Money Mule Accounts: Signals Before the Money Moves

Every fraud that ends in a transfer needs somewhere for the money to land. That somewhere is usually a mule account: a real account, opened by a real person, who has agreed to receive money and pass it on for a cut. Some are students offered "easy commission" on social media. Some sell their login outright. Some have no idea what they are part of.

For a fintech, mule accounts are where fraud and money laundering meet. Catching them protects every customer who would otherwise send money into them.

Three kinds of mule

• The recruited mule knowingly lets others use the account for a fee. Usually young, often new to banking.
• The sold account is opened by one person and handed over entirely, with credentials and sometimes the SIM.
• The unwitting mule believes they are doing a job, for example "processing payments" for an online employer.

They look different at onboarding, but they behave the same once money starts moving.

Signals at onboarding

• The account is opened on a device already linked to other new accounts.
• The phone number or email has been used on another account in the past few weeks.
• The stated occupation and expected activity are thin: a student, no income, but a request for high limits.
• The signup happens from a location or network that does not fit the rest of the profile.

Each one raises the starting risk, so the account gets watched more closely in its first weeks.

Signals once money moves

This is where mules give themselves away. The account exists to move money, not to hold it.

• Many incoming transfers from people who have never paid this customer before.
• Money leaves within minutes or hours of arriving, often in round amounts.
• The balance returns to near zero again and again.
• Outgoing transfers go to a small, repeating set of accounts, sometimes abroad.
• The device used to log in changes, or several unrelated accounts are run from the same device.
• Activity jumps from nothing to heavy volume overnight.

A single student receiving money from friends looks nothing like this. Twenty first-time senders in a day, each followed by an outgoing transfer within the hour, is hard to explain any other way.

Connect fraud reports to the receiving side

When a customer reports a scam, the receiving account is evidence. Mark it. If two or three fraud reports point to the same beneficiary, that account is very likely a mule, and every other customer sending to it is probably a victim in progress. Teams that only investigate the sender miss the account that links all the cases together.

What to do with a suspected mule

• Hold outgoing transfers and route the account to review.
• Look at the linked accounts: same device, same phone, same withdrawal destination.
• Check the inbound senders for open fraud reports.
• Escalate to compliance where the pattern points to laundering. Your compliance officer decides on reporting.
• Keep the device and identifiers on a list so the same person cannot simply open the next account.

One platform, both views

Mule detection needs fraud signals (devices, sessions, reports) and AML signals (flows, velocity, counterparties) in the same place. When they live in separate tools, the fraud team sees a victim, the AML team sees an unusual account, and nobody connects them.

Naiza runs fraud decisions, device intelligence, and transaction monitoring on one platform, so a device linked to a scam report shows up when the receiving account trips an AML rule. See transaction monitoring and the money mule entry for more.