The Pulse of Higher Ed

A follow-up from the 2026 SOLAR COLO Convening

By Julie Uranis & Tim Lehmann

FSA awards more than $120 billion a year to roughly 13 million students. Some of those enrollments are fraudulent. Fraud rings use stolen identities, synthetic identities assembled from real and fabricated information, and sometimes complicit individuals to enroll, obtain aid, and collect student-aid refunds. The U.S. Department of Education says it prevented $1 billion in this kind of fraud in 2025 alone. California’s community colleges reported losing about $1.8 million in federal and state aid to fraudsters in early 2026. Utah’s public higher-education system reported about $834,000 in confirmed and potential losses from fraudulent applicants from 2025 to 2026. The Financial Crimes Enforcement Network issued a formal alert instructing banks to flag the pattern: new accounts funded solely by student-aid refunds, multiple unrelated students directing refunds to the same account, and funds rapidly moving to common recipients. These banking system flags may never be communicated to institutions.

The U.S. House of Representatives responded this year by passing the No Aid for Ghost Students Act, which would codify new fraud-detection requirements for the Department of Education. As of publication on September 10, 2026, the bill is pending in the Senate. Legislation is a necessary step at the federal level. It is not sufficient at the institutional level, as we both believe early substantive academic engagement is an underused layer in an institution’s financial aid strategy

When Just Enough Isn’t Enough

Here is the pattern, drawn from cases inside SNHU’s own fraud response: a synthetic application goes in roughly a month before a term starts. In the first days of the course there may be a  “pulse check” which can be a login or a click on the syllabus. It is just enough activity to seemingly indicate presence in a course, even if it does not necessarily substantiate engagement from a Title IV perspective. Then, depending on the design of the course, nothing meaningful happens until the financial aid disbursement date. This is the point at which the identity vanishes for good. Traditional admissions and identity checks don’t catch this, because the fraud isn’t built to beat those checks — it’s built to survive them long enough to look like a normal, if quiet, student until aid disburses, a matter of weeks.

That is a narrow window, and it’s a window institutions control since both course requirements and aid disbursal can vary. A course that expects nothing more than a login and a syllabus click in its first couple of weeks is also a course a fraud ring can exploit without much effort. A course that requires an individualized, substantive response from every student in that same window — a discussion post that engages the actual reading, feedback that requires the student to act on it, an assignment a chatbot can’t template — forces actions most fraud rings won’t make. Either the fraudster invests real, sustained effort to keep the identity alive, which erodes the economics of running the scheme at scale, or the identity goes quiet early, offering an opportunity to identify the fraudster earlier and hopefully before aid has been disbursed.

This is different from asking faculty to police their classrooms for criminals. The signals that separate a synthetic identity from a genuinely struggling student are not the same signals, and treating them as identical risks turning a compliance problem into a wave of false accusations against legitimate learners. That distinction matters because even federal fraud guidance cautions against treating any single behavior as proof. FinCEN’s July 2026 alert identifies patterns such as newly established accounts funded solely by student-aid refunds, multiple unrelated students directing refunds to the same account, and funds being rapidly transferred after refunds arrive. But FinCEN is explicit that no single red flag is determinative.

The same principle should guide institutions: an unusual login pattern, generic discussion response, or missed assignment may warrant attention, but none establishes fraud on its own. The useful signal is the pattern across multiple indicators and systems. A real student’s engagement is often hesitant, uneven, and imperfect. We have experience with those learners, they often apologize for a late post, provide a partial answer, or ask a question that shows they’re behind but trying. A synthetic identity’s pattern looks different: batched application timing, logins from the same IP address as several other “students,” discussion responses that read as generic or template-like regardless of the actual prompt. Faculty don’t need to become fraud investigators. They need syllabi that make early, individualized engagement unavoidable, so that the absence of it becomes visible on its own.

Why this was already good practice

The case for early, sustained instructor presence and learner activities in a course didn’t originate with fraud prevention, and it shouldn’t be sold to faculty as a compliance measure alone. The Community of Inquiry framework, and the research that followed it, has argued for two decades that teaching presence — an instructor who is visibly, consistently active in a course rather than passively grading at the end — is tied to how much students report learning and how satisfied they are with a course. That relationship has held up across a large enough number of studies that a 2020 meta-analysis found it to be one of the more consistent findings in online learning research. None of that literature was written with financial aid fraud in mind. It simply describes what already makes an online course work.

What’s changed is the regulatory stakes attached to the same behavior. New R2T4 regulations effective July 1, 2026, codify longstanding guidance requiring institutions that are required to take attendance to document the institution’s determination that a student withdrew no later than 14 days after the student’s last date of attendance. An institution that can’t produce evidence of engagement — because the course never asked for any until week eight — is exposed on two fronts at once: a compliance finding if regulators look closely, and a fraud loss if the “student” was never real. A course designed around regular, substantive interaction from day one, imbued with the instructor’s presence, can support both fraud mitigation and R2T4 documentation, in some cases using overlapping evidence. Recalibrating courses to be ‘friction-right’, a term coined by Tim during his 2026 presentation to COLOs at the SOLAR COLO convening in July, is an important step.

What institutional leaders should actually do

Three moves belong on a president’s or provost’s desk, not just a financial aid director’s:

First, direct academic leadership to redesign early-course pacing, in every modality, considering the institution’s financial aid calendar. Requiring individualized, substantive interaction, not just access to materials,  well before any disbursement or census date is an important first step. This is a curriculum and instructional design decision, informed by institutional financial aid disbursement information.

Second, train faculty to recognize the behavioral difference between a struggling student and a synthetic one, explicitly, so the response is course redesign rather than suspicion aimed at slower or less confident learners.

Third, connect the data. Learning management system engagement analytics and financial aid’s fraud-monitoring systems are frequently maintained by offices that never compare notes. They’re looking at the same first few weeks of the term from two different systems. Closing that gap is an institutional decision, and it’s overdue.

Fraud rings adapted quickly to open enrollment, minimal early friction, and passive course design, because those are the paths of least resistance. These same fraudsters are far less efficient against an instructor and course that asks something real of every student before aid disburses. That’s not a new argument for good teaching. It’s an old one, with a new reason for leaders to act on it.

 

Julie Uranis, Ph.D., Senior Vice President for Online and Strategic Initiatives at UPCEA, leads UPCEA’s work in supporting digital learning professionals. She built her career across professional and continuing education, workforce-aligned and alternative credentials, competency-based education, and adult learner pathways, with earlier roles inclusive of teaching, distance-education administration, and state higher education policy at Eastern Michigan University and Western Kentucky University.

Timothy Lehmann is Vice President of Student Financial Services at Southern New Hampshire University, where he leads financial aid, fraud mitigation, and compliance with a student-first lens.

 

Sources

Caskurlu, S., Maeda, Y., Richardson, J. C., & Lv, J. (2020). A meta-analysis addressing the relationship between teaching presence and students’ satisfaction and learning. Computers & Education, 157, 103966. https://doi.org/10.1016/j.compedu.2020.103966

Federal Student Aid. (2026, March 27). Implementation of Return of Title IV Funds (R2T4) regulations effective July 1, 2026 [Electronic announcement]. U.S. Department of Education. https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2026-03-27/implementation-return-title-iv-funds-r2t4-regulations-effective-july-1-2026

Financial Crimes Enforcement Network. (2026, July 24). FinCEN alert: Fraud schemes targeting federal student aid (FIN-2026-Alert004). U.S. Department of the Treasury.

https://www.fincen.gov/system/files/2026-07/FinCEN-Alert-Fraud-Schemes-Targeting-Federal-Student-Aid.pdf

Alonso, J. (2026, June 22). What Is FAFSA Fraud, and Why Is Congress Working to Stamp It Out?. Inside Higher Ed. https://www.insidehighered.com/news/students/financial-aid/2026/06/22/understanding-crackdown-fafsa-fraud

No Aid for Ghost Students Act of 2026, H.R. 7892, 119th Cong. (2026). https://www.congress.gov/bill/119th-congress/house-bill/7892

Pina, A. A., & Martindale, T. (2023). Regular and Substantive Interaction in Online Courses: Why it Matters for Administrators. Online Journal of Distance Learning Administration, 26(2), 1-14. 

Garrison, D. R., Anderson, T., & Archer, W. (2000). Critical inquiry in a text-based environment: Computer conferencing in higher education. The Internet and Higher Education, 2(2–3), 87–105.

Richardson, J. C., & Swan, K. (2003). Examining social presence in online courses in relation to students’ perceived learning and satisfaction. Journal of Asynchronous Learning Networks, 7(1), 68–88.

U.S. Department of Education. (2026, February 12). Federal Student Aid (FSA). https://www.ed.gov/about/ed-offices/fsa 

AI Use Disclosure

This post was developed with the assistance of Claude (Sonnet 5) and ChatGPT (GPT-5.6 Sol). 

The argument, the fraud-detection framework and the underlying professional expertise are Timothy Lehmann’s own, drawn from his presentation at UPCEA’s July 2026 COLO Convening ahead of SOLAR26.

Julie Uranis used Claude and ChatGPT to draft the post, synthesizing Tim’s presentation and presenter notes. Claude conducted independent research to source supporting evidence for Tim’s framework. Claude and ChatGPT were used to verify factual claims. Claude assembled the citation list in APA format.

Both authors reviewed and revised the AI-assisted draft, and take full responsibility for its accuracy, arguments, and final published wording.