Bursting

What Is Bursting?

Bursting is a pattern where an account that normally shows little or modest activity suddenly processes a large number of transactions, usually of low or moderate value, within a short period. The activity spikes, peaks and then often stops just as abruptly. The account may go quiet again, be abandoned, or be closed shortly afterwards.

In money laundering and fraud, bursting reflects a simple economic logic. A criminal who controls an account knows it will probably be detected and frozen sooner or later. The aim is to push as much money through it as possible before that happens. Spreading the flow over many smaller payments can also help each individual transaction look unremarkable.

Bursting is a behavioral pattern rather than a crime in itself. Plenty of legitimate businesses have peaks: a retailer during a seasonal sale, a ticketing account when an event goes on sale, a payroll account at month end. What makes bursting suspicious is that the spike does not fit the customer's known profile and has no plausible explanation.

Why Bursting Matters

Bursting is closely associated with some of the most common threats facing banks, payment institutions and fintechs:

• Money mule accounts. Accounts opened or recruited to receive and forward criminal proceeds are often used intensively for a short window before being abandoned. See money mule.
• Authorized push payment and investment scams. Proceeds from many victims arrive in quick succession and are moved on rapidly to other accounts or converted into other assets.
• Account takeover. After gaining control of a genuine account, a fraudster may drain it through many fast transfers. See account takeover.
• Synthetic and newly opened accounts. An account built on a synthetic identity may sit dormant until it is used for a single intense burst.

Because the burst is short, the window for detection and intervention is short too. Controls that only look at activity in daily or monthly batches may identify the pattern after the money has already gone.

How Bursting Shows Up in Practice

Typical Red Flags

• A sharp increase in transaction count or total value compared with the account's own history.
• Many incoming payments from different, unrelated senders, followed quickly by outgoing payments to a small number of beneficiaries, or the reverse.
• Funds leaving the account almost as soon as they arrive, leaving a low end-of-day balance.
• Activity concentrated in unusual hours or compressed into a few hours or days.
• A newly opened account, or one dormant for a long time, suddenly becoming very active.
• Changes to contact details, devices or login locations shortly before the spike.
• Transaction values clustered just below internal limits or reporting thresholds, which overlaps with smurfing.

Detection Approaches

Detecting bursting depends on comparing current behavior with an expected baseline. Common techniques include:

1. Velocity rules. Counting transactions or summing values over rolling windows, such as the last hour or last 24 hours, and alerting when they exceed a threshold.
2. Peer and self comparison. Measuring how far current activity deviates from the customer's own history and from similar customers.
3. Flow analysis. Looking at the ratio of incoming to outgoing funds and how long money stays in the account.
4. Network signals. Linking accounts that share devices, IP addresses, contact details or counterparties, which can reveal a group of mule accounts bursting at the same time.
5. Session and device data. Flagging new devices, unusual locations or automated behavior around the time of the spike.

The design choice that matters most is timing. Near real-time evaluation gives a firm the chance to hold or review a payment before funds leave, while batch review mainly supports later investigation and reporting.

Regulatory Expectations

AML frameworks do not usually name bursting as a defined term. They do require firms to monitor transactions and relationships on an ongoing basis and to identify activity that is unusual or inconsistent with what the firm knows about the customer. That obligation appears in the FATF Recommendations, the EU AML framework including Regulation (EU) 2024/1624, the US Bank Secrecy Act and FinCEN's rules, and the UK Money Laundering Regulations 2017.

Where bursting activity cannot be explained, firms should consider whether it gives grounds for a suspicious activity report to the relevant Financial Intelligence Unit, as well as whether to restrict the account.

Common Challenges

• Thin history. New accounts have no baseline, which is exactly where mule and synthetic accounts sit. Onboarding signals become important to fill the gap.
• Legitimate peaks. Seasonal businesses, marketplaces and payroll accounts can trigger velocity rules for innocent reasons. Segmenting customers and setting thresholds per segment reduces false positives.
• Speed of instant payments. When funds settle in seconds, a burst can be complete before a batch alert is even generated.
• Distributed bursts. Criminal networks may spread activity across many accounts so that no single account looks extreme. Network analysis helps here.

How on8.ai Helps

on8.ai focuses on the point before an account is used. Pre-KYC checks look at email, phone and IP risk and apply velocity control and bot detection at sign-up, which helps firms spot clusters of accounts being opened for later intensive use. SmartSanction screens customers and counterparties against sanctions, PEP and other risk sources with the reasoning behind each match.

Related Terms

• Money Mule
• Smurfing
• Transaction Monitoring System (TMS)
• Alert Rules
• Layering
• Account Takeover (ATO)