College campuses have a ghost student problem.
Fraudsters are enrolling in classes under stolen identities, collecting financial aid and tuition refunds, and vanishing before ever attending a single lecture. The U.S. Department of Education estimates that nearly $90 million was disbursed to ineligible recipients under weak verification processes, including thousands of payments to deceased individuals.
Since tightening its requirements, the DOE has blocked more than $1 billion in attempted student financial aid fraud since January 2025 alone.
In a March 2026 report, Gartner named 1Kosmos as a representative vendor for automated identity verification in higher education.
Here's what the report says, and why it matters to IT and security leaders in the higher ed space.
The core problem: data checks can't stop stolen identities
From the report:
"Given the variety of ways fraudsters can acquire and exploit identity data, it becomes clear that relying solely on data-centric verification is insufficient and leaves institutions exposed to significant risk."
Our take
Most institutions still lean on knowledge-based authentication (KBA), which asks applicants to answer security questions drawn from credit bureau records, past addresses, or account history.
NIST's SP 800-63A identity proofing guidelines state that "knowledge-based verification (KBV) or knowledge-based authentication SHALL NOT be used for identity verification," reversing earlier editions that permitted KBA under limited conditions.
The flaw is structural: KBA tests whether someone can produce answers tied to a claimed identity, not whether they're the person behind it. Those answers are no longer hard to find, since data broker files, public records, and breach dumps carry the same personal details the questions draw from. A fraudster working with stolen credentials can supply the same information a legitimate applicant would.
KBA was built to slow down casual fraud, not survive the volume of breached personal data now in circulation. Document and biometric verification checks against credible sources, with authoritative issuing-authority checks available for supported documents, rather than testing whether an applicant can recite facts that are already public. That distinction is where ghost students get caught.
What Gartner states
From the report:
"Higher education CIOs and senior institution and cybersecurity leaders must strengthen the enrollment process with automated identity verification tools. These are tools that check a government-issued photo ID with a selfie."
On the additional signals institutions should deploy beyond the ID-plus-selfie check:
"To mitigate the risk of fraudulent student enrollment, cybersecurity leaders, higher education CIOs, and senior institution leaders must go beyond traditional data-centric identity affirmation and adopt real-time identity verification solutions that cross-reference applicant data with authoritative sources.
These solutions should also provide additional risk signals beyond the ID and selfie check to detect suspicious patterns — such as mismatched or recycled information, velocity checks, SIM swap detection, behavioral analysis, and phone intelligence — early in the application process."
On the compliance standard:
"The department will consider a student's identity to be verified if the student's identity was verified by an entity that is compliant with National Institute of Standards and Technology (NIST) Identity Assurance Level 2 (NIST IAL2)."
Our take
College application fraud is an identity problem. Someone submits an application, and financial aid gets disbursed in the name of a person who never applied. Institutions most exposed treat enrollment as a paperwork process, collecting and filing information without verifying who actually supplied it.
The biometric gap is where fraud lives
Stolen identities pass data checks cleanly, since the underlying personal data is genuine. A biometric match adds the missing signal: a real-time check confirming the document belongs to the living person presenting it, verified through liveness detection and face-to-document comparison.
The DOE's updated requirements move the compliance floor closer to where the security bar actually needs to be.
Correlation starts with a verified identity
KBA asks an applicant to recall information. Correlation asks whether the person applying is real, present, and matched to a genuine document, a higher bar that stolen data alone can't clear.
Institutions do not need to treat every risk signal as part of the same proofing step. The priority is connecting document authenticity, issuing-authority validation, selfie liveness, deepfake detection, and face-to-document matching.
1Kosmos combines these checks to establish whether an applicant is a real person presenting a legitimate identity document. That verified identity can then support passwordless authentication and account recovery, extending the value of identity proofing beyond the application.
Gartner, Mitigate Fraudulent Student Applications Through Identity Verification, Nayara Sangiorgio, Robert Yanckello, 5 March 2026.
Gartner is a trademark of Gartner, Inc. and/or its affiliates. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research and advisory organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
About the author
Erica West
Head of Marketing
Erica West is the Head of Marketing at 1Kosmos, where she drives messaging, positioning, and content strategy for identity verification and passwordless authentication solutions.
