Once limited to small pockets of higher education, “ghost students” now cast a growing shadow over financial aid offices nationwide. Online institutions are particularly vulnerable because of the nature of their student populations and the remote pathways through which students enroll, engage, and receive aid. These are not students in the traditional sense, but fraudulent enrollments designed to access federal aid funds before vanishing from the institution. The goal is simple: enroll in courses, remain active just long enough for financial aid funds to disburse, and then disappear.
At Excelsior University, where online access is central to our mission, this threat is not theoretical. We see it, we investigate it, and we have had to rethink how we respond.
With a primarily adult online student population, identifying potential ghost students requires more than a single document review or a single point of contact. We cannot simply ask students to come into an office and answer a few questions. Instead, we have learned to view each student as the sum of their parts, analyzing data points across multiple systems and layering each new piece of information against the last. We look for inconsistencies within institutional records, across federal verification documents, and in observations shared by colleagues who sense that something does not seem right. Over time, those inconsistencies revealed patterns, and we knew we needed to dig deeper.
“We have learned to view each student as the sum of their parts.”
From Silos to a Shared Response
Early in this work, our approach was largely manual. Reviews included validating high school completion, comparing signatures across federal verification documents, and examining records for inconsistencies that could indicate fraud. What we uncovered was unsettling. Many cases appeared to involve stolen identities, often belonging to individuals who were unlikely to detect the fraud themselves.
Then came COVID-19. The rapid expansion of online learning created new opportunities for bad actors already familiar with the nuances of federal aid. Combined with the rise of artificial intelligence and increasingly scalable fraud tactics, the risk became faster moving, harder to detect, and more difficult to manage through manual review alone. We began asking ourselves a necessary question: was manual review really the only way to manage this risk? The answer was a quick and emphatic no.
From there, we brought together representatives from admissions, advising, financial aid, student accounts, academic affairs, IT, and other areas touched by the student journey. We mapped the points where risk could enter, where concerns were being identified, and where responsibility had historically landed. What we found were silos organized by function, with most concerns ultimately routed to financial aid for resolution. The result was an unsustainable volume of suspicious files that required manual review, Title IV verification, and ongoing monitoring. Through those discussions, a clear theme emerged: ghost student fraud could not be solved by financial aid alone. We needed a better way to prevent fraudulent students from entering our systems, a proactive method to flag potential risk, and a reliable process to authenticate identity when concerns remained. That became the foundation of our approach.
Our next step was to look beyond our own institution. We connected with colleagues across the online higher education community to compare what we were seeing, what patterns were emerging, and which mitigation strategies were proving effective or falling short. Those conversations reinforced what we were already learning internally: no single checkpoint, document review, or technology solution would solve the problem on its own.
Three Layers, One Proactive Strategy
We ultimately developed a layered, three-part approach.
First, we implemented multi-factor authentication at the point of application submission to help identify invalid email addresses or phone numbers before a student proceeded into the enrollment process.
Second, we built a predictive risk model that converted the behaviors and characteristics of previously identified fraudulent files into a risk score, allowing us to assess the likelihood of fraud without relying solely on manual review.
Third, we deployed a third-party tool to support automated identity and risk-based screening across multiple data sources, including indicators such as email creation history and prior identity theft activity.
Each layer had value, but the strength of the strategy was in how the pieces worked together. Multi-factor authentication allowed us to cast a wide net at the earliest possible point. It was not designed to solve the problem alone, but it helped prevent some fraudulent activity from moving forward when invalid or unverifiable contact information was used at the time of application.
The predictive model was where the work became especially powerful. With an accuracy rate of 96.57%, the model helped our frontline admissions teams identify potential risk earlier and reduced the burden of manually connecting data points. Just as important, it allowed staff to redirect time toward real students who needed support.
The final phase was the deployment of a self-sufficient, automated monitoring process for incoming admissions activity. Every student moves through the same risk-based screening process:
For low-risk students, the process creates no disruption to the enrollment experience.
Medium-risk students are asked to provide additional identity confirmation.
High-risk students move through a more rigorous review, including live photo or video verification when needed to confirm identity.
This approach helped us move from a reactive model to a more proactive one. Instead of waiting for concerns to surface after financial aid packaging or registering for their first course, we began identifying risk earlier, applying consistent standards, measuring our efficacy, and reserving deeper review for the cases that warranted it most.
Fraudsters are smart, and their tactics will continue to evolve as institutions identify and close existing vulnerabilities. Our approach will need to evolve as well, but it is built on a foundation designed to adapt to changing behaviors and emerging patterns. For Excelsior, ghost student mitigation is not about finding a single perfect solution. It is about building a culture of shared responsibility, using data to see what individual offices cannot see alone, and protecting the integrity of financial aid while preserving access for the students we are here to serve.