Money Mule

What Is a Money Mule?

A money mule is a person who receives money into their own account and moves it on for someone else, where the money comes from crime. The mule may forward funds by bank transfer, withdraw cash, buy cryptocurrency, or hand over control of the account entirely. Each mule adds a layer between the original crime and the people who profit from it, which makes the money harder to trace and recover.

Mules are central to many fraud and laundering schemes: authorized push payment scams, investment and romance fraud, business email compromise, account takeover and the proceeds of drug trafficking or cybercrime. Without accounts to receive stolen funds, much of this crime would be far harder to monetize.

Why Money Mules Matter

For financial institutions, mule accounts are where fraud and money laundering meet. A firm can be both the victim's bank and, elsewhere in the chain, the bank of the mule who receives the funds. Regulators increasingly expect firms to detect and act on mule activity at the receiving end, not only to protect paying customers.

For the individuals involved, the consequences are serious. Acting as a mule is a criminal offense in many jurisdictions, even when the person claims not to know where the money came from. Mules can lose access to banking, face prosecution and be pursued for the funds that passed through their accounts.

Types of Money Mules

• Unwitting mules believe they are doing something legitimate, such as working for a "payment processing" company or helping an online partner. They are often recruited through fake job ads or romance scams.
• Witting mules suspect or know the activity is wrong but go along with it, often for a fee, and ignore obvious warning signs.
• Complicit mules knowingly take part, sometimes recruiting others or opening several accounts for the purpose.
• Account sellers sell or rent their account credentials, cards and devices to criminals, who then operate the account themselves.

How Mules Are Recruited

Common recruitment methods include:

• Job adverts for "financial agents", "payment processors" or remote work that only involves receiving and forwarding money
• Social media posts offering easy money for "lending" an account
• Romance scams in which the victim is asked to receive and pass on funds
• Targeting students, recent arrivals and people in financial difficulty
• Pressure or threats once a person has already been drawn in

Red Flags for Mule Accounts

• A new or long-dormant account suddenly receiving several incoming payments from unrelated senders
• Funds moved out quickly after arrival, often in full and to new beneficiaries, crypto exchanges or cash withdrawals
• Activity inconsistent with the customer's stated occupation, age or income
• Payment references that suggest invoices, loans or investments unrelated to the customer's profile
• Logins from devices, IP addresses or locations shared with other accounts, or that differ from the customer's usual pattern
• Changes to contact details or new devices shortly before high-value inflows
• Customers who cannot explain where incoming funds came from, or who give rehearsed answers

Mule activity is often visible as a network rather than in a single account. Linking accounts through shared devices, counterparties and identifiers is one of the most effective ways to find it.

Regulatory Expectations

AML frameworks such as the FATF Recommendations, the EU AML Directives and AML Regulation (EU) 2024/1624, the UK Money Laundering Regulations 2017 and the US Bank Secrecy Act require firms to perform customer due diligence, monitor transactions and report suspicion. These obligations apply directly to mule activity. In the UK, reimbursement rules for authorized push payment fraud also place a share of responsibility on the receiving firm, which has sharpened attention on inbound mule detection.

When a firm suspects an account is being used as a mule account, it should consider its reporting obligations, including filing a suspicious activity report, and be careful not to tip off the customer.

Prevention and Detection

1. Onboarding checks that test whether contact details, devices and identity data are genuine and consistent.
2. Transaction monitoring rules for rapid in-and-out movement, multiple unrelated senders and mismatches with the customer profile.
3. Device and network analytics to link accounts operated by the same people.
4. Inter-bank cooperation where permitted, so that receiving banks learn about fraud reports quickly.
5. Customer education about recruitment tactics and the consequences of lending an account.

How on8.ai Helps

on8.ai's Pre-KYC checks look at email, phone, IP risk, velocity and bot signals before onboarding, which helps flag accounts created in bulk or with disposable details. These signals complement transaction monitoring, where mule behavior usually becomes visible.

Related Terms

• Smurfing
• Layering
• Account Takeover (ATO)
• Transaction Monitoring System (TMS)
• SAR (Suspicious Activity Report)
• Phishing