Ghost student fraud found as rings before the Pell is paid, real students cleared first, every hold signed by two people
No Pell paid to a fake student, and every real student cleared with the evidence.
See one case, screen by screen ↓Ghost Student Fraud Detection helps enrollment and financial aid offices find ghost student fraud before aid is paid. Agents read applications, contact details and devices, writing, first-week course activity and aid records, link the applicants who share signals into rings and cite every signal to its record. A Protector agent clears real students first, a reviewer clears or holds each person, and the Director of Financial Aid co-signs every aid hold.
AI in education: a buyer's guide to agentic AI for colleges, universities and school districts →
Updated
Ghost student fraud is a fraud ring filing college applications with stolen or invented identities, enrolling the fake students in online sections, posting just enough work to look present, and collecting Pell grants before anyone notices. Community colleges are the main target, with low or no application fees, open admission and asynchronous online courses, and every ghost student holds a seat a waitlisted student needed. Since June 6, 2025, FSA also requires schools to confirm the identity of flagged first-time aid applicants with an unexpired government photo ID.
Today the signals sit in five systems that never meet: the application portal, the student information system, the learning management system, the financial aid system and the identity verification service. Admissions staff sort a spreadsheet of fake college applications by email, phone and address; instructors email the online learning office about students who never log in; aid staff email students for a photo ID and wait. Real students who share an address, a network or a household laptop get caught with the ring, and whatever was missed is paid, becomes an overpayment and turns into a referral. Ghost Student Fraud Detection puts eight agents in front of that work, so a reviewer decides a pattern once, with all its evidence.
Estimated split of a typical flag's business days from flag to a signed decision, by hand and with the agents: about a week before, about one day after. The student's own five days to verify are not counted. Our arithmetic, kept modest.
Eight agents read applications, devices, writing, course activity and aid records, link rings, clear the innocent first and notify; a reviewer decides, the aid director co-signs.
Ring K-0419 at Brandvale Community College: 23 applications filed in 51 hours over one October weekend. Here is what happens to it on Wednesday, October 21, screen by screen, in the working solution.
The first-week course activity arrives and the Linker agent forms ring K-0419. On the rings screen each ring is a fan of overlapping applicants with the one signal they share written on top: identical intro post, same device, same essay text, same network, same mailing address. A single line on the right counts down to Tuesday's disbursement.
Disbursement in 6 days · $305,406 Pell · 114 seats
Dolores selects K-0419 and its 23 applicants spread into a row. Under Jordan Pratt: email learnwell2601, the first of 21 in sequence; a phone in the same prepaid block; device D-7Q4, shared by 9; the identical intro post in ENG 101-W62 and PSY 101-W14; zero logins since October 12; a FAFSA with a Student Aid Index of 0. Every line is cited, and every applicant has two buttons: Clear, or Hold for identity check.
Disbursement in 6 days · $166,750 Pell · 61 seats
One minute after the ring forms, the Protector agent checks six innocent explanations against their own sources: siblings and households, the shelter list, campus and library networks, dual-enrollment labs, household devices and prior Brandvale records. Two applicants match. It clears Lucia and Mateo Arriaga, whose real home address three ring applications borrowed, and hands the ring to analyst Theo Barrantes.
Clear 2, with evidence; hold nobody
Dolores opens the Protector's first citation: the lease for 418 Orchard Row, Apt 2B, uploaded with a residency form on October 6, 2025, the passage highlighted. Lucia's dual-enrollment record and one parent on both FAFSAs are cited beside it. Opening the lease is itself on the record, under her name.
Occupants: Rosa Arriaga, Lucia Arriaga (daughter), Mateo Arriaga (son).
For a hard case she opens one person. Kayla Burris applied at 2:14 AM on October 3, inside a 51-hour burst of 21 sequential applications; her phone sits in a prepaid block activated September 28 to October 2; she posted the same 33-word intro as 18 others; she has logged in 0 times since October 12, where a typical student has 9. The Protector's six checks all read No match.
Dolores confirms the Protector's two clears at 10:06 AM and the countdown falls to $151,960. At 10:09 AM she holds the other 21 for an identity check with reason code H1, shared signals across a ring, no course activity. The dialog says what happens next: the aid hold waits for the Director of Financial Aid, and classes stay in place until the deadline.
Sameer sees who decided, when, with which reason code and on what evidence, and co-signs. The hold stops $151,960 in Pell. The person who held can never co-sign the same hold.
Co-signed at 10:14 AM. 21 identity requests sent, due Mon, Oct 26, 5:00 PM. Seat release for Oct 27, 7:00 AM sent to the Dean for approval.
Only on the co-signature, each of the 21 gets the photo-ID request in the student portal: verify online in about five minutes, by live video call, or in person at Brandvale Central or Brandvale East, by Monday, October 26, 5:00 PM. The notice never says fraud or suspect, and it comes in English and Spanish.
If you cannot make this date, reply to this message and we will work with you.
Every request is tracked from sent to opened to verified, with reminders planned for October 23 and October 25. A reviewer can extend a deadline with a reason code or record an in-person ID check on any row.
Marisol approves the conditional release. Anyone not verified by the deadline gives up their seats the next morning: 61 seats in six online sections go to 148 waitlisted students, who have 48 hours to accept before the next in line. No Pell is paid to an unverified identity.
Released for anyone not verified by Mon, Oct 26, 5:00 PM. Anyone who verifies keeps every seat.
The same ring, seen by the five people who carry it: what their day looked like, and what it looks like now.
Eight agents read applications, devices, writing, course activity and aid records, link rings, clear the innocent first and notify; a reviewer decides, the aid director co-signs.
Reads each application for bursts, sequential emails, invented or reused identities and mismatched dates of birth.
Looks at phone blocks and carrier types, email age, device fingerprints and networks.
Compares intro posts, essays and appeals for identical or machine-written text.
Reads first-week logins, posts and submissions by online section.
Reads FAFSA records for Student Aid Index patterns, refund accounts, FSA identity flags and conflicting information.
Groups applicants who share signals into rings, names the shared signal and computes the Pell and seats at stake before the next disbursement.
Looks for innocent explanations first (siblings, family shelters, library networks, dual-enrollment labs, household devices, prior records) and clears those students with the evidence.
Drafts plain-language notices, sends identity requests after the co-signature, tracks deadlines, schedules seat releases and prepares redacted exports.
Hold, co-sign, release seats. The agents propose; a named person decides.
Ask about any ring, applicant or deadline. The answers come from the records and cite them; you decide.
Why is K-0419 a ring?
Because 21 of its 23 applicants share four kinds of signal: sequential emails, learnwell2601 to 2621; one prepaid phone block; the same 33-word intro post in four online sections on Oct 12; and no logins since. 20 filed a FAFSA with a zero Student Aid Index.
Who in K-0419 could be a real student?
Lucia and Mateo Arriaga. Three ring applications used their home address; the lease lists them as occupants, Lucia took two in-person courses in 2025 and one parent is on both FAFSAs. The Protector cleared them; they are first on the ring for your confirmation.
What is at stake before October 27?
Five open rings would take $305,406 in Pell and 114 seats before Tuesday's disbursement. Ring K-0419 is the largest: $166,750 and 61 seats. Ring K-0408's identity deadline is today at 5:00 PM; 10 of 11 have not verified.
13 screens from the working solution, on its sample data. Pick one to see it large.
Every rule a ring is checked against is a setting: versioned, approved by the Dean and on the record.
| Setting | Default | Choose from |
|---|---|---|
| Forming a ring | Two different signal types, three or more people | Minimum ring size and signal rules, changed only with the Dean's approval |
| Agent confidence to propose | 0.80 (Writing agent 0.85) | Per agent, versioned, with the last evaluation shown |
| The Protector | Runs before any person sees a ring · locked on · 0.85 to clear | Siblings and households, family shelters, campus and library networks, dual-enrollment labs, household devices, military housing, prior Brandvale record |
| Decide a flag | 2 business days, and always before the next disbursement | Escalates to the Dean at 2 days or 48 hours before a disbursement |
| Co-sign an aid hold | 4 business hours | Escalates to the Dean and the Director's delegate |
| Identity check deadline | 5 calendar days, and before the disbursement | Reminders on day 2 and day 4; extend with reason codes E1–E3 |
| Seat release | The morning after the deadline, 7:00 AM | Only with the Dean's approval |
| Retention | 3 years after the end of the award year (34 CFR 668.24) | Identity document copies the same; exports redacted by audience |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
Sources: California community college reporting for 2024, via FSA and press (1.2 million fake applications, 223,000 suspected fake enrollments) · Fortune, August 23, 2025 (the Department of Education's finding of $90 million paid to ineligible students, $30 million under the identities of people who had died) · FSA Electronic Announcement APP-25-16, June 6, 2025 (identity verification of flagged applicants) · 34 CFR 668.16(f) and (g), 668.21, 668.24 · FERPA, 34 CFR 99.32 · "demo" = seen in the working solution, on its sample data · "target" = design goal, measured in the live solution · "typical" = published figures · "estimated" = our arithmetic, kept modest. Brandvale Community College and the people named on this page are fictional: characters and sample data in the working solution.
Ghost Student Fraud Detection helps enrollment and financial aid offices find ghost student fraud before aid is paid. Agents read applications, contact details and devices, writing, first-week course activity and aid records, link the applicants who share signals into rings and cite every signal to its record. A Protector agent clears real students first, a reviewer clears or holds each person, and the Director of Financial Aid co-signs every aid hold.
A ghost student is a fake applicant, enrolled under a stolen or invented identity, who posts just enough coursework to look present so that a fraud ring can collect Pell grants and the refund. Ghost students usually come in groups that share an email pattern, a phone block, a device or the same intro post, and each one holds a course seat a real student is waiting for.
Separate agents read each source for signals: bursts of applications and sequential emails, prepaid phone blocks and shared devices, identical intro posts or essays, no logins after the first week, and FAFSA patterns such as a zero Student Aid Index. The Linker agent forms a ring only from two different signal types shared by three or more people, and a single line shows the Pell and seats at stake before the next disbursement.
Shared addresses, networks and household devices are exactly the signals rings also produce, so the Protector agent checks innocent explanations first: siblings, family shelters on the county list, campus and library networks, dual-enrollment labs, household devices and prior records. It clears those students with the evidence before anyone sees the ring, and a reviewer confirms each clear. In the working solution, no student was held this term for a shared address, network or device alone.
Under FSA's June 6, 2025 announcement, a flagged first-time aid applicant confirms identity with an unexpired government photo ID, in person, by live video or through an identity service that meets NIST IAL2. The request goes out only after the co-signature, in plain words in English or Spanish, with a date, three ways to verify and a way to reply for more time. Classes stay in place until the deadline.
No. The agents find, link, protect and notify; they never drop a student, stop or release aid, send a notice before the second signature, release a seat before the deadline or show aid data to instructors. A reviewer decides each person with a reason code, the Director of Financial Aid co-signs every aid hold and release, and the Dean approves seat releases and settings changes.
From the audit trail, an export is built for the audience: an FSA program review with names and student IDs and sensitive numbers masked, the state system office with counts only, or an Inspector General referral under 34 CFR 668.16(g), which leaves only with the Director of Financial Aid's signature. Each disclosure is recorded for each student under FERPA.
The Agentic Solution Engine builds and deploys it from your requirements and documents (your signal rules, innocent explanations, notices and a sample of past applications and flags), and it goes live once every quality gate has passed. We will walk you through it on your own applications first.
The reader scores first; the agent's score opens beside it, cited to the page.
1-min demoTransfer Credit EvaluationCredit decided in a day, not a week, with every outcome threaded to the syllabus.
1-min demoTranscript Processing AutomationEvery course line read twice, reconciled to the grade key, and posted the same day.
1-min demoWe'll run Ghost Student Fraud Detection on a sample of your own applications, flags and first-week course activity.