Money Mule Detection Guide: Mule Accounts and Networks

Almost every fraud that ends in a bank transfer needs somewhere to send the money, and that somewhere is usually a money mule account. Phishing, business email compromise, romance scams, investment fraud and authorised push payment scams all depend on accounts that receive stolen funds and move them on before anyone can freeze them. Mule detection is the receiving side of fraud prevention, where a bank, payment firm or crypto exchange can stop losses that started elsewhere. This guide covers mule typologies, recruitment, the account, device and network signals that expose mules, response and closure without tipping off, and awareness. It is written for fraud, financial crime and AML teams, and the security and identity teams who own onboarding and device signals.

Key takeaways

Mules are a laundering layer, not a fraud type. The same mule account may receive funds from APP scams, account takeover and BEC in a single week, so detection has to work on money movement, not on the original scam.
Not every mule is a criminal mastermind. FinCEN and the FBI separate unwitting, witting and complicit mules, and the right response differs for each, from a warning conversation to exit and reporting.
Inbound monitoring matters as much as outbound. A receiving account that collects many unrelated credits and empties within hours is the classic mule shape, and UK reimbursement rules now make receiving firms pay half the cost of APP scams that land in their customers' accounts.
Networks give mules away. Shared devices, IP addresses, contact details and payment hops link accounts that look harmless alone; graph analysis and data sharing find the herder behind them.
Response has legal edges. Freezing, delaying, reporting and closing an account all interact with suspicious activity reporting and tipping-off rules, so playbooks need financial crime and legal sign-off before they are automated.

What money muling is and why it matters

FinCEN defines a money mule as "a person who transfers illegally acquired money on behalf of or at the direction of another". The US Department of Justice puts it in fraud terms: "Money mules are people who, at someone else's direction, receive and move money obtained from victims of fraud." Money muling is the act of providing that service, whether by handing over an existing account, opening new ones, or moving cash and crypto on instruction.

A money mule scheme has four roles: the fraudster who steals the money; the mule herder who recruits and manages mules (the FATF notes "Money mule recruiters are also known as mule 'herders'"), sometimes tasked by facilitators; the mules who receive and forward funds; and a cash-out point. Mules run by one herder form a mule ring or mule network, and mule herding is the work of recruiting, instructing and replacing mules as accounts get closed.

The FATF, with the Egmont Group and INTERPOL, found cyber-enabled fraud proceeds are "rapidly laundered through a network of accounts" spanning "multiple borders and financial institutions". Once funds have hopped two or three times, recovery becomes far harder. Scale is real too. UK Finance's Annual Fraud Report 2026 reports APP fraud losses of £576.4 million in 2025, up 19 per cent, and states that "12,438 money mules were disrupted in 2025" through its intelligence sharing. For the payment flow and victim side of these scams, see the Authorised Push Payment (APP) Fraud Guide.

Mule types and account typologies

Classifying both the person and the account helps choose the right control and the right response. FinCEN advisory FIN-2020-A003 and the FBI use the same three categories of person.

Mule type	Definition (FinCEN / FBI)	Typical profile	Usual response
Unwitting mule	"unaware that he or she is part of a larger criminal scheme"	Romance or job scam victim, fake "payment processing" employee, older customer asked to help a new partner	Stop the flow, explain, treat as a potential fraud victim, record and monitor
Witting mule	"chooses to ignore obvious red flags or acts willfully blind"	Student or young adult paid to "lend" an account, who may already have been warned by bank staff	Restrict, report, usually exit; in the UK, consider a fraud database marker
Complicit mule	"aware of his/her role as a money mule and is complicit in the larger criminal scheme"	Serial account opener, mule recruiter, person advertising account services, funnel account operator	Report, exit, preserve evidence for law enforcement, look for the wider network

Each money mule account usually fits one mule account typology, and the typology decides which signal finds it first:

Recruited existing account: a genuine long-standing customer agrees to receive and forward funds. History looks normal until the first mule credit, so behaviour change is the key signal.
Purpose-opened account: a real person opens accounts on instruction, often at several institutions at once. A Spanish FIU profile in the FATF report flagged "bank accounts opened by a single individual at three or more financial institutions within 20 days".
Sold or rented account: FATF notes mules "surrender banking credentials, cards, and tokens", some for a limited period only.
Synthetic, stolen or taken-over account: opened with fabricated or stolen identity data, or hijacked through account takeover, so there is no willing customer to contact. See the Identity Proofing and KYC Guide.
Business and funnel accounts: FinCEN advisory FIN-2014-A005 describes funnel accounts receiving multiple cash deposits in one area, often below reporting thresholds, with withdrawals elsewhere shortly after.
Crypto money mule: the mule converts proceeds to virtual assets, deposits cash into crypto kiosks (an FBI red flag) or passes funds through exchanges. FATF lists unhosted wallets, peer-to-peer transactions, peel chains, high-risk exchanges and Bitcoin ATMs. See the Crypto Scam and Drainer Guide.

How mules are recruited

Money mule recruitment is mostly online and mostly disguised. The FATF found mules for cyber-enabled fraud "are more likely to be recruited online", and the fourth European Money Mule Action (EMMA 4, reported by Eurojust in 2018, with 1,504 mules identified) found recruiters increasingly use social media with fake jobs and get-rich-quick offers aimed at young people, students, newcomers and the unemployed.

Money mule job scam: "payment processing" or "financial assistant" roles. The FBI's red flags include unsolicited offers of easy money, an employer using web-based email, a request to open an account in your own or a company's name, and permission to keep part of the money.
Romance scams: the FATF notes romance fraud victims "can often be tricked into acting as money mules", so victim care and mule handling overlap.
Social media and in-person offers: quick money for "lending" an account, aimed at teenagers and students; Cifas has warned of approaches around student unions.
Prize pretexts and coercion: the DOJ lists sweepstakes notices that lead to requests to forward funds, and herders may pressure vulnerable people, who are then both mule and victim.

Detection signals: inbound, outbound, device and identity

Money mule detection at account level combines four signal families. Each is weak alone; together they produce precise mule account detection. The signals below draw on FinCEN, the FBI, the FATF case studies and standard transaction monitoring practice.

Signal family	Signal	Why it points to a mule
Inbound flows	Credits from several unrelated payers, new payers each day, round or repeated amounts, payment references that do not match the customer's profile	Victims of different scams are being directed to the same account
Inbound flows	First large credit on a dormant or low-activity account, or a student account receiving business-sized sums	A recruited existing account has just been activated
Outbound flows	Funds leave within minutes or hours of arrival ("in and out"), balance returns near zero, outflows split into smaller amounts	Pass-through layering described by the FATF
Outbound flows	Transfers to crypto exchanges, money service businesses, gift card purchases or ATM cash withdrawals soon after credits	Cash-out to a less traceable channel
Device and access	New device or new country right before the first suspect credit, a device used across several customers, emulators or remote access tools, logins from hosting IP ranges	Account is controlled by a herder, or credentials were sold
Identity and onboarding	Several accounts opened at different institutions within days, shared phone, email or address across customers, thin-file applicants, mismatch between declared income and activity	Purpose-opened, synthetic or recruited accounts
Customer behaviour	Customer cannot explain the payments, says they are "processing payments for an employer", or a third party is present or coaching during branch or call contact	Unwitting or witting mule under instruction

Inbound mule payments

Inbound mule payments are a first-class detection target: score every incoming instant payment or wire against the receiving account's history, and act on the first suspicious credit, before the funds move on. When a sending bank flags a fraud, the receiving institution needs a fast path to locate the funds and restrict the account. UK Finance describes its Best Practice Standards platform as letting firms create cases in real time, "quickly passing information to other financial institutions that have received fraudulent money".

Device and session signals

Mule control shows up in the digital channel before it shows up in the ledger. Device binding, device reputation and behavioural biometrics reveal one device logging into many accounts, or an account suddenly operated from an unfamiliar device. See the Device Intelligence and Fingerprinting Guide. Changes to contact details, new payees and new devices in a short window are also classic account takeover markers; see the Account Takeover Prevention Guide.

Network analysis and mule account networks

Single-account rules find individual mules; network analysis finds the mule account network. Build a graph where nodes are customers, accounts, devices, IP addresses, phone numbers, email addresses, addresses and counterparties, and edges are payments or shared attributes. Then look for patterns:

Fan-in, fan-out: many senders into one account, or a hub account feeding several second-layer accounts.
Shared attributes: unrelated customers sharing a device ID, phone number or contact details. The FATF cites accounts linked by "common banking transactions, data points (foreign contact information and device ID)".
Chains and communities: funds passing through three or more accounts within hours, and clusters that regrow when one mule is closed, a sign of a herder replacing accounts.
Known-bad proximity: accounts one or two hops from a confirmed mule get higher risk scores.

No single institution sees the whole network, which is why the FATF highlights public-private partnerships that "identify hidden ML networks through tactical information exchange", and cites Hong Kong's use of "data analytics and network link analysis to identify syndicates". Scheme-level analytics that trace payment flows across all participating banks in a payment system are the logical extension: they can see multi-bank hop chains no member bank can see alone. In the UK this approach is associated with the industry's mule insights tactical solution; confirm current scope, participation and data-sharing terms directly with the scheme operator before designing around it. For broader cross-team fraud data, see the Fraud and Cyber Convergence Guide.

Regulatory drivers and reporting

Jurisdiction or body	Rule	What it means for mule detection
UK, Payment Systems Regulator	Mandatory APP scam reimbursement for Faster Payments and CHAPS from 7 October 2024, up to £85,000 per claim	Sending and receiving firms split reimbursement costs 50:50, so mule accounts at a receiving firm are now a direct cost
UK, Payment Services (Amendment) Regulations 2024 and FCA FG24/6	Outbound payments may be delayed by up to 4 business days where there are "reasonable grounds to suspect fraud or dishonesty on the part of someone other than the payer"	Gives time to investigate a suspected scam payment; the FCA notes this power does not apply where the suspected fraud is by the payer, so suspected mules fall under AML obligations instead
UK, Proceeds of Crime Act 2002	Money laundering offences (ss.327 to 329), suspicious activity reports to the National Crime Agency, tipping-off restrictions	A Defence Against Money Laundering request may be needed before releasing funds; customer conversations must avoid tipping off
US, Bank Secrecy Act	Suspicious activity reporting by banks (31 CFR 1020.320), customer identification and beneficial ownership rules	FinCEN advisories ask filers to use specific key terms, for example "Funnel Account" from FIN-2014-A005
FATF Recommendations	R.10 customer due diligence and ongoing monitoring, R.20 suspicious transaction reporting, R.21 tipping-off and confidentiality, R.15 new technologies and virtual asset providers	The international baseline that national AML regimes implement

The broader payment fraud context, including card and push payment controls on the sending side, is in the Payment Fraud Guide.

How to implement a mule detection programme

Money mule detection works best as a staged programme rather than a single model purchase.

Agree definitions and ownership. Document your mule typologies, who owns mule alerts (fraud, financial crime or a joint team) and who can freeze, restrict and exit accounts.
Fix the data first. Put inbound payments, device and session data, onboarding data and outbound transfers behind one customer key. Most programmes fail here, not in the models.
Start with explainable rules in shadow mode. Dormant account receiving unusual credits, many unrelated inbound payers then rapid outflow, new device before a first large credit, several accounts opened within days. Run four to six weeks without action and measure precision against confirmed cases.
Use inbound fraud reports as labels. Every sending-bank notification and confirmed APP claim against a receiving account is a labelled mule; feed them back.
Add graph analysis, then models. Pilot proximity scoring on one product line, and add supervised models only once labels are sufficient, keeping rules as a fallback.
Define tiered responses. Map scores to monitor, contact, restrict outbound, or freeze and report. Pilot automated restrictions at low values first, with a fast manual release path to roll back false positives.
Join data-sharing schemes and review quarterly. Use fraud databases and consortium intelligence, retire noisy rules and add typologies as herders adapt.

Decision guidance: choosing the right approach

Rules or models: rules are transparent and easy to defend to auditors; models catch subtler combinations but need labelled data and governance. Start with rules plus consortium data; large banks usually run both, with models ranking alerts.
Real-time or batch: instant payments leave in seconds, so inbound credits and the next outbound payment need real-time scoring. Batch still suits slower patterns such as funnel accounts and cross-institution account opening.
Restrict or exit: a first-time, apparently unwitting mule may need only a stopped flow and a structured conversation; repeat, witting or complicit mules should be exited, with the decision documented.
Small firm or large institution: a small payment firm can bind devices, check shared contact details, cap new-account velocity and act fast on fraud notifications; a large institution should add network analytics.
Crypto platforms: exchanges are both cash-out point and mule venue. Watch for fiat deposits from many senders followed by withdrawals to unhosted wallets.

Response and mule account closure

When an alert is confirmed, speed matters more than perfect investigation, because funds can still be recovered while they sit in the account.

Freeze or restrict: block outbound payments and cards on the suspect account, and return funds to the sending institution where your legal basis allows.
Report without tipping off: file a SAR (to the National Crime Agency in the UK, with a Defence Against Money Laundering request where you need to deal with the funds; to FinCEN in the US) using advisory key terms. Script customer contact: explaining a restriction is fine, disclosing a SAR is not.
Close and record: mule account closure should follow a documented exit process, with a fraud database or consortium marker where membership and evidence allow. Closing without sharing pushes the mule to the next bank.
Trace the network: review linked devices, payees and customers before the herder moves funds through sibling accounts.
Treat victims as victims: an unwitting mule who is also a romance scam victim needs support. The FBI notes mules may be held personally liable for repaying victims, a strong deterrent message.

Money mule awareness

Awareness is prevention for the supply side. The DOJ describes its Money Mule Initiative as "an international, coordinated effort occurring each fall that disrupts money mule networks", and in its 2021 ten-week campaign agencies took action against approximately 4,750 suspected mules, often through warning letters and interviews rather than prosecution. UK Finance reports its Don't Be Fooled schools programme reached more than 33,000 pupils at 470 schools.

Target and time it: students at term start, job seekers, recent arrivals and customers at risk of romance scams, with in-app prompts when a young customer receives several credits from strangers.
Use concrete messages: "No legitimate company will ever ask you to use your own bank account to transfer their money" (Cifas), plus the consequences: account closure, a fraud record affecting credit, and prosecution.
Train front-line staff: branch and contact-centre staff meet witting mules in person and need a script and escalation route. See the Security Awareness and Human Risk Management Guide.

Measuring money mule activity

Mule detection rate: confirmed mules found by your own controls, as a share of all confirmed mules including those reported by other institutions.
Time to restrict: median minutes from first suspect inbound credit to outbound restriction.
Funds retained: value frozen or returned as a share of suspect inbound value.
Alert precision: confirmed mules per alert, tracked per rule and per model.
Receiving-side APP liability: reimbursement costs allocated to you as the receiving firm, a direct financial measure under the UK regime.
Re-entry rate: exited mules who open new accounts or reappear in the network within 12 months.

Common failure patterns

Watching only outbound payments: the receiving account is never scored, so funds leave before the sending bank's fraud report arrives.
Treating onboarding as the only control: recruited and taken-over accounts passed KYC honestly and are invisible without ongoing behaviour monitoring. See the Identity Fraud Prevention Guide.
Closing accounts one at a time: exiting a mule without checking linked devices and payees leaves the rest of the ring active.
Slow handling of inbound fraud notifications: large authorised transfers, like those in the Arup deepfake fraud, land in receiving accounts where every hour of delay reduces recovery.
Contact that tips off: untrained staff tell a complicit mule why the account is blocked, and the network drains sibling accounts.
No feedback loop: confirmed cases are never labelled, so false positive rates stay high.

Practitioner checklist

Document mule person types and account typologies, with an agreed response for each.
Score every inbound credit in real time, not just outbound payments.
Deploy rules for dormant activation, many-to-one inbound, rapid in-and-out and multiple recent account openings.
Alert on one device linked to many customers, or a new device before a first large credit.
Review the graph neighbours of every confirmed mule before closing the case.
Staff a route to act on sending-bank fraud notifications within minutes.
Script customer contact to avoid tipping off, and file SARs with advisory key terms.
Join fraud data-sharing schemes and report time to restrict, funds retained and receiving-side APP liability quarterly.

Money Mule Detection Guide: Mule Accounts, Networks and AML Signals