Somewhere in the United States, a person who has never set foot on a college campus may soon open a letter claiming they owe money for classes they never took.

That quiet damage sits at the center of Operation Ghostbusters, the US Department of Justice’s effort to unpick a scheme in which invented students were allegedly enrolled at colleges to collect federal aid, with a trail of money leading to Kenya.

Prosecutors say the conspirators obtained stolen personal details of Americans, filed false Free Application for Federal Student Aid forms in their names, and enrolled the fictitious students at schools, sometimes keeping up appearances by completing coursework.

When refunds were released, the money landed in accounts controlled by the group or by recruited middlemen known as money mules, who kept a share and passed the rest along, including to people in Kenya.

In Nebraska, Francis Mogambi has been indicted on accusations of using stolen identities to redirect aid payments, keeping 30% and sending the rest to conspirators in Kenya.

In Virginia, a Kenyan national allegedly received more than 700 fraudulent deposits worth about $1.44 million, then moved at least $1.3 million onward through thousands of transfers. In New Jersey, three US-based participants allegedly took in over $1 million and wired money to associates tied to a purported safari company, and US authorities say two Kenyan-based associates linked to that company could face charges as the investigation continues. Every one of these remains an allegation until tested in court.

The numbers depend on who is counting. The FBI has identified more than $32 million in losses, while the DOJ flagged 830,840 potentially fraudulent student aid IDs tied to nearly $130 million in September and October alone and now puts suspected fraud across the wider scheme above $200 million.

Those figures describe exposure and suspicion rather than proven theft, and they cover a national operation, not only the Kenyan strand. Still, more than 40 open cases across 26 FBI field offices point to something far larger than one rogue group.

Investigators have already seized over $750,000 in cryptocurrency linked to a Kenyan national, which the DOJ describes as the first international seizure of its kind in Kenya.

All figures Represent Allegations or Suspected Exposure Currently Under DOJ & FBI Investigation

The most striking signal is what American officials say comes next. They describe the operation as just getting started, and US officials recently travelled to Kenya to discuss extradition, prosecution, and recovering money allegedly stolen from American taxpayers.

For anyone connected to the network, the old assumption that distance offers protection looks increasingly shaky, particularly as Kenya’s Computer Misuse and Cybercrimes Act explicitly provides for international cooperation.

So why Kenya? The evidence points to one node in a multinational network, not the birthplace of the crime. A large English-speaking, digitally connected workforce can handle American forms and college correspondence from anywhere; established remittance channels make it easy to split and move money; and some criminals simply repurpose skills in phishing and impersonation.

Kenya has seen this shape of case before, including the 2019 extradition of Amil Hassan Raage over a scheme that persuaded two American universities to send more than $872,000 to a US account, and a 2026 Connecticut sentencing tied to an email fraud costing victims over $12 million.

Victims may spend months proving that debts and enrollments in their names were fake, and the Education Department runs a discharge process for exactly that. Colleges are expected to add identity checks and refund holds, which means genuine students may face delays. Kenyans, meanwhile, could meet extra scrutiny in banking and immigration systems because of what a few are accused of doing.

Behind it all sits an uncomfortable question about talent and opportunity. The skills used in these schemes are the same ones that fraud detection, cybersecurity, and legitimate digital businesses pay for, and explaining how a scheme works is no excuse for it.

The harder task is closing that gap, so capable young people find better-paid work than draining the accounts of strangers.