When Francis Mogambi arrived in the United States on a Diversity Visa lottery ticket in May 2024, he likely imagined a fresh start. Within two years, he found himself at the centre of a sprawling federal investigation into a fraud that exploits the very programme meant to expand educational opportunity for low‑income Americans.
How the scheme operated
According to court documents, between November 2025 and May 2026 Mogambi collaborated with associates in Kenya to steal the personal details of U.S. citizens. Those stolen identities were used to create “ghost” students—fictitious enrolments at American colleges. The fraudsters then applied for federal student aid on behalf of these non‑existent students, diverting the disbursements to themselves. Mogambi kept roughly 30 % of each payment, while the remainder was funneled to partners in Kenya.
The operation relied on a sophisticated “super intelligence” system, as described by Assistant Attorney General Colin M McDonald, to keep the fake students appearing active semester after semester. This allowed the illicit aid to continue flowing, often disappearing overseas within weeks.
Scale of the fraud
Investigators identified 830,840 potentially fraudulent Federal Student Aid identification numbers, representing about $130 million in aid linked to suspicious accounts in September and October 2026. While the figure reflects possible fraud rather than confirmed losses, it underscores the magnitude of the threat.
Operation Ghostbusters has already resulted in five indictments of Kenyan nationals, with another 40 investigations ongoing. In related cases, a Kenyan national in Virginia allegedly received over $1.44 million in fraudulent refunds, and three New Jersey residents were charged as money mules for more than $1 million in aid.
International cooperation and asset recovery
U.S. authorities have worked closely with Kenyan law‑enforcement agencies. In September, a joint effort led to the seizure of over $750,000 from a cryptocurrency account tied to a Kenyan individual linked to the scheme—described as the first international seizure of its kind in Kenya.
Impact on victims
Beyond the fiscal loss to the federal government, victims whose identities were stolen face unexpected student‑loan debts, damaged credit scores, and the administrative nightmare of clearing erroneous records. McDonald highlighted a victim whose credit was jeopardised simply because his name appeared on a fraudulent loan bill.
Legal consequences
If convicted, Mogambi faces a mandatory minimum sentence of ten years, forfeiture of assets, and restitution to victims. The Justice Department has signalled a relentless pursuit of anyone who exploits taxpayer‑funded programmes, emphasizing that the crime is both a financial and a moral affront.
Analysis
The case illustrates how globalized criminal networks can weaponise the U.S. education financing system. By exploiting low‑income Americans—individuals less likely to monitor their credit reports—fraudsters achieve a high return on relatively low‑cost data purchases (as little as $4‑$8 per stolen identity). The reliance on cryptocurrency for moving funds further complicates detection and recovery, highlighting the need for tighter cross‑border financial oversight.
Moreover, the operation reveals a troubling feedback loop: the promise of lucrative returns draws participants from abroad, while the anonymity of digital money channels obscures the trail, making international cooperation essential. The successful seizure in Kenya demonstrates that such collaboration can yield tangible results, but the sheer volume of fraudulent accounts suggests that many more remain undetected.
Uncertainty
While the indictment provides a clear snapshot of Mogambi’s alleged activities, the full scale of the fraud remains uncertain. The $130 million figure reflects potentially fraudulent aid, not confirmed losses, and the number of victims whose identities were compromised may be higher than reported. Ongoing investigations could reveal additional actors and pathways, especially as authorities continue to examine the cryptocurrency transactions linked to the scheme.
Finally, the long‑term effectiveness of policy responses—such as disabling suspicious identification numbers and tightening verification processes—will depend on sustained funding and inter‑agency coordination. Until then, the ghost student threat remains a potent reminder of how digital vulnerabilities can be leveraged for large‑scale financial crime.