Student-aid refunds left U.S. bank accounts as cash. Investigators say the next step in the trail ran through a Kenyan cryptocurrency wallet.

The U.S. Department of Justice on Thursday announced charges against five defendants in “Operation Ghostbusters,” an investigation into federal student-aid fraud linked to a Kenyan network, together with the seizure of more than $750,000 from a cryptocurrency account belonging to a Kenyan national tied to the scheme. Officials described the action as the Justice Department Fraud Division's first international crypto account seizure of its kind in Kenya. Cases span the District of New Jersey, the Eastern District of Virginia, and the District of Nebraska.

According to the Justice Department announcement, the alleged pipeline began with stolen U.S. identities and fraudulent FAFSA filings, moved through U.S. mule bank accounts, and, in part, ended in digital assets held abroad. The FAFSA — the Free Application for Federal Student Aid — is the Education Department form that determines eligibility for federal grants and loans, the source of the refund money at the center of the case.

How the Alleged Pipeline Worked

Operation Ghostbusters targets a large-scale student-aid fraud scheme. Prosecutors say participants created fraudulent Federal Student Aid accounts using stolen U.S. identities and enrolled “ghost students” who never attend class. Loan and grant refunds were then directed into accounts controlled by foreign actors and U.S.-based money mules, including Kenyan nationals. In the U.S. system, aid that exceeds tuition and fees is released directly to students as refunds, which is what turns an approved aid package into spendable cash.

According to the Department, community colleges and universities began flagging suspicious FAFSA applications around 2021, with refunds landing in bank accounts that did not belong to the named applicants. Investigators now estimate the fraud at well over $200 million. The FBI says it has identified more than $32 million in losses in similar ghost-student schemes, with millions more suspected.

Prosecutors also allege that fraudsters used what the Department called “super intelligence” to place fake students in classrooms and complete their coursework so that aid kept flowing. Many identified victims hold only high school diplomas and later learned they had been enrolled at schools hundreds of miles away — a reminder that the entry point in each case was a real person's stolen information, which is why the charges include aggravated identity theft.

In September and October 2026, investigators identified 830,840 potentially fraudulent FSA IDs — the login credentials used to access and sign federal student-aid applications — tied to nearly $130 million. Agents recommended that the Department of Education disable them; the announcement did not say whether that step has been taken.

The Kenya Crypto Seizure

In September, Fraud Division staff and agency partners traveled to Kenya to press for extradition, prosecution, and the return of assets. Kenyan law enforcement helped seize more than $750,000 from a cryptocurrency account that belonged to a Kenyan national connected to the scheme.

Assistant Attorney General Colin M. McDonald of the National Fraud Enforcement Division framed the move as a first, calling it the Division's first international seizure of its kind in Kenya. The announcement coincided with the charges against five defendants. Kenyan partners named in the release include the Directorate of Criminal Investigations, the Asset Recovery Agency, and the Office of the Director of Public Prosecutions.

The seized amount is small next to the alleged overall loss, but the Justice Department presented it as a signal of the investigation's reach: proceeds of student-aid theft can end up as cryptocurrency balances that partner authorities can freeze when a trail crosses borders.

Charges Across Three Districts

District of New Jersey. A criminal complaint charges Mabed Patricia Utate-Alberto, Patricia Arisleydi Perez, and George Arturo Alfau Mendez, whom prosecutors describe as alleged U.S.-based money mules. The conspiracy is alleged to have run from about March 2021 through at least January 2026, with an intended loss above $1 million — approximately $1.5 million per the case caption. After taking a cut, the trio allegedly wired funds to Kenya-based co-conspirators linked to a purported safari company. All three have been arrested. Two Kenya-based co-conspirators remain uncharged for now, according to the Department.

Eastern District of Virginia. On Oct. 21, a grand jury returned a multi-count indictment whose target remains unidentified in the public release. It charges a Kenyan national with conspiracy to commit wire fraud and student-aid fraud, alleging that more than $1.4 million was stolen through over 700 fraudulent refund deposits and that at least $1.3 million then moved through wires and money-service transfers to accounts in the United States and Kenya.

District of Nebraska. On Oct. 19, a grand jury indicted Francis Mogambi, a Kenyan citizen, on five counts of theft of government money and five counts of aggravated identity theft. Prosecutors allege that between November 2025 and May 2026 he used stolen identities to redirect aid checks, kept about 30% of the proceeds, and sent the rest to Kenya. The intended loss in that case is listed at $20,000. Mogambi has been arrested and detained pending trial.

An indictment or complaint is an allegation. Defendants are presumed innocent unless proven guilty in court.

A Nationwide Operation

The Justice Department says more than 40 cases are open, spanning 26 FBI field offices and more than 20 U.S. Attorneys' Offices. Operation Ghostbusters continues to work with Kenyan counterparts on asset return and extradition. The open questions from here: whether the two Kenya-based co-conspirators still listed as uncharged face charges, and whether further cross-border seizures follow. A single frozen wallet in Kenya will not close a scheme measured in hundreds of millions of dollars, but it shows where investigators are willing to follow the trail next.

In the Department's account, the same pattern runs through the cases: stolen identities provide entry, mule bank accounts move the refunds, and cryptocurrency becomes one place where proceeds can sit when cash must travel faster than paperwork.