So-called “ghost students” stole about $500,000 in financial aid from Utah’s public colleges and universities over the last academic year, according to a state audit released Tuesday.

That’s only counting the confirmed losses. Schools reported another roughly $334,000 in “potential” losses that are still being assessed, plus more that might remain “undetected,” landing the total somewhere near a potential $1 million that’s irrecoverable.

The new report from the Office of the Legislative Auditor General details for the first time the toll this type of enrollment fraud is having on Utah’s higher education institutions — after it also previously wreaked havoc at other schools nationwide.

“The surge of enrollment fraud in Utah should have been expected,” the 34-page audit states, but warnings weren’t heeded.

The report identified several shortfalls where auditors found Utah’s eight public schools, and the system that governs them, allegedly failed to proactively prepare.

The audit also repeats a frequent criticism of the overarching Utah System of Higher Education: It ignored opportunities to collaborate and communicate among institutions, which auditors say could have prevented further loss.

Overall, school staff reported being afraid to alert other institutions about what seemed to be going on, worried about the potential of sharing private student data. So they didn’t raise red flags; or, if they did, schools didn’t respond to them in a timely manner, the audit found.

Because of that, the auditors say, the same fake student accounts were used multiple times at as many as five separate schools to collect more cash.

The “ghost student” phenomenon occurs when people use fake or stolen IDs to apply for financial aid through the federal form commonly referred to as FAFSA. Once that application is complete, they then apply to a school, which is responsible for disbursing any awarded federal student aid money when an academic term starts.

Once a fake student has gamed the system well enough to get the money — sometimes even going so far as to enroll in classes to appear more legitimate — they disappear.

“If they succeed, they take the money and run,” said Joe Hadfield, the lead performance auditor, in a presentation of the findings to a legislative subcommittee Tuesday.

The audits says the attempts “vary in sophistication, ranging from high-volume automated applications to more tailored submissions designed to evade detection,” according to the audit.

Hadfield said fraudsters are also increasingly relying on artificial intelligence to get around barriers.

But no matter the approach, schools are on the hook to repay the misspent funds back to the federal government. That leaves institutions with less funding, which auditors said can harm real Utah students.

The issue has also been taken up by federal Rep. Burgess Owens, R-Utah, who has introduced the No Aid for Ghost Students Act, which has passed in the House. It attempts to stop FAFSA application fraud by requiring the U.S. Department of Education to create identity-fraud detection screening.

Schools would be notified of which applicants are flagged; then, institutions would be required to seek additional verification from those individuals.

The Utah audits notes that the Department of Education counted 150,000 fraudulent identities with the FAFSA form in 2025.

More access = more fraud

In Utah, access to higher education was widely expanded in January 2024 under a well-meaning effort. The audit notes that likely opened the door to more “ghost student” fraud.

At that time, the Utah Board of Higher Education made it free for any in-state students to apply to any public Utah university or college. Eliminating the application fee was meant to remove a barrier for students who couldn’t afford to pay.

That also opened up the floodgates for fraudsters. Applications to Utah schools increased, the audit notes, with many of them fake.

The auditors assert the higher education board knew that could happen.

For instance, Salt Lake Community College removed its fee in fall 2023, before the rest of the state’s schools, and saw a smattering of “ghost students” apply. SLCC “proactively warned” the Utah System of Higher Education and the other institutions, according to the audit.

But that wasn’t heeded, the audit states. Instead, schools operated in siloes.

“Institutions addressed fraud largely in isolation despite facing similar risks, resulting in delayed responses and financial losses,” the report says.

The audits notes that SLCC has received the largest share of fraudulent applications, with about 2,000 in the last five years. Since 2025, six other universities in the Utah System of Higher Education have received a combined 4,500, the audit states.

Auditors allege that removing the application fee statewide also ignored the advice of admissions directors at Utah schools, whom the audit says asked the higher education board to keep a fee to serve as a deterrent to fraud.

They’d watched California experience a fraud spike in 2021, after similarly moving more applications and services online following the COVID-19 pandemic, plus removing some application fees. Access increased, but so did fraud.

The audits notes that California’s community colleges have estimated a loss of $18 million in aid since 2021; 31% of their applicants were fraudulent in 2024. The state is now considering reinstating application fees.

“These examples of enrollment fraud should have signaled to USHE institutions to implement fraud prevention solutions before fraud surged more broadly in Utah,” the audit states. “However, most institutions reacted when the problem arrived rather than proactively preparing.”

Auditors commended the Utah board for trying to improve access, but they argued that needs to be balanced with security and communication.

Utah’s commissioner over higher education, Geoff Landward, responded to the audit with a letter, saying he appreciates the report’s recommendations. He promised to strengthen collaboration moving forward.

During Tuesday’s meeting, he acknowledged the “missed opportunity” to act as a system but stood by the efforts to make applying to college more accessible.

Landward said he doesn’t want the state’s response to make access to higher education “harder or more expensive.”

“There have to be other opportunities to address this problem,” he added.

Senate Minority Leader Luz Escamilla, D-Salt Lake City, echoed that concern.

She questioned whether schools or the criminal justice system could go after perpetrators, rather than the state introducing a barrier to students. Landward said resources are better spent on prevention and detection.

“Finding out who’s doing it is near impossible,” he said.

Responses by schools varied widely

In addition to the lost funding, the audit reports a serious impact for real students when schools aren’t prepared to handle fraudulent applications.

In one example at Utah Valley University, the fake “ghost students” were able to get so far in the process that they applied for classes — and pushed real students onto waitlists.

At another school, Weber State University, the fraudulent accounts signed up for appointments with advisers to appear more legitimate. Those advising times were then unavailable for real students.

Overall, the audit notes, staff at seven of the eight of Utah’s public colleges and universities spent a combined 15,000 hours over the last year trying to mitigate the issues.

The audit states institutions are also now taking longer to respond to real student applications because of the volume of fraudulent students applying.

Some schools have been affected more than others. The report says the bulk of the financial losses were concentrated at three schools, though it does not name them.

One school saw $140,000 in confirmed financial aid losses handed over to fake students; that same school flagged another $320,000 in “potential” losses still being assessed. A second institution saw nearly $200,00 in confirmed losses. A third saw roughly $150,000.

House Speaker Mike Schultz questioned whether those three schools received more fraudulent applications or were less equipped to respond.

Nick Varney, senior audit and operations supervisor, said it was the latter. Some institutions, he said, receive more fake applications but reported far less financial loss.

Three other schools, for instance, reported no losses, according to the audit.

Utah State University was a noted success story. In one weekend, according to the audit, it received roughly 700 fraudulent applicants.

“Employees immediately notified leadership and temporarily shut down the application portal until they implemented stronger controls,” the report notes. “Senior leadership supported additional system controls that prevented financial loss and effectively blocked future fraudulent attempts.”

State lawmakers applauded that quick response Tuesday.

Southern Utah University, the audit says, could’ve benefited from that approach.

It now has a “dynamic in-house fraud detection system,” according to the report, which has identified more than 1,500 fake accounts. But that was only developed after financial losses.

Similarly, the report notes other institutions had strong identity-verification systems for applying to online programs; others didn’t. Those should be shared and implemented at every school, auditors recommend.

Hadfield, the lead auditor, suggested schools need to “adapt quickly and together.”

Recommendations to prevent fraud

To address any concerns about staff potentially sharing private student information as they try to flag potential fraud, the auditors suggested that the Legislature could create exceptions in situations like this.

That has been done in California, where community colleges are now partnering with the state’s Department of Motor Vehicles “to more effectively verify student identities” against the state’s driver ID database, the audit states.

Utah attempted to do something similar, but it hasn’t worked as planned, the audit notes.

That came with the “Admit Utah” program announced in 2024. The Utah Board of Higher Education first launched that with a pilot in Provo School District, which the auditors note showed gaps.

Under the program, Utah high school seniors are guaranteed admission from at least one of the state’s public universities, colleges or technical colleges if they apply on the “Admit Utah” website.

Their identities were verified by the school district, to confirm students applying were real. But college admissions directors said many of the applications ended up without the necessary information, such as student ID numbers to allow them to retrieve high school transcripts.

Some of the problems there, the audit notes, were also based on data-sharing concerns from the Utah State Board of Education, which governs public K-12 schools in the state.

The auditors say the idea for “Admit Utah” is good, but it needs to be refined as it’s further rolled out. And better data-sharing guidance from the state would help.

In addition to that, and to improve collaboration systemwide, the report makes several recommendations:

• It directs the Utah Board of Higher Education to create a task force made up of representatives from each school to study fraud prevention and best practices.

• It advises the system to also consider either including application fees again — or at least introducing them for online programs. And it suggests that enrollment deposits might be another way to weed out fake students.

• It says each institution should appoint an administrator to lead efforts on a school-level for detecting and responding to fraud.

• The system should also track key fraud metrics moving forward to raise greater awareness.

Landward, in his letter, confirmed his intent to act on those. He said he’d like to have a task force convened and meeting by September. And he plans for an initial report on fraud metrics to be prepared by December.

During the meeting Tuesday, he also supported better information sharing, with approval by the Legislature.

“It’s always baffling to me when we create this kind of roadblocks to sharing information,” he said. “We’ll look to learn from mistakes in our past practice.”