Francis Smith Mogambi had earned the right to live in America, beating thousands of Green Card lottery applicants in 2024.
Mogambi went through police and security clearances, fingerprinting and intense scrutiny of his life before Uncle Sam allowed him to become a permanent resident of the US.
Barely two years later, US prosecutors now allege that the opportunity Mogambi seized was one to be the boots on the ground for a network of scammers who stole the identities of American citizens, and used them to steal $200 million (Sh25.8 billion) from a student loans scheme.
Mogambi has been arrested and is awaiting prosecution in the US, as authorities from his birth and adopted countries work to round up more Kenyans who will be extradited to face trial in connection with the student loans scam.
According to federal prosecutors, he allegedly worked with associates in Kenya between November 2025 and May 2026 to obtain personal information belonging to American citizens and use it to enrol them in educational institutions without their knowledge.
The scheme allegedly involved several online colleges, including Grand Canyon University, American Public University, Colorado Technical University, Ultimate Medical Academy and Chemeketa Community College.
Mogambi allegedly received financial aid cheques issued in the names of fictitious students, endorsed them to himself and deposited the proceeds into his bank accounts. He reportedly retained 30 per cent of the money and sent the balance to his Kenyan associates.
Francis Smith Mogambi.
Photo credit: Pool
The investigation gathered momentum in April 2026 after Lincoln Police Department officers were called to the University of Nebraska-Lincoln Student Union over a suspected fraud report.
A witness familiar with the alleged operation told investigators that Mogambi had been receiving student financial aid cheques issued in the names of people fraudulently enrolled in online colleges.
The witness reportedly became aware of the scheme after Mogambi attempted to recruit him, offering $2,000 (about Sh259,000) every week to participate.
Investigators subsequently examined photographs of cheques and documents recovered from Mogambi's residence. The records included cheques bearing different students' names but carrying endorsements payable to Mogambi.
According to the arrest affidavit, police observed that the signatures appeared to have been made in the same handwriting.
“The cheques were drawn on behalf of different purported students, but they all carried endorsements payable to Francis Smith Mogambi in what appeared to be the same handwriting,” police said in the affidavit.
Investigators obtained financial records from Bank of America, Wells Fargo, US Bank and Chase Bank, tracing deposits and transactions linked to the suspect.
They also contacted alleged victims, including a Wisconsin resident who discovered that he had been enrolled at Colorado Technical University after a student loan appeared on his credit report.
The man told investigators that he had never enrolled at the institution and knew nothing about the financial aid issued in his name.
Police established approximately $20,397 (about Sh2.56 million) in forged cheques cashed by Mogambi.
On October 19, a federal grand jury in Nebraska returned a 10-count indictment against him, charging him with five counts of theft of government money and five counts of aggravated identity theft.
For years, unsuspecting Americans were being enrolled in colleges they had never applied to and, on paper, being lent money to study. On the ground, nobody was going to class, and millions in student loans were ending up in the pockets of scammers, some in Kenya.
Kenyan and US authorities have already seized $750,000 (Sh97.4 million), which was allegedly part of the proceeds from the student loans scam and which was stashed in a cryptocurrency account operated by a Kenyan national in Nairobi.
The US Justice Department confirmed that intelligence from Kenyan law enforcement partners had enabled the seizure.
Behind the fictitious students were stolen identities, fraudulent applications, forged cheques and a sophisticated financial trail stretching from American college campuses to bank accounts and cryptocurrency accounts linked to Kenya.
Dubbed ‘Operation Ghostbusters’, the investigation has resulted in five defendants being charged in three separate cases in Nebraska, New Jersey and Virginia, with authorities seizing more than $750,000 (about Sh97 million) in cryptocurrency from an account belonging to a Kenyan national connected to the wider scheme.
US authorities are working with Kenya’s Directorate of Criminal Investigations (DCI), Assets Recovery Agency (ARA), Office of the Director of Public Prosecutions (ODPP), Kenya Revenue Authority (KRA) and Financial Reporting Centre (FRC).
Their cooperation has helped investigators follow the money beyond American borders, culminating in the seizure of cryptocurrency linked to a Kenyan national.
The alleged fraud exploited the Free Application for Federal Student Aid (FAFSA), the system through which students apply for federal government assistance to finance higher education.
Under the programme, eligible students can receive grants and loans to meet tuition and other education-related expenses.
The system became an attractive target because successful applicants could receive financial assistance even when enrolled in institutions offering online courses.
Investigators say fraudsters obtained personal information belonging to American citizens and used it to create fraudulent FAFSA accounts.
The stolen identities were then used to submit applications and enrol unsuspecting individuals in colleges and universities, creating what investigators described as ghost students.
Once the applications were approved, institutions received money to cover tuition and other charges, while the remaining financial aid was released as refunds which were paid to bank accounts controlled by fraudsters or their American intermediaries, who subsequently transferred portions of the proceeds to associates overseas.
The operation was particularly difficult to detect because the identities belonged to real Americans, even though the individuals had never applied for financial aid or enrolled in the institutions receiving the money.
Some victims discovered the fraud only after student loans appeared on their credit reports. Others learnt that colleges hundreds of kilometres away had records showing them as students.
Investigators also established that fraudsters used artificial intelligence to maintain the appearance of genuine student participation, including completing coursework to keep fictitious enrolments active and ensure financial aid continued flowing.
The first indications of a nationwide problem emerged around 2021, when community colleges and universities across the US began identifying suspicious financial aid applications.
The institutions noticed that refunds were being disbursed into bank accounts opened in the names of individuals other than the students who had supposedly applied for assistance.
FBI's Richmond Field Office
The Department of Education's Office of Inspector General subsequently referred suspected fraud to the FBI's Richmond Field Office, setting in motion an investigation that would eventually expand across the country.
Rather than treating each suspicious application as an isolated incident, investigators began examining similarities between applications, financial accounts, institutions and refund transactions.
The FBI Richmond cyber squad worked with education investigators to identify patterns linking seemingly unrelated cases.
The investigation uncovered hundreds of participants and hundreds of millions of dollars in suspected fraudulent activity, prompting authorities to expand the inquiry to other FBI field offices.
First Assistant US Attorney Theophani K. Stamos said the investigation had demonstrated how data analysis could expose criminal activity that had previously gone unnoticed.
By October 2026, the investigation had grown to more than 40 open cases across 26 FBI field offices, with more than 20 US Attorneys' Offices involved.
The case, however, was only one strand of a much wider investigation involving alleged money mules, bank accounts and Kenyan beneficiaries.
While the Nebraska investigation exposed one method of cashing fraudulent cheques, a separate case in New Jersey revealed a more extensive financial network involving American intermediaries and alleged Kenyan beneficiaries.
Prosecutors say Mabed Patricia Utate-Alberto, Patricia Arisleydi Perez and George Arturo Alfau Mendez worked with people in Kenya between March 2021 and January 2026 to defraud the Department of Education.
The three allegedly acted as money mules, using American bank accounts to receive funds obtained through fraudulent FAFSA applications submitted using stolen identities.
They would allegedly receive the money, retain an agreed portion and transfer the remainder to associates in Kenya.
More than $1 million (Sh129.9 million) was allegedly obtained through the scheme, with prosecutors estimating the intended loss at approximately $1.5 million (194.9 million).
Investigators identified two alleged co-conspirators based in Kenya, who are said to be associated with a safari company.
The case suggests that the operation was not simply about individuals stealing identities and cashing cheques. It involved people responsible for sourcing personal information, submitting applications, receiving government funds and arranging international transfers.
The involvement of a purported safari company raises further questions about whether commercial operations were being used to facilitate the movement of proceeds.
Another case announced by the Justice Department on October 29 provides an even clearer picture of the scale of the alleged financial transactions.
A federal grand jury in the Eastern District of Virginia returned an indictment on October 21 against a Kenyan national whose identity remains under seal in the published announcement.
The suspect is accused of conspiring with fraudsters in Kenya to obtain stolen American identities and use them to submit fraudulent student financial aid applications.
According to prosecutors, the individual acted as a money mule in the US, using multiple bank accounts across several financial institutions to receive more than 700 fraudulent federal student aid refund deposits.
Investigators subsequently traced thousands of wire transfers and transactions through money-service businesses, establishing that at least $1.3 million (about Sh168 million) had been transferred to accounts in the US and Kenya.
In September 2026, representatives of the Justice Department's National Fraud Enforcement Division and partner agencies travelled to Kenya to discuss extradition, prosecution and the recovery of funds allegedly stolen from American taxpayers.
The US Embassy subsequently confirmed that the cooperation extended to the KRA and FRC, bringing together investigators, prosecutors and financial intelligence agencies.
The first public announcement under Operation Ghostbusters involved five defendants in three US jurisdictions.
In Nebraska, Mogambi was arrested following his indictment.
In New Jersey, all three defendants, Utate-Alberto, Perez and Alfau Mendez, were arrested.
In Virginia, a Kenyan national was indicted, although the published Justice Department announcement does not confirm whether the suspect has been arrested.
