TL;DR: Money laundering in modern fraud now moves through mule accounts, crypto exchanges, shell companies and high-cash businesses before stolen funds can be frozen, according to IDnow, which argues that banks must detect both the receiving account and the onward movement. Detection has to shift from document checks alone to behavioural and transaction signals that expose laundering in motion.
At a glance
What this is: This is an analysis of how stolen funds are layered, obscured and converted after fraud, with mule accounts, crypto and shell companies identified as the main intervention points.
Why it matters: It matters to IAM and fraud practitioners because onboarding, verification and transaction controls need to distinguish a real customer from a real laundering conduit before money leaves the system.
By the numbers:
- Mule recruits may be promised $70-300 per day for remote payment processing.
Context
Modern money laundering in fraud is not a single event but a sequence of conversion and concealment steps that make stolen funds harder to freeze, trace or reverse. The practical gap is not just in transaction monitoring. It also sits in onboarding, where identity fraud prevention and mule detection need to separate a real person from a real laundering role.
The article’s core point is that fraud prevention and laundering detection are not the same control problem. Fraud tries to stop the victim from sending money; laundering detection has to catch the account that receives, fragments and moves it onward. That distinction is central to financial institutions, and it is typical of the broader convergence gap between identity, payments and AML operations.
Key questions
Q: How should banks detect mule accounts before stolen funds move out?
A: Banks should look for identity, device and behavioural mismatches at onboarding, then confirm whether the account behaves like a laundering conduit after deposit. The strongest signals are repeated registrations from the same device or IP, scripted verification responses, thin digital footprints and rapid onward transfers. A single check rarely works; linked signals do.
Q: Why do verified customers still become laundering risks?
A: Because verification proves that a person exists, not that the account will be used lawfully. Mule accounts often pass KYC with genuine documents and plausible addresses, then become risky only when they start receiving third-party funds and forwarding them quickly. The control gap is role misuse after onboarding, not identity fabrication alone.
Q: What are the warning signs that transaction layering is under way?
A: Look for repeated small transfers, movement across multiple accounts, conversion into crypto, use of mixers and account activity that exists only to move money. Those signals matter because layering is designed to fragment value and defeat isolated reviews. Detection improves when teams correlate sequence, counterparties and timing instead of judging one payment at a time.
Q: How should fraud, AML and payments teams share responsibility for laundering detection?
A: They should share signals, case ownership and escalation criteria across the full money trail, from onboarding to post-transfer monitoring. If fraud teams stop at victim protection and AML teams only review suspicious accounts later, the laundering chain can slip through the seam. Joint governance is the practical answer to cross-channel laundering.
Technical breakdown
How mule accounts create the first laundering conduit
Mule accounts are the first operational bridge between fraud and laundering. A victim transfer lands in a legitimate-looking account controlled by a recruited intermediary, so the account passes initial KYC while the behaviour that follows exposes the abuse. The laundering value is not the identity document itself but the account’s ability to absorb funds and move them on quickly. That makes onboarding signals, device reuse, IP reuse and live verification quality more important than document authenticity alone. In practice, the problem is that traditional verification proves personhood, not intent or role in a laundering chain. See the Identity Fraud Prevention Guide.
Practical implication: Treat onboarding as a behavioural risk problem, not only a document validation exercise.
Why transaction layering defeats conventional banking controls
Layering works by breaking value into smaller movements and moving it through multiple intermediaries before it can be recovered. Once funds move from mule accounts into crypto exchanges, chain-hopping and mixers, the trail becomes non-linear and much harder to freeze. Conventional controls struggle because they are often designed to spot a suspicious transaction, not a chain of otherwise plausible hops. The operational issue is correlation across accounts, channels and asset classes. A single transfer may look ordinary, but the sequence reveals laundering intent. Detection therefore depends on linking events across time, counterparties and infrastructures.
Practical implication: Build detection logic around transfer sequences and entity linkages, not isolated transactions.
How shell companies and high-cash businesses hide the final conversion
The final stage of laundering converts digital value into assets that look legitimate on paper. Shell companies, fake invoices, nominee directors and cash-intensive businesses all create a veneer of commercial activity that can satisfy weak reviews. The failure mode is not only opacity but plausible business fiction: transaction patterns that appear documented while remaining economically nonsensical. This is where beneficial ownership, business purpose validation and cross-sector reporting matter. In many cases, the account is not the asset. The asset is the story that makes the movement acceptable to weak control environments.
Practical implication: Validate economic purpose and beneficial ownership whenever business accounts move unusually high-value funds.
Threat narrative
Attacker objective: The attacker’s objective is to move stolen funds out of reach, disguise their origin and convert them into usable assets with minimal traceability.
- Entry occurs when fraud victims are induced to send money to a mule account under false pretences, often through social engineering.
- Credentialed access is not the issue here; the abuse comes from a real account that can receive funds, pass KYC and act as the first laundering conduit.
- Escalation occurs as the funds are rapidly split, forwarded, converted into crypto or moved through shell-company structures to obscure the trail.
- Impact is the successful conversion of stolen money into assets or clean-looking balances that are far harder to freeze, trace or recover.
Breaches seen in the wild
- Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Fraud and AML are now one operating problem: the control failure is not just weak fraud detection or weak AML, but the gap between them. A bank can know a customer is real and still miss that the account is being used as a laundering conduit. That is why the governance model has to join onboarding risk, behavioural analytics and post-transfer tracing into one control narrative.
The real failure mode is legitimate identity used for illegitimate role: mule accounts succeed because the person is genuine enough to pass KYC, yet the account’s behaviour is organised around receiving and forwarding criminal value. That is a governance gap in role assurance, not identity proofing alone. Fraud and cyber convergence is the right lens for institutions that still separate casework, signals and ownership.
Mule-account trust gap: this article exposes the assumption that a verified customer is a safe counterparty for value movement. Verification certifies a person, not the account’s future function inside a laundering chain. Once that assumption fails, detection has to move from identity assurance to behaviour and network analysis. The practitioner implication is to govern account purpose, not merely account existence.
Cross-channel laundering requires cross-domain control ownership: the trail now spans bank accounts, crypto rails, shell entities and asset purchases, so no single team owns the whole picture. That creates a structural detection blind spot when fraud, AML, payments and financial-crime teams operate with separate metrics and separate escalation paths. Institutions need joint ownership of the laundering path, not just the transaction alert.
From our research library:
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
What this signals
Money-laundering detection is becoming an identity problem as much as a payments problem: the institutions that win here will treat account purpose, behavioural consistency and cross-channel movement as one control surface. That means fraud, AML and onboarding signals need to be governed together instead of reviewed in separate queues.
Mule-account governance is the next control frontier: once a real person can be recruited into a laundering role, the question shifts from “is this identity valid?” to “is this account being used for its declared purpose?” That is a sharper and more useful control question for modern financial crime programmes.
The pressure will keep moving toward faster sharing of suspicious patterns across banks, crypto services and asset-purchase channels because laundering now crosses sector boundaries by design. Institutions that keep controls inside one team or one channel will continue to detect the trail after the money has already changed form.
For practitioners
- Strengthen mule-specific onboarding checks Add live verification questions, device correlation and behavioural inconsistency checks to onboarding flows so an apparently valid identity is also tested for laundering intent.
- Monitor rapid outbound movement after deposit Flag accounts that receive unrelated third-party funds and move them on within minutes, especially when there is no normal spending, balance retention or lifestyle fit.
- Link fraud and AML casework Create shared escalation paths for fraud prevention, transaction monitoring and AML investigation so mule patterns are not lost between teams.
- Inspect shell-company behaviour patterns Review business accounts for implausible invoice narratives, weak operating history and transaction volumes that do not match the stated business model.
Key takeaways
- The central risk is not only fraud loss but the laundering chain that turns a victim transfer into something harder to freeze or recover.
- The article shows how mule accounts, crypto layering and shell-company structures create multiple intervention points, but each one weakens traditional controls in a different way.
- The most effective response is joined-up governance across onboarding, transaction monitoring and financial-crime casework, with behaviour weighted more heavily than document validity alone.
Related NHI Mgmt Group resources: Identity Fraud Prevention Guide · Fraud and Cyber Convergence Guide · Fraud Prevention Guide for Digital Businesses · MAS Technology Risk Management Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Account onboarding and misuse controls are central to detecting mule accounts and laundering conduits. |
| Recommendation — Apply PR.AA-05 to govern account permissions and flag accounts whose behaviour diverges from their intended purpose. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account management controls underpin onboarding, lifecycle review and misuse detection in mule schemes. |
| Recommendation — Use CIS-5 to strengthen account lifecycle review and revoke accounts that show laundering behaviour. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Authenticator lifecycle governance supports detection of compromised or abused accounts involved in laundering. |
| Recommendation — Enforce IA-5 to manage account credentials and remove access paths associated with suspicious laundering activity. | ||
| MITRE ATT&CK | TA0006; TA0010 — Credential Access; Exfiltration | The article describes a value-moving chain that begins with account abuse and ends in transfer out of reach. |
| Recommendation — Map laundering-linked account abuse to TA0006 and TA0010 to improve detection coverage across the chain. | ||
| GDPR | Art.32 — Security of Processing | Where verification and device data are processed, institutions still need appropriate security and governance over that data. |
| Recommendation — Align identity verification data handling with Art.32 controls for secure and proportionate processing. | ||
Key terms
- Money Mule Account: A money mule account is an account used to receive and move stolen funds on behalf of a fraud network. Mule accounts help disguise the origin of illicit transfers, making them a central target for fraud teams trying to disrupt payment scams before the money is laundered onward.
- Layering: Layering is the process of moving funds through multiple accounts, entities, or assets to obscure their origin. In fraud operations, it creates distance between the initial crime and the final cash-out point, which makes investigation, recovery, and attribution much more difficult.
- Beneficial Ownership: Beneficial ownership identifies the person or entity that ultimately controls or benefits from an account, company, or asset. In EDD, it matters because nominal ownership can hide the real decision-maker, which is often the entity regulators and investigators need to understand.
- Transaction Monitoring: Transaction monitoring is the process of detecting, reviewing, and escalating activity that may indicate fraud, money laundering, or other financial crime. It combines rules, investigation workflows, and documentation so organisations can explain why a case was flagged and what was done next.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps security practitioners connect identity controls to the broader security programmes they operate.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org