The previous university I worked at had a problem even one level more sophisticated. The school had a lot of international students, mainly from China and the Middle East. Mostly these were children of rich (but not obscenely rich) parents and often not particularly smart (the school was not super highly ranked).

Now the ghostwriting was also an issue, but that theoretically still can be caught (and it was from time to time). One way to do that was requiring in person exams and you always had to cary your uni I'd for the exams.

However, what the University administration realised is that there were some students essentially hired someone at the beginning of their studies to impersonate them at registration, where they got their photo taken. The "impersonator" would then complete the full studies for the student.

Now you need to id yourself at registration, however if the hired person looked somewhat similar it would just go through.