Topic starter
15/08/2026 6:09 pm
TL;DR: Mule account activity is increasingly organised as a networked fraud pattern, with rapid transfers, layered movement and distributed payouts making account-level monitoring too slow and too narrow, according to Fingerprint. The core problem is not the transaction itself but the coordinated relationship between accounts, devices and infrastructure, which is where fraud governance now needs to evolve.
Editorial analysis by NHI Mgmt Group, based on content published by Fingerprint: “How to detect mule accounts”.
By the numbers:
- Nearly €9.4 million was laundered through mule accounts in the 12 months leading up to mid-2025, according to Banking & Payments Federation Ireland data cited by Fingerprint.
Key questions
Q: What breaks when fraud detection only reviews accounts one by one?
A: Account-only fraud detection misses mule rings because each account can stay below behavioural thresholds while the network as a whole launders money across multiple destinations.
Q: When should fraud teams prioritise device signals over transaction alerts?
A: Prioritise device signals when transactions are fast, accounts are newly opened, or several accounts show the same movement pattern without an obvious customer relationship.
Q: How do fraud teams know a mule network is forming?
A: Look for repeated device reuse, shared infrastructure, and the same inbound-to-outbound transfer pattern across otherwise unrelated accounts.
Practitioner guidance
- Implement device-linked mule detection Correlate account events with persistent device and browser identifiers so the same operator cannot hide behind multiple legitimate-looking accounts.
- Review onboarding for post-open risk Treat successful KYC as a starting control only and continue monitoring newly opened accounts for rapid in-and-out transfers, repeated destination reuse and account cycling.
- Cluster accounts by shared infrastructure Group accounts that share IP ranges, device characteristics, location signals or virtualised environments so networked mule behaviour becomes visible earlier.
Bottom line: Mule account networks exploit a structural weakness in account-only monitoring because each transfer can look ordinary until the activity is viewed across multiple accounts and devices.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:17 pm
Account-only fraud detection is now a governance blind spot, not just a tuning problem. Mule networks exploit the fact that onboarding, threshold alerts and manual review all operate on isolated accounts. When the fraud pattern is distributed across devices and institutions, the control model has already lost the relationship signal that matters. Practitioners should treat this as a shift from single-entity monitoring to network governance.
A question worth separating out:
Q: What role does KYC play when mule accounts use real identities?
A: KYC still matters because it screens the initial identity, but it does not guarantee honest intent after account opening. Mule accounts often pass onboarding with genuine documents and then become active in laundering chains later. That means KYC should be paired with continuous behavioural monitoring, especially for rapid transfer patterns and reused devices.
👉 Read our full editorial: Mule account networks expose the limits of account-only fraud detection