Recognizing "Ghost Students" and Synthetic Identity Financial Aid Fraud

Recognizing "Ghost Students" and Synthetic Identity Financial Aid Fraud

Quick Overview
  • Explains what "ghost student" / synthetic identity fraud is and why it matters at SFA
  • Gives faculty, advisors, Financial Aid, and Registrar staff a shared checklist of red flags
  • Covers application, identity, engagement, disbursement, and communication red flags
  • Provides clear steps for reporting a suspected case, including SFA's formal noncompliance reporting channels
  • Click any section header below to expand or collapse it

Colleges and universities nationwide have seen a sharp rise in organized fraud rings using stolen or fabricated identities, sometimes called "Pell runners" or "ghost students," to enroll, draw down federal and state financial aid, and disappear before census date or the add/drop deadline. These schemes exploit online enrollment and exceed what any single office can catch alone. Early detection depends on faculty, advisors, and staff across campus recognizing the same warning signs and reporting them quickly.

!
Important
No single red flag proves fraud. Many legitimate students have non-traditional schedules, never visit campus, or struggle to engage early in the term. These indicators are meant to prompt a closer look and a report through the proper channel below, not an accusation or independent investigation by the person who notices them.
What Is "Ghost Student" / Synthetic Identity Fraud?  Background ⌄

Synthetic identity fraud combines real and fabricated information, such as a stolen Social Security number paired with a fake name and date of birth, to create an identity that can pass initial verification but does not belong to a real applicant. A "ghost student" enrolls under such an identity (or a stolen real identity) purely to access financial aid, has no intention of attending class, and typically withdraws or stops engaging as soon as funds disburse.

These schemes are frequently run at scale by organized groups submitting many applications in a short window, often targeting low-cost or open-enrollment courses to maximize the aid-to-effort ratio.

Application & Enrollment Red Flags  Red Flags ⌄
  • Application submitted very close to a financial aid disbursement deadline or census date
  • Multiple applications submitted from the same IP address, device, or browser fingerprint
  • Several applicants share a mailing address, phone number, or emergency contact who are not related
  • Applicant requests the maximum loan or Pell Grant amount with no other selections customized
  • FAFSA or admissions application completed unusually quickly with minimal corrections or typos for a first-time form
  • Enrollment concentrated in fully online, asynchronous, or low-cost sections only
  • Bulk or batch-like submission patterns: several "different" applicants with near-identical timing
Identity & Documentation Red Flags  Red Flags ⌄
  • Government ID appears altered, mismatched, or low-resolution/recompressed in a way that obscures detail
  • Name, date of birth, or SSN on file does not match what's returned by Social Security or NSLDS verification
  • Phone number is VoIP-only or a disposable/burner number with no voicemail set up
  • Email address follows a sequential or templated pattern shared with other "unrelated" applicants (e.g., firstname.lastname1234@, firstname.lastname5678@)
  • Transcript or prior-school records cannot be verified, or the listed institution has no record of attendance
  • Address is a known mail-drop, vacant lot, or shared by many unrelated applicants
Academic Engagement Red Flags  Red Flags  For Faculty & Advisors ⌄
Financial Aid Disbursement Red Flags  Red Flags ⌄
  • Refund or direct deposit account is changed immediately before or after disbursement
  • Multiple "unrelated" students share the same bank account or routing number for refunds
  • Student requests an expedited refund or asks repeatedly about disbursement timing before classes begin
  • Student stops all activity (enrollment, LMS, communication) within days of receiving a refund
  • Pattern of enrolling, drawing aid, and withdrawing repeats across multiple terms under different applicant names but similar contact details
Communication Pattern Red Flags  Red Flags ⌄
  • Will only communicate by email, never by phone or video, and avoids any request to verify identity in real time
  • Responses are generic, oddly formal, or appear copy-pasted across different "students"
  • Long delays between messages followed by a burst of activity around enrollment or disbursement deadlines
  • Inconsistent details about program, major, or course schedule when asked directly
  • Requests changes to personal information (address, banking, phone) handled entirely through email with no verification
What To Do If You Suspect Fraud  Reporting ⌄

Immediate Steps

  1. Do not contact the student directly to confront or accuse them. If the identity is synthetic, this tips off the fraud actor; if it's a real student, a false accusation can cause real harm. Report instead.
  2. Do not alter, delete, or withhold the student's record. Preserve enrollment, LMS, and financial aid data as-is for review.
  3. Report what you observed, including which red flags, which student/section, and when, to the Office of the Registrar and the Office of Financial Aid using the normal case-referral process for your role (advising note, faculty alert, or direct email).
  4. If the case involves a confirmed or suspected compromised identity, stolen SSN, or systemic/organized pattern (multiple students, shared contact info, coordinated timing), also notify the Office of Information Security at itsecurity@sfasu.edu so it can be evaluated for a broader fraud ring.
  5. Financial Aid staff identifying a suspected fraud case should follow SFA's existing financial aid fraud referral procedure, which includes notice to the U.S. Department of Education's Office of Inspector General as required.
i
Tip
Even a single red flag is worth reporting. You are not expected to confirm fraud yourself. Financial Aid, the Registrar, and Information Security will evaluate the pattern across offices.

Formal Noncompliance and Fraud Reporting Channels

Beyond the operational referral above, SFA Policy 01-403 makes fraud prevention the responsibility of every employee and defines how suspected fraud, waste, or abuse is reported and investigated university-wide. Any employee, vendor, or community member who suspects fraudulent activity, including financial aid fraud, can use any of these channels:

  • Your supervisor or director
  • Office of Compliance: 936.468.2207, sfacompliance@sfasu.edu
  • Audit Services
  • Human Resources
  • Office of General Counsel
  • EthicsPoint: confidential third-party hotline at 866.294.9539, or report online (see Related Resources below)
  • Texas State Auditor's Office: 1.800.TX.AUDIT
!
Important
UT System and SFA policy, along with state law, prohibit retaliation against anyone who reports suspected noncompliance in good faith or participates in an investigation. These formal channels are reserved for suspected noncompliance, unethical conduct, or fraud, not general complaints, which should go through normal administrative channels.
External Reference SFA Reporting Noncompliance (Office of Compliance) – SFA Policy 01-403, full list of reporting options, and the EthicsPoint online reporting link

Related Resources

  • Office of Financial Aid fraud referral procedure (internal)
  • Office of the Registrar enrollment verification process (internal)
  • SFA Reporting Noncompliance – SFA Policy 01-403, Office of Compliance
  • FERPA - Family Educational Rights and Privacy Act (see IT Laws & Regulations KB article)
  • U.S. Department of Education Office of Inspector General - Higher Education fraud reporting

Need Help?

Contact the IT Help Desk at (936) 468-4357 (HELP) or submit a ticket at help.sfasu.edu. For fraud-specific questions, contact the Office of Information Security at itsecurity@sfasu.edu or the Office of Compliance at sfacompliance@sfasu.edu.
Print Article