Fast In Fast Out Patterns

What it measures

Fast in, fast out (FIFO) is the investigators' phrase for pass-through activity, unrelated to the inventory-accounting term. It describes a relationship between inbound and outbound value. The core measures:

Why it matters

Almost every transaction fraud ends with value leaving. FIFO is the one pattern common to the cash-out step of very different mechanisms:

• Unwitting and complicit mules: scam proceeds or stolen funds arrive by P2P, ACH credit or check and are forwarded within hours.
• Funding fraud and kiting: an unauthorized or doomed ACH pull or check deposit is made available instantly and withdrawn before the return arrives.
• ATO cash-out: a brokerage account is liquidated and the proceeds pushed out; a rewards balance is redeemed to a new gift card email.
• Reward farming: bonus or cashback credited, then withdrawn at the earliest eligible moment, across many accounts.

FinCEN red flags repeatedly describe this shape: the mail-theft check fraud alert (FIN-2023-Alert003) flags sudden check deposits, often electronic, followed by rapid withdrawal or transfer; the pig butchering alert flags a customer receiving a crypto deposit close to an amount sent earlier and then sending much larger amounts out. Nacha's 2026 RDFI credit-monitoring rules list activity on new, dormant or mule-like accounts and clusters of similar credits among possible red flags for incoming entries.

How to collect it

• Build a unified ledger view per account and per customer across all rails, with both initiated and settled timestamps and the reversal window for each inbound item.
• Maintain a "provisional exposure" balance: value made available that could still be returned or disputed. FIFO risk is highest when outbound draws against this balance.
• Link inbound originators and outbound beneficiaries to entities (Entity Link Analysis) so you can see the networks behind single accounts.
• This is a build signal: vendors provide transaction monitoring scenarios, but dwell time, settlement gap and cross-product sequences depend on your ledger.

How to use it

• Evaluate at the outbound decision (Withdrawal and Payout Controls): when an outbound request draws on value that arrived recently, especially unsettled value, apply holds, step-up or review.
• Combine with tenure and baseline: FIFO on a brand-new account (peer anomaly) suggests mule or funding fraud; FIFO on a long-tenured account that never did it before (self anomaly) suggests ATO or a scam victim being coached to move money (Scam Victim Indicators).
• Combine with source and destination signals: inbound from a source that fails ownership checks (Funding Source Signals) and outbound to a destination shared across accounts (Payee and Counterparty Risk) is near-conclusive.
• Look at networks: many accounts receiving from the same originators and forwarding to the same beneficiaries is a mule network or ring (Fraud Rings and Collusion, Graph Analytics).
• Use as an AML handoff: sustained pass-through without fraud loss to you may still be laundering, so route it to BSA-AML and SAR Filing processes.

Strengths and limitations

Strengths: mechanism-agnostic; tied directly to where the loss occurs; interpretable for reviewers and SAR narratives; detects mules even when identity looks clean.

Limitations: timing-based features can be degraded by adaptive adversaries. Compensate with settlement-aware exposure limits that don't depend on timing alone, plus source, destination and network signals. Instant rails compress the decision window to seconds. Cross-institution flows are only partly visible from one platform; information sharing (see External Intelligence Feeds) fills some gaps.

False positives and fairness

• Paycheck-to-paycheck customers who withdraw or spend nearly everything on payday, producing high pass-through that is entirely legitimate.
• People using a fintech as a "transit" account (receive P2P, move to their main bank).
• Small businesses and gig workers using personal accounts to receive and pay out.
• Active traders who deposit, trade and withdraw profits frequently.
• Extreme couponers and cashback power users who cash out as soon as they reach the threshold.
• Customers moving money to a new bank after switching.

Distinguish by settlement gap, source–destination ownership and network context rather than speed alone; penalizing speed alone disproportionately hurts lower-income customers.

Privacy and compliance considerations

Pass-through monitoring is a core BSA/AML expectation and appears in multiple FinCEN advisories; SAR decisions and timelines apply when FIFO indicates laundering or mule activity. Holds on outbound transfers must be consistent with disclosures and Reg E/Reg CC where applicable. RDFIs gained explicit credit-monitoring duties under the 2026 Nacha rules (Nacha Rules and ACH Risk).

Mechanisms it helps detect

Money Mules · ACH Funding Fraud · Instant Funding Abuse (Kiting) · Check and Mobile Deposit Fraud · Account Takeover (ATO) · Payout Redirection · Real-Time Payment Rail Fraud · Loyalty and Rewards Redemption Fraud · Sign-Up Bonus Abuse

Related signals and controls

Funding Source Signals · Payee and Counterparty Risk · Customer Tenure and History · Entity Link Analysis · Velocity Signals · Funds Availability Holds · Velocity and Exposure Limits · Playbook - Money Mule Detection Members · Playbook - Payout and Withdrawal Risk Members · Playbook - Instant Funding Abuse Members

Sources and further reading

• FinCEN Alert on Mail Theft-Related Check Fraud (FIN-2023-Alert003): deposits followed by rapid withdrawal or transfer; new accounts used only for check deposits.
• FinCEN Alert on Pig Butchering (FIN-2023-Alert005): inbound crypto close to an earlier outbound, followed by larger outbound transfers.
• Nacha: Fraud Monitoring Phase 1: RDFI credit-monitoring examples including new, dormant or mule-like accounts.
• FinCEN Financial Trend Analysis: Elder Financial Exploitation: victims used as unwitting mules; growth of digital/P2P channels.