The US Justice Department announced on October 29, 2026 that five people have been charged under Operation Ghostbusters for allegedly creating fake college enrolments with stolen American identities and diverting federal student-aid refunds, some of which were sent to Kenya, and all remain presumed innocent until proven in court.
Two of the accused are Kenyan nationals, including Francis Mogambi of Nebraska, who faces five counts of theft of government money and aggravated identity theft and is alleged to retain 30 per cent of the proceeds and forward the remainder to associates in Kenya through intermediaries known as money mules.
A separate indictment in Virginia concerns an unnamed Kenyan national who allegedly received more than 700 fraudulent aid-refund deposits worth about $1.44 million and moved at least $1.3 million onward through thousands of transfers.
In New Jersey, three US-based defendants are accused of taking in over $1 million and wiring money to Kenya-based associates linked to a purported safari company; prosecutors say two Kenya-based associates may also be charged, and the DOJ did not disclose the name of the safari company or the cryptocurrency platform involved in the seizure.
The DOJ said investigators have identified more than $32 million in losses, flagged 830,840 potentially fraudulent student-aid IDs tied to nearly $130 million in September and October, and now estimate suspected fraud across the wider scheme at above $200 million, noting that these figures describe exposure and suspicion rather than proven theft.
Federal agents have seized more than USD 750,000, about KSh97,374,000, in cryptocurrency connected to a Kenyan national, which the DOJ described as the first international crypto seizure in Kenya, and the seized amount is separate from the total alleged fraud.
The investigation involves Kenya’s Directorate of Criminal Investigations, Asset Recovery Agency and Office of the Director of Public Prosecutions, and US officials have travelled to Kenya to discuss extradition, prosecution and the recovery of stolen funds.
Kenya’s Computer Misuse and Cybercrimes Act provides for international cooperation, and the case follows earlier cross-border actions, including the 2019 extradition of Amil Hassan Raage and a 2026 Connecticut sentencing for email fraud.
The US Education Department introduced real-time identity screening within FAFSA on April 26, 2026, requiring high-risk applicants to present government identification and complete a live camera check, a measure aimed at preventing schemes like those described.
The FBI reports more than 40 open cases across 26 field offices, indicating a national operation that extends beyond the Kenyan strand.
Victims whose identities were used may need to prove the enrolments were fake, and the Education Department runs a discharge process to remove fraudulent debts.
Colleges are expected to add identity checks and hold refunds, which could delay legitimate students.
Kenyan citizens could encounter heightened scrutiny in banking and immigration systems as a result of the investigation.
