How did a fraudulent application get approved?

This is not a hypothetical admissions joke. This happened to the victim. One documented case, eleven documented failures.

What failed at intake?

Five checks that would each have stopped the application: no identity cross-check against the SSN's owner, no database check of the prior college, no scrutiny of the lookalike email accepted as the identity anchor, no verification of the foster-youth claim, and no attention to a name and residency history inconsistent with the SSN holder.

Every one of those flags was visible on the face of the application that Minnesota State's Universal Application processed as "Y-Successful" on November 5, 2024.

1. No identity cross-check.

   A real Social Security number paired with a fabricated address, phone, and email was accepted with no verification that the SSN's owner submitted it. This was not unusual for the era: the U.S. Department of Education reports that fewer than 1% of FAFSA filers were required to verify identity during this period (sources).

2. A college that closed in 2014 was accepted as 2018–2019 attendance history.

   The application listed attendance at Anthem College in Phoenix, Arizona in 2018–2019. Anthem College — a for-profit chain — shut down in 2014. A check against IPEDS or PEPS, databases every financial aid office uses, would have flagged this instantly.

3. A lookalike email became the identity anchor.

   The fraudster's contact email copied the victim's real name with a letter replaced by a zero — the same trick as turning jondoe@outlook.com into jond0e@outlook.com (shown here as an illustrative example). It was accepted as the authoritative contact, so every notice and warning that might have surfaced the fraud went to the fraudster.

4. The foster-youth claim was accepted at face value.

   Claiming foster-youth status strips parental income from FAFSA scrutiny and fast-tracks independent-student treatment. It is a known ghost-student technique, and it was not verified.

5. Name and history anomalies went unnoticed.

   The application carried a casing anomaly in the surname and a claimed 25-year Mankato residency with a 2013 Bagley High School graduation — a biography inconsistent with any record tied to the actual SSN holder.

What failed after the fraud was reported?

Six more failures: no notification to the real SSN holder at origination, no student record findable under the victim's own name at first contact, an identity-verification process that ran through the same email channel the fraudster had used, counsel abruptly ending the victim's call, the withholding of the application's timestamps and IP addresses and audit logs, and no root-cause analysis.

Discovery depended entirely on a delinquency reaching a credit bureau roughly fifteen months after origination.

6. Zero victim notification.

   Neither the school, the state system, the Department of Education, nor the servicer notified the real SSN holder at origination. Discovery depended entirely on a delinquency reaching a credit bureau fifteen months later — and only because the victim independently maintained credit monitoring. The loan was about $9,000, and when the delinquency landed the victim's credit dropped 168 points overnight (KSTP 5 Investigates, Aug. 24, 2026).

7. First contact: no record under the victim's name.

   When the victim called, the institution could not find a student record under the victim's name, because the record existed under the victim's SSN with altered identifying data. The system indexes people in exactly the way this fraud defeats.

8. The verification paradox.

   The institution's initial victim process asked the victim to establish their identity through email and forms — the exact channel the fraudster had used to impersonate them. Credit where due: after pushback, Normandale agreed to live video verification with government ID review.

9. Counsel abruptly ended the victim's call.

   On May 12, 2026, Minnesota State Assistant General Counsel Daniel G. McCabe took the victim's call and abruptly ended it. This is documented contemporaneously in writing from the same day — his own produced email: "I did abruptly end my brief conversation with [the victim]. I informed him that the College was working on the issue, and he responded with hostility." (Bracketed text marks a redaction of the victim's name; the original names the victim.)

10. The metadata stonewall.

    Minnesota State withheld the timestamps, IP addresses, and audit logs of the fraudulent application from the victim, classifying them as "security information" under Minn. Stat. § 13.37. Its own produced internal email states: "We don't have to consider the threat actor the data subject." The state's position amounts to this: the data about how your identity was stolen is secret from you. That classification is now under challenge via a § 13.072 advisory opinion request.

    The classification arrived after the fact. Earlier in remediation, the institution had itself sent the victim an originating IP address in correspondence — the same category of data it later declared too sensitive to disclose. No policy is cited on the site claiming that disclosure was improper; the point is narrower and documented: the data was disclosable when the institution chose to disclose it, and "security information" once the victim formally asked.

11. No root-cause analysis.

    As of this update (Aug. 25, 2026), Normandale and Minnesota State have provided the victim no root-cause analysis of this case. Their first on-record statements about what is changing came through KSTP 5 Investigates, Aug. 24, 2026: Normandale says it has committed extra staff, technology and training, and Minnesota State says it is selecting a pilot vendor for an automated identity verification system funded by $3 million in one-time legislative money. Neither statement, as reported, addresses how this application passed intake.

Why did the loan servicer fix its part faster than the school?

The private servicer, Aidvantage (Maximus), accepted the identity-theft claim on the FTC and police reports and removed the fraudulent tradeline with comparatively little friction, while the public institution ended the victim's call, withheld the records of how the fraud was committed, and offered no root-cause analysis.

"Fixed" here means the credit-reporting harm only: the federal False Certification (Identity Theft) discharge was still pending with the U.S. Department of Education as of July 2026, and as of this update (Aug. 25, 2026) it has been granted — the loan no longer exists in the victim's name. In my view, it says something that the actor with the least accountability was the easiest to work with.

Is ghost student fraud specific to Minnesota?

No — but this fraud entered through Minnesota State's system-wide Universal Application, so the intake weakness was shared infrastructure across dozens of colleges rather than one campus's error.

Minnesota institutions appear by name in national ghost-student reporting: at Century College, also in the Minnesota State system, instructors found roughly 15% of one course's enrollees were fraudulent. The numbers behind that pattern — national and Minnesota State — are set out on what ghost student fraud is and how big it has become. For why almost none of it produces a remedy for the person whose identity was used, see where the law fails student identity theft victims.

Next: how big this is nationally, and what to do if it happens to you.

Every question heading on this page appears verbatim in its FAQPage structured data, and the failures, quotes, and dates match its Article data — what you read is what machines read. Documented facts are sourced in the timeline's documents section; satire is labeled where it starts. This site documents one victim's experience and is not legal advice.