The government’s position is, if you see something, say something, and let the proper authorities decide what to do from there:
https://ed.gov/about/offices/list/oig/hotline.html?src=rt
No doubt the IRS has a fraud & abuse reporting portal as well.
Sure, it’s possible that the family actually has done everything by the book. If so, they’ll be fine.
And the DOE or IRS may decide not to investigate the tip anyway; they surely don’t have the resources to run down every one.