The Treasury Department’s Financial Crimes Enforcement Network (FinCEN) has issued an Alert “urging financial institutions to detect, prevent, and report suspicious activity connected to fraud schemes targeting student aid programs administered by the Federal government.”
“Every dollar stolen from Federal student aid is a dollar taken from taxpayers and deserving students,” said Secretary of the Treasury Scott Bessent.
“Fraud rings use stolen and fraudulent identities, as well as other tactics, to enroll in educational institutions and unlawfully acquire funds from Federal student aid programs,” according to FinCEN officials. “The schemes not only result in losses to Federal student aid programs, but in some cases, real students face difficulties enrolling in classes because of the number of fraudulently enrolled ‘students.’”
They said that the Education Department has launched an “effort to prevent fraud in Federal student aid programs to protect taxpayers while significantly reducing associated administrative burdens on colleges and universities. [The Education Department and its Office of Inspector General] have consistently worked to detect, investigate, and facilitate the prosecution of fraudsters, as well as to communicate emerging fraud risks associated with Federal student aid and other ED programs.”
In late 2025, ED officials said that it had prevented $1 billion in Federal student aid fraud during that calendar year.
Elaborating on how many of these sehemes work, FinCEN said that fraudsters often steal personally identifiable information to create “ghost students.”
“To create ghost students, fraudsters may illegally obtain Personally Identifiable Information (PII) to impersonate an identity theft victim and pose as a legitimate student,” according to FinCEN. “Fraudsters may also use artificial intelligence or other tools to overcome identity verification by generating fraudulent documents that combine stolen PII with fabricated details, commonly referred to as synthetic identities. Victims whose identities are leveraged as part of ghost student schemes, including minors, are unaware that fraudsters are receiving Federal student aid using their PII.”
FinCEN officials said that in addition fraud rings sometimes use complicit “straw students” to obtain federal student aid. Straw students are individuals who, for a fee, provide their PII to fraudsters, who enroll them at educational institutions and collect financial aid refunds issued in their names.
They added that corrupt staff at educational institutions may also take advantage of their positions to defraud student aid programs by recruiting straw students and managing their educational records.
According to FinCen, fraudsters then get their hands on the money by channeling refunds to accounts with no connection to the nominal recipient, which is not to say that there will be no paper or electronic trail.
“Financial institutions may be able to identify student aid refund payments either through deposits made directly by educational institutions or by contracted intermediaries, they said. “According to Bank Secrecy Act data, payments made by an intermediary typically occur via Automated Clearing House transfers and the associated transaction references may include the term ‘refund’ and the educational institution’s name or abbreviation (e.g., “Local Community College Refund” or “LCC REFUND”). In some cases, the stated recipient may also be listed in the transaction reference (e.g., “LCC REFUND John Doe”). After illicitly obtaining student aid refunds, fraudsters may launder student aid funds, including through money mules, shell companies, and fraudulent accounts.”
FinCEN officials then identified “red flags” they said may indicate fraudulent activity, although they started with a somewhat standard cautionary note.
“Because no single red flag is determinative of illicit or other suspicious activity, financial institutions should consider the surrounding facts and circumstances, such as a customer’s historical financial activity, whether the transactions are in line with prevailing business practices, and whether the customer exhibits multiple related red flags, before determining if a transaction or attempted transaction is indicative of fraud or is otherwise suspicious,” they wrote.
The Red Flags include a “customer who has no previous history of, or customer profile information that would be consistent with, enrollment at an educational institution receives a student aid refund, especially where the stated recipient of the refund listed in the transaction reference is an individual with no known connection to the customer. These funds are then rapidly transferred to another
account via P2P or wire transfers, used to purchase digital assets, or used in transactions with online money services businesses that typically process international funds transfers.”
Another Red Flag consists of a customer using funds to quickly purchase digital assets, which the customer then rapidly transfers to another digital wallet for no apparent legal purpose.
And a Red Flag may consist of multiple unrelated students using the same account for the deposit of federal student aid refunds.
FinCEN officials identified several other “red flags” they said may indicate fraudulent activity.
FinCEN reminded financial institutions of their obligations to file Suspicious Activity Reports in these circumstances and included details about when they must do so.
“A financial institution is required to file a suspicious activity report (SAR) if it knows, suspects, or has reason to suspect a transaction conducted or attempted by, at, or through the financial institution involves funds derived from illegal activity; is intended or conducted to disguise funds derived from illegal activity; is designed to evade regulations promulgated under the BSA; lacks a business or apparent lawful purpose; or involves the use of the financial institution to facilitate criminal activity,” FinCEN officials wrote.” All statutorily defined financial institutions may voluntarily report suspicious transactions under the existing suspicious activity reporting safe harbor.”
Recent Comments