Identity verification is the weak link in ghost student fraud

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Zumigo's blog post: Ghost student fraud is exploiting higher education identity flows by pairing synthetic identities, account takeover and phishing with weak verification.

Why it matters: This matters because institutions must protect financial aid, student data and portal access without pushing users toward brittle verification steps that create workarounds and support load.

By the numbers:

• More than $350 million in financial fraud committed by ghost student schemes has been uncovered over the past five years.
• In 2024, the California Community Colleges system estimated nearly a third of college applications were fraudulent.

Context

Higher education enrollment has become a high-value identity workflow because it combines access decisions, aid distribution and sensitive personal data in one path. When those steps rely on static credentials, cached attributes or manual document checks, fraudsters can blend into legitimate applicant traffic and move quickly from application to payout.

The deeper governance issue is that education institutions need both assurance and usability. Identity proofing and KYC practices are relevant here because the core challenge is not enrollment volume alone, but deciding whether a person behind a remote application is real, entitled and persistent enough to merit aid access.

Key questions

Q: How should universities verify remote applicants without creating excessive friction?

A: Universities should use layered identity proofing that combines document verification, liveness checks, and challenge questions matched to the applicant's risk. The process should step up only when signals are weak, then issue a verified digital identity or enrolment account tied to an audit trail and a human review path for exceptions.

Q: Why do phishing attacks still succeed against student portals?

A: Phishing still succeeds because student portals often rely on passwords, reusable one-time codes, and poor session binding, which attackers can steal or proxy in real time. Phishing-resistant authentication such as FIDO2 security keys or platform passkeys blocks credential replay and reduces account hijacking even when users are tricked into a fake sign-in page.

Q: How does account takeover redirect financial aid payments?

A: Account takeover redirects financial aid payments by letting an attacker change bank details, contact information, or payout instructions after compromising the student's account. The usual failure point is weak recovery controls, missing step-up verification for high-risk changes, and no approval workflow for payment destination updates, which allows fraud to pass as normal account activity.

Q: What is the difference between one-time passcodes and time-based one-time passcodes in authentication design?

A: One-time passcodes are single-use codes sent to a user by email, SMS, or messaging app. Time-based one-time passcodes are generated by an authenticator app and change every 30 or 60 seconds. TOTP is generally stronger because it is tied to a specific device and narrows the window for attack.

Technical breakdown

Why static enrolment checks fail against synthetic identities

Static checks depend on attributes that are easy to recycle or steal, such as name, date of birth, address and partial government identifiers. When those values are already circulating in breach data, a form can look legitimate even when the applicant is fabricated. Universities often end up validating the document image rather than the person or the device actually submitting the request. That creates a gap between identity proofing and fraud detection, especially when the same data is later used to trigger aid eligibility.

Practical implication: Treat remote application intake as a proofing problem, not a document-scanning problem.

How account takeover redirects aid and portal access

Account takeover in this context usually starts with credential theft, password reset interception or phishing, then ends with abuse of the student portal after login. Once inside, the attacker does not need to break the portal itself. They can change direct deposit details, harvest personal information or divert disbursements through normal account settings. The security failure is that authentication proves a prior account relationship, not current user legitimacy, so existing accounts remain a high-value fraud target. See the Identity Proofing and KYC Guide.

Practical implication: Move sensitive portal changes behind step-up verification tied to current risk, not just a successful login.

Why passwordless verification changes the trust model

Passwordless methods shift the trust anchor away from reusable secrets and toward device-bound or network-backed signals. FIDO-based passkeys reduce phishing exposure because the credential is not meant to be copied into another context, while mobile and network-based checks can add confidence that the asserted identity matches authoritative records. The point is not to eliminate all friction, but to make assurance conditional on stronger signals than passwords or one-time codes can provide. Read the Ultimate Guide to NHIs: Standards.

Practical implication: Prioritise phishing-resistant authentication for student portals that touch financial aid, records or payment data.

Threat narrative

Attacker objective: The objective is to obtain financial aid or related disbursements while appearing to be a legitimate student.

1. Entry begins when fraudsters submit an application using stolen or synthetic identity data that can pass weak automated screening.
2. Credential access follows when they phish students or intercept password reset codes to take over existing portal accounts.
3. Impact occurs when the attacker changes direct deposit details or diverts aid disbursements into external accounts.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ghost student fraud is an identity governance problem, not just an admissions problem. The core weakness is that institutions are being asked to make high-value decisions on people they have not strongly verified, then keep that trust intact across the rest of the student lifecycle. That creates an identity assurance gap that fraudsters can exploit before aid is ever issued. The practitioner conclusion is that enrollment, aid and portal access need a shared assurance model.

Application fraud and account takeover are two sides of the same campus trust gap. One path abuses identity proofing at the front door, the other abuses account recovery after access has already been granted. Together they show that static verification and weak recovery controls fail as a pair, because fraudsters only need one weak seam to turn a legitimate student relationship into a payment diversion channel. The practitioner conclusion is to govern proofing and recovery as one control surface.

Phishing-resistant authentication should be treated as a student-data protection control. In higher education, login compromise is not only an access problem. It is a path to PII exposure, aid redirection and reputational harm, which makes passkeys and device-bound authentication relevant to privacy as well as fraud reduction. The practitioner conclusion is to raise assurance where the data and funds at risk justify it, without forcing every workflow into the same friction level.

Real-time verification creates a more durable assurance model than cached identity data. When applicant attributes are checked against live signals instead of stale records, fraudsters lose the ability to stitch together identities from breached datasets and reused credentials. That matters because higher education is increasingly handling remote-first onboarding at scale. The practitioner conclusion is to anchor trust in current, authoritative signals rather than historical form data.

What this signals

Campus identity assurance will keep moving from document checks to signal fusion. Higher education programmes that still depend on scans, static records and reset codes will keep absorbing fraud pressure because those controls can be replayed at scale. The practical shift is toward live, risk-based verification that can support both access decisions and payment integrity.

Financial aid workflows are becoming fraud operations as much as student services. Once attackers can redirect payouts through ordinary portal actions, the identity team, the financial aid office and the security function all share the same failure surface. The next programme-level question is not whether to add more friction, but where assurance needs to be strongest to stop monetisable abuse without breaking legitimate student access.

For practitioners

• Strengthen applicant proofing at first contact Use real-time signals to verify the person behind a remote application before financial aid decisions are made, especially where the data set can be assembled from breached records.
• Protect aid disbursement changes with step-up checks Require additional verification before a student can change direct deposit information, reset credentials or alter contact details tied to payment flows.
• Replace SMS recovery where aid is at stake Move away from one-time codes sent by text for the highest-risk student workflows and use phishing-resistant methods that are harder to intercept or replay.
• Tier portal access by fraud exposure Keep low-friction paths for low-risk services, but require higher assurance for records, payments and aid actions that can be monetised quickly.

Key takeaways

• Higher education identity systems are being abused at both the application stage and after account takeover, which makes enrolment and aid governance inseparable.
• The scale of the problem is already material, with more than $350 million in ghost student fraud uncovered over five years and nearly a third of applications flagged as fraudulent in one state system.
• Institutions need stronger proofing, phishing-resistant recovery and tighter controls on disbursement changes if they want to preserve access without funding fraud.

Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · Top 10 Online Fraud Attacks · Fraud and Cyber Convergence Guide · Ultimate Guide to NHIs: Standards

Key terms

• Ghost Student Fraud: Ghost student fraud is the creation of fake or bot-generated student accounts to trigger financial aid or enrollment workflows without a real person behind the application. The fraud works by exploiting the period between account creation and the institution’s later verification steps.
• Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, human identity and secrets management in a way that supports cross-functional security and identity teams. It helps practitioners connect assurance, access and lifecycle controls across the programmes they run.