Spirited Away | This Week in Fraud

Hello Fraud Fighters!

Halloween’s over (thank goodness, I live in Salem, MA!), but the ghosts are still cashing checks. The DOJ says fake students have pulled more than $200 million in federal aid since 2021, and the refunds landed in perfectly ordinary bank accounts.

Elsewhere, FATF chases scam-compound cash to the exits, a judge tells BofA that a customer conned into handing over his iPhone never signed off on the transfer, Ofcom bills a telco for the numbers scammers borrowed, and TransUnion finds $3.7 billion in bad debt quietly scrubbed off credit reports.

OK, enough lollygagging. Let's get into it.

Nick

The Justice Department announced the first charges in "Operation Ghostbusters (yes, they really called it that) on October 29, and the scheme it describes is identity fraud at industrial scale with the federal government as the payer. Five defendants across New Jersey, the Eastern District of Virginia and Nebraska are accused of using stolen American identities to open federal student aid accounts, enroll "ghost students" at schools they never attend, and collect the aid refunds. DOJ estimates the broader fraud at more than $200 million since at least 2021, with the FBI running 45 cases across 26 field offices.

In September and October alone, investigators flagged 830,840 potentially fraudulent student aid IDs tied to nearly $130 million and recommended the Department of Education disable them; that's aid linked to suspect accounts, not confirmed losses. Kenyan authorities also helped seize more than $750,000 from a Kenyan national's crypto account, which DOJ called the first international seizure of its kind in Kenya.

The identity theft happens at enrollment, but the money moves through ordinary deposit accounts. According to DOJ, US-based money mules received the refunds into bank accounts, kept a cut and sent the rest overseas. One defendant indicted in Nebraska allegedly kept 30%; the New Jersey defendants, accused of working with contacts in Kenya to obtain more than $1 million in aid, deducted their share before forwarding the remainder. A refund from a real school is about the cleanest-looking deposit an account will ever receive, which is the whole appeal.

Regulators have already moved the burden downstream. FinCEN's July alert, issued with the Education Department's inspector general and the FBI, shifted the focus from application checks to tracking aid through the accounts, devices and networks that receive and move it. It added no new identity verification or biometric requirement for banks; it asked them to spot the flow. The Education Department separately pulled about 300,000 applications for the 2026–27 award year for heightened identity verification.

For credit unions with campus fields of membership, neobanks and prepaid issuers that market to students, the exposure is concentrated and consequently measurable. Accounts funded only by aid refunds, "unrelated" students sharing a device or address, and refunds that leave within a day for P2P apps, crypto or international transfers are where that account, device and network monitoring starts.

The Financial Action Task Force (FATF) published Combating End-to-End Illicit Financial Flows Linked to Scam Compounds on November 5. Drawing on nearly 120 case studies from more than 60 jurisdictions, it finds countries perform better at tracing assets and intercepting payments than at stopping money before it moves, even though victim funds usually become unrecoverable once withdrawn as cash, sent abroad or swapped into virtual assets. The US numbers show how much of that runs through regulated accounts: in September, FinCEN tied roughly $12.7 billion across 33,904 BSA reports to compound-run digital asset scams, with banks filing 41% of reports and flagging $6.4 billion, per Decrypt.

FATF's six new principles push prevention upstream, and the report brings evidence that it works. Indonesia's Anti-Scam Centre blocked more than 515,000 accounts and returned about $10.9 million to victims, while the UK's Scam Signals service, which feeds banks real-time mobile network risk indicators as customers authorize payments, has been linked to a 41% fall in people scammed and a 44% drop in losses. FinCEN's red flags (mules, shell companies, stablecoin transfers, accounts set up by professional launderers) describe accounts somebody approved, so teams without the FIN-2026-SCAMCENTERS key term in their SAR workflow, or a conversation underway with telco partners, have homework.

Bank of America lost a motion to dismiss in a proposed class action brought by customers who were scammed out of $106,000. In 2024, the plaintiff got fake text alerts about suspicious charges, then a FaceTime call from someone posing as a BofA employee. He believed he was sharing his screen with the bank and instead handed the fraudster remote control of his iPhone; the scammer moved $78,000 from checking and $28,000 from savings to another bank. BofA rejected the fraud claims on the grounds that the transfers were authorized, and argued that EFTA didn't apply because the money left by wire.

U.S. District Judge Edward M. Chen disagreed on both counts. Granting screen access under false pretenses isn't "actual authority," he found, and the unauthorized debit inside the app is an intrabank transfer EFTA covers; the wire was an "incidental happenstance." Courts remain split on whether EFTA reaches consumer wires, but remote-access impersonation scams are common enough that this reasoning will get cited. If the debit starts in your app, "the customer authorized it" is a weaker defense than it was a month ago.

Ofcom fined Tismi £437,500 on October 21 for failing to stop phone numbers allocated to it being misused, including by scammers. Tismi didn't properly check the business customers it passed numbers to or monitor how they were used, leaving about 366,000 numbers exposed to potential misuse for more than two years. The same day, Ofcom opened an investigation into Xtra Phones UK, a month after probing Vonage and Voxbone over similar concerns.

On November 3, Ofcom also started a call traceback trial, gathering metadata from every provider that carried a suspected scam call to find where it started. UK banks have argued for years that most scams originate online or through telecoms, while they pick up the reimbursement bill. Number-range KYC is now an enforcement matter, which gives fraud teams a regulator-backed reason to push carriers for shared signals, the same kind FATF credits with cutting losses.

TransUnion's H2 2026 Top Fraud Trends update puts US lenders' exposure to synthetic identities at $2.4 billion at the end of June 2026, with auto lending carrying $1.5 billion of it. These are estimates of potential losses, not losses already booked. Once a synthetic identity gets through onboarding, one profile can be used for a BNPL loan, a phone contract with a handset lease, a credit card and a betting account. 53% of business leaders told TransUnion their organizations are least prepared for synthetic identity fraud.

TransUnion expects $3.7 billion in US charge-offs to be erased from credit reports this year through credit washing suppressions, up from $2.7 billion last year and $1.2 billion in 2024. Bad debt that disappears from the bureau file makes the next application look cleaner. TransUnion is selling new credit washing and synthetic fraud scores alongside the research, so weigh the framing accordingly, but dispute volumes on young tradelines are worth a look either way.

This Week in Fraud is a publication for fintech operators, fraud teams, and risk professionals. Have a tip or story? Reply to this email or drop Nick Holland a note at [email protected].