Treasury flags $270 million in suspicious activity linked to federal student aid fraud
FinCEN identified about $270 million in suspicious financial activity potentially tied to fraud against federal student aid programs and referred its findings to federal investigators.
The US Department of the Treasury announced on 19 October 2026 that the Financial Crimes Enforcement Network (FinCEN), the US financial intelligence unit, identified approximately $270 million in suspicious financial activity potentially linked to fraud against federal student aid programs. FinCEN referred the findings to federal investigators and law enforcement as tip-and-lead information for further investigation.
Treasury said FinCEN issued an alert in July 2026 that warned financial institutions about student aid fraud and asked them to file suspicious activity reports (SARs). The alert noted that schools or their payment contractors often send aid refunds by electronic bank transfer, and that the payment descriptions often contain the word refund along with the school's name or initials.
According to Treasury, financial institutions have filed nearly 100 SARs since the alert, and FinCEN's review identified more than 20,000 potentially suspicious transactions since February 2026. Treasury said these reports should not be considered a complete representation of the scope of the activity. It said fraudsters often move stolen aid through money mules, shell companies and fake accounts.
Treasury described two schemes. In ghost student schemes, criminals steal personal information such as names and Social Security numbers and use it to enroll fake students under a victim's identity. In straw student schemes, fraud rings pay real people for their personal information, enroll them at a school and keep the aid refunds issued in their names. Treasury said corrupt school employees sometimes help fraud rings by recruiting straw students and altering their records. Treasury said it is working with the White House Task Force to Eliminate Fraud, led by Vice President Vance, and encouraged whistleblowers to report credible information.
Why it matters to AML professionals
Student aid refunds arrive as routine-looking incoming credits, so fraud proceeds can pass through monitoring unnoticed. AML professionals at banks and fintechs that receive school refunds can use the payment patterns Treasury describes to review alerts, tune scenarios and write clearer SARs.
Red flags in this case
- Several student aid refunds from different schools arriving in one account
- A newly opened account that receives a school refund and is emptied soon after by transfers or cash withdrawals
- Refund credits for students with different names landing in accounts controlled by one person, device or address
- An account holder whose age, location or profile does not fit enrollment at the school sending the refund
If this landed in your queue
- Search incoming credits for refund descriptions that include school names or initials, and group them by beneficiary
- Compare the account holder's profile and identity documents with the student name on the refund payment
- Trace where the refund money goes next and look for links to other accounts that receive school refunds
- File a SAR that clearly describes the refund pattern, the accounts involved and the possible link to student aid fraud
Key terms
- Ghost student
- A fake student enrolled using a stolen or made-up identity so that criminals can collect financial aid.
- Straw student
- A real person who is paid to let a fraud ring use their identity to enroll and collect aid refunds.
- Money mule
- A person who lets their bank account be used to receive and move criminal money, knowingly or not.
Interview angle
How would you spot student aid refund fraud in transaction monitoring?
Explain that refunds from schools look normal on their own, so the signal is in patterns: several refunds into one account, refunds for names that do not match the account holder, and fast outflows. Mention linking accounts by shared details and writing a SAR that explains the pattern simply.
Sources
Go deeper on AMLift
Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.
Report an error
Every report is checked against the official source. If we got something wrong, the story is corrected.