‘Ghost’ students are hijacking millions from colleges—and locking real human students out of classes

“When we got hit in the fall, we got hit hard,” Kim, president of California’s Santiago Canyon College, told Fortune. “They were occupying our wait lists, and they were in our classrooms as if they were real humans—and then our real students were saying they couldn’t get into the classes they needed.”

Kim worked quickly to bring in an AI firm to help protect the college and strengthen its guardrails, she said. Santiago Canyon wound up dropping more than 10,000 enrollments representing thousands of students who were not really students, said Kim. By spring 2025, ghost student enrollments had dropped from 14,000 since the start of the spring term to fewer than 3,000. 

Ghost students

Across America’s community colleges and universities, sophisticated criminal networks are using AI to deploy thousands of “synthetic” or “ghost” students—sometimes in the dead of night—to attack colleges. The hordes are cramming themselves into registration portals to enroll and illegally apply for financial aid. The ghost students then occupy seats meant for real students—and have even resorted to handing in homework just to hold out long enough to siphon millions in financial aid before disappearing. 

The scope of the ghost-student plague is staggering. Jordan Burris, vice president at identity-verification firm Socure and former chief of staff in the White House’s Office of the Federal Chief Information Officer, told Fortune more than half the students registering for classes at some schools have been found to be illegitimate. Among Socure’s client base, between 20% to 60% of student applicants are ghosts.

“Imagine a world where 20% of the student population are fraudulent,” said Burris. “That’s the reality of the scale.”

At one college, more than 400 different financial-aid applications could be tracked back to a handful of recycled phone numbers. “It was a digital poltergeist effectively haunting the school’s enrollment system,” said Burris. 

The scheme has also proved incredibly lucrative. According to a Department of Education advisory, about $90 million in aid was doled out to ineligible students, the DOE analysis revealed, and some $30 million was traced to dead people whose identities were used to enroll in classes. The issue has become so dire that the DOE announced this month it had found nearly 150,000 suspect identities in federal student-aid forms and is now requiring higher-ed institutions to validate the identities of first-time applicants for Free Application for Federal Student Aid (FAFSA) forms. 

“Every dollar stolen by a ghost is a dollar denied to a real student attempting to change their life,” Burris explained. “That’s a misallocation of public capital we really can’t afford.”

Under siege

The strikes tend to unfold in the quiet evening hours when campuses are asleep, and with surgical precision, explained Laqwacia Simpkins, CEO of AMSimpkins & Associates, an edtech firm that works with colleges and universities to verify student identities with a fraud-detection platform called SAFE. 

Bryce Pustos, director of administrative systems at Chaffey Community College, recalled last fall’s enrollment period when faculty members reported going to bed with zero students registered for classes and waking up to find a full class and a mile-long wait list. 

Michael Fink, Chaffey’s chief technology officer, said the attacks took place at scale and within minutes. “We’ll see things like 50 applications coming in within two seconds and then somebody enrolling in all 36 seats in a class within the first minute,” Fink told Fortune. 

Simpkins told Fortune the scammers have learned to strike on vulnerable days in the academic calendar, around holidays, enrollment deadlines, culmination, or at the start or end of term when staff are already stretched thin or systems are more loosely monitored.

“They push through hundreds and thousands of records at the same time and overwhelm the staff,” Simpkins said. 

Plus, enrollment workers and faculty are just that, noted Simpkins; they’re educators who aren’t trained in detecting fraud. Their remit is focused on access and ensuring real students can get into the classes they need, she added, not policing fraud and fake students who are trying to trick their way to illicit financial gain. That aspect also makes the institutions more vulnerable to harm, said Simpkins.

“These are people who are admissions counselors who process applications and want to be able to admit students and give everybody an equal chance at an education,” she said. 

Sadly, professors have dealt with cruel whiplash from the attacks, noted John Van Weeren, vice president of higher education at IT consulting firm Voyatek. 

“One of the professors was so excited their class was full, never before being 100% occupied, and thought they might need to open a second section,” recalled Van Weeren. “When we worked with them as the first week of class was ongoing, we found out they were not real people.”

Follow the FAFSA

In a nightmare twist, community and technical colleges are seen as low-hanging fruit for this fraud scheme precisely because of how they’ve been designed to serve and engage with local communities and the public with as few barriers to entry as possible. Community colleges are often required to accept every eligible student and typically don’t charge fees for applying. While financial-aid fraud isn’t at all new, the fraud rings themselves have evolved from pandemic-era cash grabs and boogeymen in their mom’s basement, said Burris. 

“There is an acceleration due to the proliferation of these automated technologies,” he said. “These are organized criminal enterprises—fraud rings—that are coming both from within the U.S., but also internationally.”

Maurice Simpkins, president and cofounder of AMSimpkins, says he has identified international fraud rings operating out of Japan, Vietnam, Bangladesh, Pakistan, and Nairobi that have repeatedly targeted U.S. colleges. 

The attacks specifically zero in on coursework that maximizes financial-aid eligibility, said Mike McCandless, vice president of student services at Merced College. Social sciences and online-only classes with large numbers of students that allow for as many credits or units as possible are often choice picks, he said. 

For the spring semester, Merced booted about half of the 15,000 initial registrations that were fraudulent. Among the next tranche of about 7,500, some 20% were caught and removed from classes, freeing up space for real students. 

The human cost

In addition to financial theft, the ghost student epidemic is causing real students to get locked out of classes they need to graduate. Oftentimes, students have planned their work or childcare schedule around classes they intend to take—and getting locked out has led to a cascade of impediments. 

“When you have fraudulent people taking up seats in classes, you have actual students who need to take those classes who can’t now, and it’s a barrier,” said Pustos. 

The scheme continues to evolve, however, requiring constant changes to the algorithms schools are using to detect ghost students and prevent them from applying for financial aid—making the problem all the more explosive. Multiple school officials and cybersecurity experts interviewed by Fortune were reluctant to disclose the current signs of ghost students, for fear of the scheme further iterating. 

In the past 18 months, schools blocked thousands of bot applicants because they originated from the same mailing address; had hundreds of similar emails with a single-digit difference, or had phone numbers and email addresses that were created moments before applying for registration. 

Maurice Simpkins noted an uptick this year in the use of American stolen identities as more schools have engaged in hand-to-hand combat with the fraud rings. He’s seen college graduates who have had their identities stolen get reenrolled at their former university, or have had their former education email address used to enroll at another institution. 

Scammers are also using bizarre-looking short-term and disposable email addresses to register for classes in a 10-minute period before they can get their hands on a .edu email address, said Simpkins. That verified email address is “like a gold bar,” Simpkins explained. The fraudster then appears legitimate going forward and is eligible for student discounts on hardware, software, and can use the college’s cloud storage.

“We had a school that reached out to us because some fraudsters ordered some computers and devices and other materials and then had them delivered overseas,” said Simpkins. “And they did it using an account with the school’s .edu email address.”

McCandless said initially it was easy to tell if a fake student was disguised as a local applicant because their IP address was generated overseas. But just a few semesters later, IP addresses were local. When the college’s tech team looked deeper, they would find the address was from an abandoned building or somewhere in the middle of Lake Merced. 

Every time the school did something to lock out fraudulent applicants, the scammers would learn and tweak, McCandless said. The school’s system is now designed to block ghost applicants right out of the gate and at multiple stages before they start enrolling in classes. 

McCandless said professors are assigning students homework for the first day of class, but the ghost students are completing the assignments with AI. Faculty have caught the fake homework, however, by noticing that half the class handed in identical work, or detecting the use of ChatGPT, for instance. 

“They’re very innovative, very good at what they do,” said McCandless. “I just think the consistency with which they continue to learn and improve—it’s a multimillion-dollar scheme, there’s money there, why wouldn’t you invest in it?”

‘Rampant fraud’

According to the DOE, the rate of financial fraud through stolen identities has reached a level that “imperils the federal student assistance programs under Title IV of the Higher Education Act.” In a statement, Secretary of Education Linda McMahon said the new temporary fix will help prevent identity theft fraud. 

“When rampant fraud is taking aid away from eligible students, disrupting the operations of colleges, and ripping off taxpayers, we have a responsibility to act,” said McMahon. 

Ultimately, what schools are trying to do is put in place hurdles that make it unappealing for scammers to attack because they have to do more front-end work to make the fraud scheme efficient, explained Jesse Gonzalez, assistant vice chancellor of IT services for Rancho Santiago Community College District. However, the schools are attempting to balance the delicate issue of accepting everyone eligible and remaining open to vulnerable or undocumented students, he said. “The more barriers you put in place, the more you’re going to impact students, and it’s usually the students who need the most help.”

Kim from Santiago Canyon College fears too many measures in place to root out fraud could make it more difficult for students and members of the community—who for various reasons might have a new email, phone number, or address—to access education and other resources that can help them improve their lives. 

“Our ability to provide that democratic education to those that would not otherwise have access is at stake, and it’s in jeopardy because of these bad actors turning our system into their own piggy banks,” said Kim. “We have to continue to figure out ways to keep them out so the students can have those rightful seats—and keep it open-access.”