Name: Fake Students, Real Fraud: Stopping the Ghost Student Problem
Uploaded: 2026-04-16T18:03:55.145Z
Duration: 32 min 16 s
Description: Fake Students, Real Fraud: Stopping the Ghost Student Problem

Transcript for "Fake Students, Real Fraud: Stopping the Ghost Student Problem": Hey, everyone. Thanks for joining us today. Our topic today is going to be fake students, real fraud, stopping the ghost student problem. I'm Liz Morton, field CSO for Cloudflare. With me today is Steve Carlson. He's a senior strategic solutions engineer with Cloudflare and a resident expert on this topic. Steve, thanks for joining me today. Hey. Thanks, Liz. Great. Let's, let's dive right in and just go over our agenda real quick. Let's see if I can advance. Great. So we're gonna go over just a few things. First, we're gonna talk about what a ghost student is and and what is, what is what's the story with this fraud, how it works, who it affects, and some solutions. By the end of today, we hope to leave you with some, key items, for guiding your own fraud programs, protecting your own universities, protecting yourselves. So, Steve, we're gonna go ahead and just get started right away with the first question. What is a ghost student? What's the story with this fraud? Yeah. So a ghost student is, a essentially a fake student. Right? So a a a student that doesn't really exist, but for, you know, some other activity or action, you know, actually appears like a real student. Right? So, generally, how this happens is that, there's the bunch of stolen identity information out there. There's a bunch of AI that's out there as we know. You know, AI is super active out in the world right now of helping and enabling, you know, a lot of these fraudsters, to make their job easier. Right? So, AI picks up these identities, also can freely generate these fake identities as well based on algorithms. They'll enroll in, schools. Generally, it's really prevalent in schools where registration is either free or, doesn't have some sort of payment gate, for the first part of the process. So essentially, they can, in an automated way, jump online, emulate a fake student, register for it, and then get past the first gate as far as, the account being created. Right? Okay. So what's the what's the thinking? What's the motivation? What are these threat actors after? And I I have another question too. You know, you mentioned PII. Where is all this PII coming from? Is this is there a chain of events? Is this are these activities that are opportunistic? What what does that look like? Yeah. So, a lot of the PII is coming from, existing breaches that are already, you know, kind of out there. You know, if if, there's there's these huge networks that kind of broker in a lot of this information where that, can be just purchased online remarkably inexpensively. So that is part of it. But with, like I mentioned a little bit earlier, with AI now, it is so easy to create these disposable emails, these, kind of generated, close enough to be real kind of correlations between sets of data where, they can slightly modify even existing, PII data and, you know, have it retry over and over and over again for for the different, types of login. Right? Interesting. Okay. So so what's the motivation? I I think, you know, a lot of fraud is always money. Right? So there is a financial kind of benefit anywhere where there's a financial benefit. I know that you're looking at a lot of these public universities, these, you know, very nonprofit or, you know, low funded, kind of university. So what would that be? Well, they do offer, a bridge to the federal government on financial aid. So they also do offer, a bridge to state aid as well. So the idea is, you know, we'll generate these fake students. We'll, get an account into the system enough so that the federal, applications for student aid can verify that the student actually exists, and a lot of those things are back end automated as well. And so once it verifies that that student is there, even if that account is temporary or or transitory, it's enough for the system to say, yep. I I did verify there is an account over there, so I'm gonna go ahead and and continue to process this application. Right? Okay. I think the other one that a lot of people don't think about as far as motivation goes is universities spend a lot of time brokering a suite of beneficial services for their students. Right? That's perfect. How about that? Because that that struck me as as a potential motivation for these guys too in addition to money. Yeah. So this so the services that the university uses for their staff, they actually always broker with vendors, an extension of those services to students, and that can be anything from, you know, like technology services to health services to, you know, retail services, discounts, you know, anything else like that. So there is a a ton of auxiliary benefit, not just the financial fraud. It's the free services that you can get, by just being a student and and having that login. So, there's some real value and real cost to to those services because the university, typically doesn't get those services for free. They may get them at a highly discounted rate, but it doesn't actually cost the universities real money to provide those services. Even though it's free to students. Right. Even though it's free to students, it does actually cost somebody something. Right? Yeah. You get free CloudFlare within the Absolutely. Like, we have a program We do. Specifically CloudFlare. Right? That is CloudFlare for students where if you have an e d u email address, which you can get from applying for school somewhere, then you can register for free Cloudflare services. It's it's actually something I've talked to two universities over the last couple days about Mhmm. How maybe we think about not pinning, these free services to purely just the EDU email. Mhmm. Right. So Certainly for to help contain sort of the cost of this fraud, that would be one way to to look at the problem at a university level. So let's let's, let's get into a little bit more, you know. Right. What's that? I'm sorry. It's in the detail. Right? The details. Let's get into the details. Let's get into the dirty details of how this fraud works. So, you are our resident expert. Go ahead. Tell us all about it. Yeah. So we we kind of covered this really briefly in in the last slide, but let's go a little bit deeper into kind of actually how this happens. So you've got your data breaches, your exposed PII, and then you've also got, your AI that synthesizes identities, government credentials, you know, randomizes these numbers, etcetera, to create, kind of a multiple multiplication of those existing records. Right? So maybe they have hundreds of records that now AI has turned into thousands of records that they can use in order to do this. Right? They they train their bots. Right? And that's a really, really big portion of this is that this is all automated. Well, not entirely automated, but the majority of the the work is is automated, and we will talk a little bit about that part that isn't. But for the for the most part, I'd say, you know, over 80% of this activity is going to be bot driven, through mass applications of, you know, just, scripting and routines that are that are scheduled and run continuously. Right? So fraudsters, they will, they'll create the accounts. They'll get past the initial gate, like I mentioned a little bit earlier, particularly effective against, like, junior colleges or community colleges where there isn't a payment that is required upfront. Even the universities that do require payment sometimes don't require that payment right at the beginning. Right? So, there is some period of time where the account can actually exist for a while. And then they start their real work. Right? This is just the vehicle that they are using to get to the end goal, which is real financial benefit. Right? So they'll apply to federal loans, Pell grants, state grants, state federal aid. In California, there's a significant where I'm from, there's a significant amount of free, you know, services that that move from the community colleges to the state colleges. Right? So they're just implied that if you, you know, have the the junior college, services, that you get state college services as well. So they just start their real work in trying to get this money extracted from the federal government. Then they'll pocket that money, even like I mentioned a little bit earlier, even if those accounts are temporary, it's generally that process is automated as well. Right? So it doesn't really take a lot of time for the system to kick off that process on the federal side, verify the students. Maybe universities have a pretty aggressive approach in, their humans actually, their human teams, stopping this fraud and canning these accounts. Right. Or maybe they even have registration, validating, you know, physical, face to face kind of meetings with students, but that's always after the fact and there's some period of time. Right. So, you know, those accounts get canned, but it's just too late because the money's already been taken. It's already on its way, and then you and I both know how effective, recovery of money is after it's, gone. Yeah. Like, how how easy it is to get that back. Yeah. I imagine you could just ask for it back. Yeah. Exactly. Works very often. Right? Okay. So interesting. It sounds like there's a lot of loop loopholes that can be exploited in some of these processes. What what about scale, Steve? What is the scale of this? How how big of a problem is this? It's a it's a massive problem, actually. There are actually several articles, that have just been released recently, particularly in my home state, California, where, you know, they've estimated that the fraud is, you know, in the, you know, double digit billions, of of, you know, federal aid that's been going to a lot of this. And there's been a huge effort on the state side, to coordinate with these schools in order to kinda ratchet down on, protecting the federal government against this. In fact, the federal government has actually, changed policies and pushed down, several different changes to policy that says that now schools, who used to have not have the primary responsibility for verifying these accounts, now do have the the primary and, you know, front end responsibility for various, you know, verifying these accounts. So that's a lot of pressure being put back on these smaller schools, you know, to come up with ways or systems in order to reduce this because now it's directly, according to the federal government, their responsibility. Right? So I But it is a massive problem. Yeah. What happens to the school if they are if they fail to be able to properly validate, a student. What what's the implications for for them? Is there some regulation in place? Is there a penalty? Yeah. But emerging. I don't know. Yeah. So the federal government is now saying that if they don't have some sort of a system or a process in place in order to verify these things, that they'll fail to qualify for giving student aid to their students, which obviously is a huge, huge issue. Right? Particularly at the community college, level, etcetera. Right? Yeah. So so it's a huge deal for them. Yeah. It's actually terrible for their operating capabilities, and that's that's Absolutely. Okay. Yeah. Absolutely. And the whole reason why they exist, right, is Right. To provide education to, you know, the local, community. Right? So so it basically invalidates their whole reason for for really existing. And then the other side of it is also we talked a little bit earlier is that, these free services cost real money. So that's money that they can't actually use to, you know, further more classes or pay, you know, more professors. So when this money these free services are manipulated and and frauded, and those costs are higher than they should be. That's money that isn't going directly towards their core, goals, which is educating. Alright? So, Shane, we're we're actually segueing into the next slide, which is who this affects. Obviously, you've gone into some detail about how it affects the universities. It it basically threatens their entire operating model and their entire reason for existence. I mean, if you can't draw federal funds, it's gonna be really hard to assist those who are seeking your services in your local community. Who else? How else are we seeing this rear tugged? Yeah. I think, before we we talk about who else, I'll just add that, I think, the institutions also stand to to take on some pretty heavy reputational damage. Right? I mean, no one nobody likes to be in the press, associated with a methodology of fraud. You know, that's bad for local, you know, government. That's bad for federal government. It's bad for management at the university level. Like I said earlier, there have been some pretty large articles that have been released, and, and I'm not saying that they're they're trying to solve this problem just so they stay out of the press. I think, that just doesn't help the situation at all. We are talking about universities that, I mean, everybody, has has budget struggles this year. Right? So, you know, adding this complexity to their already existing strained budgets is super, super challenging. Right? So, and then that affects the, you know, the professors, the support staff, everybody else, with, you know, money that they don't have to kind of do their jobs. Right? Individuals, like we talked about, like, up here on the slide, legitimate students actually, when those fake students are registered and they actually succeed in some cases in in registering for classes or, you know, accounting for an actual registered student and maybe there's a limit in the number of registered students that they can accept every year, you're actually denying a real student access to their education. Right? So class with a bunch of filling up classes with a bunch of fake students, and then real students can't register. Yeah. And we and, you know, most universities have a limit on how many students they can actually accept. Right? So, you know, when they are taking on this mass registration and they're saying to themselves, hey. I don't know if these are real or fake students, so I just have to turn the registration off, then that's real students who, you know, don't have an opportunity. Maybe they were late or something happened. You know, they weren't they weren't able to get on to the system in order to register, and that that really disenfranchises them. Right? Yeah. Yeah. So it's it's really, really bad, on that side of it. Obviously, on the federal side of it, that's taxpayer money, as well as the state side. So they are successful in getting, you know, financial benefit from any of this by by stealing the financial aid. Obviously, that's local tax money. That's the federal tax money. We all kind of pay for that, which I think we've got a a huge amount of effort that we're making right now nationally and and statewide to reduce fraud. This is another one of those that, you know, kinda contributes to that problem. Okay. Yeah. Yep. Alright. So let's talk about some solutions. You're our resident expert, of course. So what, what are we doing these days to to solve the problem? You you know, I talk all the time about, kind of one of our mandates and and what I like to think is, you know, one of the hardest jobs that we do, in the world. Right? And that is in this world of AI determining what is real and what is not real. Right? I mean So Yep. So it's something that, we spend a lot of time on. We spend, you know, almost all of our time perfecting, you know, that ability. And I think one of the things that we've talked about throughout this presentation so far is that most of this is done by not real people. Yeah. By automation, by AI, by, you know, scripting and and, basically, there's no human involved in that process, for as much of it as possible. Right? So I I think, a lot of universities don't look at, kind of bot management or these different services to cut down on fake, versus real because they don't think that it's you know, everybody knows, Cloudflare's turnstile or our managed challenge. It's kinda ubiquitous out there on the Internet. Yep. If you don't know CloudFlare, you probably have seen our managed challenge out there, with the little spinning circle and the It's it's easily the thing that makes it easiest for me to explain who I work for. I've just taken a little yeah. Every day. Yeah. So turnstile, is free. It's something that, you know, basically will break automation. So I do see a lot of organizations implementing as a very quick fix, you know, laying turnstile on top of their registration pages, their, login pages, things like that in order to break the automation. That does an extremely good job of sloughing off, you know, 20 to 30% of that kind of traffic. Okay. So that's usually the first step, and I'm not gonna really follow these in specific orders or order. I was gonna say with turnstile, the price is right. Yeah. Abs absolutely right. Yeah. Obviously, we talk a lot about identity and identity verification. That has to happen on some level. Yeah. I don't know of a single university that I'm talking to that isn't going through some sort of process for implementing better identity verification. So, kudos to everybody that I've been talking to about this. I think everybody's making a significant effort, both large universities and small universities, try to incorporate better, identity verification or verification of their existing students, so that they can stop this on the, you know, knowing what they do know, portion of of the vector. Right? But I do think that our bot management, our advanced bot management is highly effective at stopping a lot of this. So we're one of the the few companies in the world that, you know, likes to identify our bots, and use our, heuristics and machine learning to follow these bots, and and predict their modifications, etcetera. So I think our our system is highly effective at detecting, Turnstile can detect whether it's real or not and kind of try to break that process. Bot management uses much more, intelligence to identify the activity, tag it to its source, and and really, stop that from happening as well as any minor modifications Yeah. To that. Right? So I do I see up to an 80% reduction from my customers on implementing aggressive bot management strategies, using our advanced bot management. Right? That's great. I've I've love our bot management solution, and I follow I've used it and been a part of it for many years. We really have come a long way with that product. So glad to I never thought of it as a solution for this problem, but you're right. It it it is the same. It's all automation. Sure. Makes sense. Yep. And and, obviously, there's a lot of customization that needs to be done for every, you know, customer based on their audience and and what their you you obviously don't wanna disenfranchise real students. So there is, a little work that needs to be done in order to make sure that it's, absolutely blocking, you know, bad bad guys and not good guys. Right? But like like you said, I I think our product is, really, really made some massive improvements, and I am really, really happy. I spent a lot of my time helping universities, fine tune, as well as municipalities, fine tune bot management to make sure that, this this unneeded Yeah. Fraud is isn't happening. Right? We also have other products like, you know, API Shield and and some of our other products that are also machine learning and algorithmically enhanced on our end. So we can scan, for different things happening to your applications. One of the reasons why I bring up AI security for apps is that, we can actually, tag your login pages and look specifically for things like disposable emails. Right? So that's our intelligence, looking at how disposable emails are constructed and looking at the verification the variation of the different emails to detect a pattern and then essentially just scanning anything coming from that source once we detect that pattern. So, again, I mentioned earlier using AI to fight AI. You know, you as a human are gonna have a really challenging time fighting a lot of these things. Please let us help you, you know, with our machine learning and heuristics get the the lead on these things. Right? I I spoke to a customer last week. Between bot management, and API Shield, working together on their websites, they were able to cut down, almost 90% of this activity from their website Right. With fine tuning. Right? And then, ultimately, we hear a lot about zero trust. Right? Perfect. So, so zero trust is, something that CloudFlare provides as well. But fronting access to, your applications with identity integration and policy is, obviously, the most advanced way to to kind of, stop this from occurring. So I generally see it as an evolutionary step in the process. Like we talked about earlier, evolution typically goes turnstile, then, you know, bot management, aggressive, you know, analytics, fighting analytics with analytics. Right? Mhmm. Fine with identity verification, and then kind of the third step to evolution is just, gaining access to their critical applications, using a zero trust product or SaaS product. Yeah. Sounds like a really smart progression from simple and cheap to much more complex and with many many more legs potentially in the project. But great. I think those are all, really fantastic solutions. Yeah. I think you can stop the bleeding on these things, while you're kinda progressing to a more aggressive approach, and then things just get better and better and better, very quickly. Right? Yeah. I mean, I was just gonna say, I think you have to start somewhere. You might as well start with the easiest, cheapest thing first and leave the the heavy lifting for later. It gives you more time, allows you to iterate through your project and see what specifically is impacting you. I would imagine that the analytics coming out of, Clafler Spot Management would be very interesting for anybody who's really trying to fight this fraud, in real time. I I absolutely say to, you know, most of my customers, be prepared for what you're going to see. It's I can I can only imagine? Yeah. I I think even most customers that know they have a problem, have a hard time kind of conceptualizing how big the problem is. You mentioned scale earlier. Right? Yeah. I think once they do have the ability to see what's actually happening, see it in, you know, reporting, see it in analytics, they're often shocked with how how pervasive it is. Yeah. Right? Well, when you have a tool as effective as ours, I I've seen some of the outcomes that we've been able to accomplish. Suffice to say, it helps to have data on your side. But good. Let's, let's kinda wrap here. We talked about a lot of different elements of this problem. What are some key takeaways? Some some of that for us. Yeah. So I think, the first step is obviously understanding how this impacts your school. Right? You know, what seems to be obvious to you. Right? I've had different universities actually come to me, with different problems, but then they all actually end up being kind of part of the same group of problems. Right? And they just happen to be dealing with one particular aspect of the problem. You know, they'll come to me with the requirement from the federal government on, you know, protecting student aid, but then I'll ask them about their, you know, free services that provide they're providing, and do they see an uptick tick in the licensing there, etcetera. Right? Have they seen an uptick in, you know, other services associated that are, you know, being reported back to them from their other vendors? So I think it's it's important to to look further at, other vectors that are probably happening that can all be solved kind of in the same way. Right? Mhmm. A lot of schools have ticketing systems for sporting events. They have, you know, that's a big one that I see, particularly the larger universities that have these big sporting events that they're sponsoring. Maybe they have one of the, you know, you know, final four games or they have, you know, one of the, you know, big games that, happens to just be on their campus, yet they've never really, put anything in place to kind of adapt to the kind of influx of that kind of traffic that that's gonna be present for that. Right? Okay. So, yeah, I think it's it's really good to kind of evaluate and see, all the different ways that these these things are being exploited and how we can kinda protect them all with the same approaches. Right? Interesting. Right. I think the second one is, look, you humans can't fight AI. I think we all realize that. We can't fight automation as, you know, individuals. So you kind of need to step up and and recognize, how these things get, you know, fixed in the real world. And so I think you do need to implement modern defenses that prevent this fraud. You know, I've had different universities come to me and say, hey. You know, we're blocking by, you know, block lists and IP lists and ASN lists, and, you know, it just seems like our day never ends, by doing that. And and what I tell them is it's it's actually futile. You're you're actually fighting a fight that can't be won, by yourself. So let us let someone help you, you know, fight that fight and generate those, those blocks not based on you updating a list, but, on intelligence. Right? Yep. Yep. And and then I think the last one, we'd we'd be kinda remiss in not saying that, you know, also protect yourself, from identity theft. Make sure you've got strong passwords. Make sure you're looking at, suspicious activity on your own reporting, just to see if maybe you're being leveraged for this. Existing students, for sure, can have their accounts, compromised. And I know some students my kids have been, you know, students at at different universities, and they have old accounts from, old universities they no longer attend and have moved on to new universities, and those old accounts can be compromised and used in this, in this scheme. So keep an eye on your accounts and and make sure that you have that you're doing, you know, your own due diligence to protect yourself and your family from identity theft. Great. Amazing. Great advice as well. I have kids that are a couple years away from college. I hadn't thought about some of these things, Steve. I appreciate, the insights. I think it's really an aggressive, program that I've seen from any university to kinda recover old accounts Right. That are out there. So, you know, essentially, a consistent thing that I've seen is, yeah, they may have, some kind of a a process for, you know, staling out old university accounts. But Mhmm. In general, they want, to keep those accounts around for students that reenroll. So, so there that is a a vector that definitely needs to be addressed. Yeah. Interesting stuff. And certainly, there's much more that could be said about this. And in fact, I wanted to point out that for those of you who joined us today, thank you for doing that. Thanks for taking your time. Thanks to Steve, our resident expert on, GoStudent fraud, and one of our best here at CloudFlare. For those of you who would like more details, please do go to cloudflare.com/education, where we have a solutions brief, that goes into some of the goes into more detail about some of the things that Steve and I touched on today. Thanks for joining everybody.