Second-party fraud: where KYC clears the wrong risk

TL;DR: Investigators tracing at least $28 billion tied to illicit activity found a meaningful share moved through crypto accounts that had already cleared KYC, according to SEON, exposing second-party fraud where a verified identity and the person using it are not the same. The control failure is not enrollment alone, but the lack of continuous trust revalidation after approval.

Editorial analysis by NHI Mgmt Group, based on content published by SEON: “The KYC Mule: When Verified Identity Becomes the Product”.

Key questions

Q: What breaks when KYC clears the wrong risk?

A: KYC breaks when it is treated as proof of ongoing account legitimacy rather than proof that a real person existed at onboarding.

Q: Why do verified accounts still become money mule accounts?

A: Verified accounts become mule accounts because legitimacy at enrollment does not prevent later handover.

Q: What are the signs that a verified identity has been handed over?

A: The most common signs are a new device or emulator, a sudden geography change, clustered password or recovery updates, and behavioural patterns that diverge from the account's earlier history.

Practitioner guidance

• Define second-party fraud as a separate control class Create an explicit taxonomy for verified identities that later become rented, coerced, or delegated accounts so analysts do not force every case into first-party or third-party fraud.
• Monitor post-onboarding operator drift Correlate login device changes, geography shifts, recovery event bursts, and behavioural drift after approval because those are the earliest signs that a verified account changed hands.
• Separate proofing evidence from ongoing legitimacy evidence Keep the onboarding artefacts that proved a person was real distinct from the runtime signals that show whether the current operator still matches the approved risk model.

Bottom line: Second-party fraud fills the gap between genuine onboarding and later account misuse, which is why KYC alone cannot prove who is operating an account.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →