Category: Fraud, Scams and Phishing

  • U.S. Treasury Identifies $270 Million in Suspicious Activity Linked to Federal Student Aid Fraud

    October 19, 2026

    FinCEN Refers Findings to Federal Investigators to Combat Fraud and Protect Taxpayer Dollars

    WASHINGTON – The U.S. Department of the Treasury announced today that its Financial Crimes Enforcement Network (FinCEN) has identified approximately $270 million in suspicious financial activity potentially linked to fraud against federal student aid programs. FinCEN has referred these findings to federal investigators to pursue potential fraud schemes targeting federal student aid programs and help ensure those responsible are held accountable. These referrals underscore the Trump Administration’s commitment to eliminating fraud, protecting taxpayers, and safeguarding the integrity of federal student aid programs.

    “Federal student aid is intended to expand educational opportunities, not line the pockets of fraudsters who steal from students pursuing their education and hardworking taxpayers,” said Treasury Secretary Scott Bessent. “The Trump Administration will not tolerate criminals who exploit government programs for personal gain. Treasury is working with financial institutions and law enforcement to identify these fraud schemes, recover stolen funds, and hold those responsible accountable.”

    “Federal student aid is meant to support students, not fraudsters. That is exactly why we introduced the new FAFSA fraud detection tool earlier this year, which stops fraud at the start of the federal student aid process,” said Education Secretary Linda McMahon. “We are proud to partner with the White House Task Force to combat fraud, waste, and abuse across these critical programs – already saving American taxpayers more than $2 billion in less than 2 years!”

    In a July 2026 Alert, FinCEN warned financial institutions about student aid fraud and asked them to report suspicious activity. That Alert explained that schools or their payment contractors often send aid refunds by electronic bank transfer and that the payment description often includes the word “refund” along with the school’s name or initials. The Alert also noted that fraudsters often move stolen aid through money mules, shell companies, and fake accounts to hide the source of the money. These red flags help financial institutions spot suspicious payments and report them to FinCEN in suspicious activity reports, as required by the Bank Secrecy Act (BSA).

    Financial institutions have filed nearly 100 suspicious activity reports since the July Alert. FinCEN’s review of these reports identified more than 20,000 potentially suspicious transactions since February 2026. These reports reflect suspicious activity that has been identified and reported by financial institutions and, therefore, should not be considered a complete representation of the scope of any particular type of suspicious activity.  Accordingly, FinCEN has referred this information to law enforcement as tip-and-lead information for further investigation.

    Federal student aid fraud schemes often involve fraudulent enrollments designed to divert financial assistance away from legitimate students. In “ghost student” schemes, criminals steal personal information, such as names and Social Security numbers, and use it to enroll fake students in classes under a victim’s identity. Fraudsters may also use super intelligence to produce fake documents that blend stolen information with invented details, which creates what are known as synthetic identities that can pass identity checks. Victims, including minors, often do not know that someone has received student aid in their name.

    In “straw student” schemes, fraud rings pay real people for their personal information, enroll those people at a school, and then keep the aid refunds issued to them. Corrupt school employees sometimes help these rings by recruiting straw students and altering their school records. Student aid fraud drains taxpayer funds, and in some cases, keeps real students out of classes that fake enrollees have filled.

    Student aid fraud has real consequences for students and American taxpayers. It drains finite grant resources from deserving students, potentially prevents legitimate students from enrolling in classes occupied by fraudulent enrollees, and can leave identity theft victims responsible for debts they never incurred.

    As part of the Trump Administration’s efforts to eliminate fraud, waste, and abuse across the federal government, Treasury is working with the White House Task Force to Eliminate Fraud, led by Vice President Vance, and encouraging whistleblowers to report credible information involving fraud, money laundering, sanctions violations, and tax-law violations. Whistleblower tips, combined with financial institutions’ reporting under the Bank Secrecy Act, help Treasury and its law enforcement partners uncover criminal networks, recover taxpayer funds, and hold bad actors accountable.

    Treasury will continue to leverage financial intelligence, strengthen coordination across government, and pursue those who seek to profit by defrauding American taxpayers and harming legitimate students.

    In My Humble Opinion:

    Firstly, “potentially linked” is pretty weak sauce. FinCEN is not referring this for prosecution – they’re referring it for investigation.

    Secondly, $270 million total? That’s a rounding error in the federal budget, assuming it’s all found to actually be fraudulent. And you know that it’s not a single borrower – it’s much more likely to be thousands, if not tens of thousands. So, the cost of the investigations are likely to rival the actual funds recovered.

    If I didn’t know better, I’d guess this has something to do with the calendar….

  • Office of Financial Sanctions Implementation HM Treasury

    New guidance on verifying communications claiming to be from OFSI 

    OFSI has published new guidance on how to verify whether communications claiming to be from OFSI are genuine. 

    The guidance provides information to help individuals verify communications claiming to be from OFSI, including signs that a communication may not be genuine and sets out what to do if you are unsure. 

    The guidance:

    Check if an email or communication claiming to be from OFSI is genuine

    OFSI will never ask you to make a payment, transfer cryptocurrency, pay a fee to obtain a licence, or pay to release frozen funds. 

    1.  I’ve received a suspicious email or communication claiming to be from OFSI. What should I do? 

    If you receive a suspicious communication claiming to be from OFSI, HM Treasury or another government body: 

    • do not reply 
    • do not click any links or open attachments 
    • do not make any payments 
    • do not use the contact details they have provided 

    Instead, use the official contact details published on GOV.UK. If you’re unsure if a communication is genuine, contact OFSI directly at ofsi@hmtreasury.gov.ukimmediately. 

    2. How to check if an OFSI email or letter is genuine  

    Official OFSI emails are sent from: 

    Official UK government email addresses end in ‘gov.uk’. Always check the full email address carefully. 

    Scammers may use email addresses or display names that appear to come from a UK government department. 

    They may also use official-looking documents, branding, formatting or language to make communications appear genuine. A professional-looking email or letter does not mean it is authentic. 

    3. Does OFSI contact people by text message or WhatsApp? 

    No, OFSI will never contact you via: 

    • Text message  
    • WhatsApp 

    If you receive a message claiming to be from OFSI through these channels, you should treat it as suspicious.  

    4.  Signs an OFSI communication may be a scam 

    Be cautious if a communication claiming to be from OFSI: 

    • Asks you to pay a fee for an OFSI licence application. Applications for OFSI licences are made through the official GOV.UK website and there is no charge to apply for a licence   
    • Asks you to send or transfer money, cryptocurrency, or make a payment to unfreeze funds or release assets. OFSI does not require individuals to transfer money or cryptocurrency to obtain a licence, release frozen funds or assets, avoid enforcement action, or verify compliance with UK financial sanctions. Funds are frozen by relevant persons, such as banks, in accordance with UK sanctions legislation. Payment to OFSI, a bank or a third party will not unfreeze funds. 
    • Asks you to provide personal, banking or financial information. Genuine OFSI communications will not ask you to provide sensitive financial information or security credentials unexpectedly. If you are unsure whether a communication is genuine, contact OFSI directly using the contact details published on GOV.UK.  
    • Pressure you to make an immediate payment to avoid fines, penalties or other consequences. Communications that demand urgent payment or threaten enforcement action if you do not pay should be treated with caution. 

    5.  Report a scam or phishing email 

    If you believe you have received a scam or phishing email claiming to be from OFSI, you can report it to the National Cyber Security Centre.

    If you’ve been a victim of a scam, suffered financial loss or responded to a scam communication, report it to Report Fraud through their website or to Police Scotland by calling 101 if you live in Scotland.  

    You can report fraud to Report Fraud if you are in the UK, if the fraud occurred in the UK or if the fraud is related to the UK and the internet. Report Fraud also provides information on reporting fraud in a range of languages and guidance for people who may need support accessing its services. 

    If you live outside the UK, you can also report it to your local law enforcement agency or the relevant fraud reporting authority in your country.