and in programs that real students could be missing out on,” Griffin said. 

There’s also compliance risk for higher education institutions, said Patrick Beirne, senior director, bursar and student financial services at Wayne State University in Detroit. Schools are responsible for safeguarding Title IV aid, which can include programs like Pell Grants and work-study funding.

Wayne State witnessed an increase in ghost student activity about a year and a half ago, but over the last year, the university has implemented more safeguards, which has led to “significantly decreased activity,” according to Beirne. One safeguard has been to verify identity when someone enters the institution, then verify it again when the student receives the funds. This process “has been highly effective” in cutting down fraud, he said.

The university looks for red flags like a large group of students taking the same classes, registering at the same time or using the same bank account for direct deposit. When it identifies something that may be a ghost record, Wayne State suspends access immediately and drops the registration, Beirne said. If the government has already disbursed aid, the university returns the funds to the federal program and reports the suspected fraud to the Education Department's Office of Inspector General.

Banks and payments providers can aid university investigations by giving context when they flag or reject an activity, Beirne said. That way, “campus teams can determine what happened and respond quickly.”

Banks increase their vigilance

For higher education lending, Citizens Bank monitors the origins of student accounts, uses validation tools, and monitors funds disbursement and usage, Martin said. The bank ensures money movement is consistent with what would be expected of a student profile. 

Other suspicious signals include deposits under an unrelated name or geographic mismatches — such as a student living in New York receiving aid from a California community college, Griffin said.

When an account holder converts funds entering an account into cash almost immediately, “that definitely deserves additional scrutiny,” Trout said.

The FinCEN alert also pointed to other warning signs, such as a newly established account funded exclusively with student aid refunds and with no other financial activity; multiple students using the same account for aid deposits; or several accounts created online in a short time frame. 

Trout, Griffin and Beirne all called for a collective and collaborative effort to mitigate fraud, suggesting that government agencies, higher education, fintech, banks and payment processors could pool resources to spot patterns that indicate ghost student scams. FinCEN’s alert “strongly encourages” financial institutions to share information with each other, as permitted via the safe harbor from liability under the Patriot Act.

“No single organization has visibility into the entire fraud life cycle,” Trout said. “If we start sharing intelligence and really coordinate, I think that's when we can start seeing — not just education fraud cases, but fraud as a whole — really reduce.”