Money Mules
Unwitting, witting or complicit people and accounts that receive and move illicit funds: the cash-out layer nearly every scam, ATO and payment fraud depends on.
What it is
Mules are the bottleneck that most transaction fraud shares. Scams (Authorized Push Payment (APP) Scams), takeovers (Account Takeover (ATO)), check and ACH fraud (Check and Mobile Deposit Fraud, ACH Funding Fraud), marketplace fraud and promo abuse all need somewhere for value to land that doesn't lead straight back to the criminal. That makes mule detection one of the best-returning investments a program can make. Shutting down one mule account protects every future victim who would have paid into it.
The FBI describes three levels of awareness. Unwitting mules don't realize they're in a criminal scheme, and are usually recruited through romance or job scams. Witting mules ignore red flags or deliberately avoid knowing, and may keep opening accounts after bank warnings; many start out unwitting. Complicit mules know what they're doing: they open accounts at several institutions, advertise their services, or recruit others. Treat the three as a spectrum:
| Type | Awareness | Typical recruitment | Response implication |
|---|---|---|---|
| Unwitting / unknowing | Believes the activity is legitimate | Romance, fake job ("payment processing agent"), lottery or grant scams, overpayment scams | Often a victim; education and offboarding, sometimes reimbursement questions |
| Witting | Ignores red flags or suspects wrongdoing; paid or pressured | Social-media "easy money," friends and family, students | Offboard; may be charged; SAR |
| Complicit | Knowingly opens, sells or operates accounts; may recruit others | Criminal networks, account sellers | Offboard; law-enforcement referral; network takedown |
Mule accounts come from several sources, and the source determines where you catch them:
- Lent or rented real accounts. A real customer passes KYC and later hands over access. Onboarding controls won't catch it, so detection falls to behavior monitoring.
- Purpose-opened accounts. Real people open accounts in order to sell them. See Account Farming and Resale.
- Synthetic or stolen identities. See Synthetic Identity Fraud and Generative AI and Deepfake Fraud. FinCEN's 2024 deepfake alert describes GenAI-made identity documents used to open accounts that receive and launder proceeds of other fraud, including funnel accounts.
- Taken-over accounts used as pass-throughs.
- Victim accounts. Scam victims instructed to receive and forward funds. FinCEN found scammers sometimes use victims both as a source of funds and to launder gains.
How it works
Transaction footprint
| Stage | What you see in the data | Decision point |
|---|---|---|
| Onboarding | Identity elements, devices or IPs shared with other new accounts; student or young-adult clusters; addresses far from activity; KYC near pass thresholds | KYC and Customer Identification Program (CIP), Identity Verification Outcomes, Device Reputation and Linkage |
| Dormancy or aging | Account opened and left quiet, or lightly used with small "warm-up" activity | Re-score on activation; Customer Tenure and History |
| Activation | Sudden inbound from many unrelated senders, or a few large credits inconsistent with the profile (payroll-like, check deposits, P2P from strangers) | Inbound-focused monitoring; most programs over-index on outbound |
| Pass-through | Funds leave within minutes to hours: P2P, crypto purchase, ATM withdrawals, cashier's checks, wires abroad | Fast In Fast Out Patterns, Funds Availability Holds, Withdrawal and Payout Controls |
| Access shift | Logins from a new device or location after an ownership hand-off; one device controlling many accounts | Login Anomalies, Entity Link Analysis |
| Network | Same beneficiaries, wallets or devices across many accounts; chains of accounts passing similar amounts | Graph Analytics |
| Exit | Account abandoned after reversals or recalls start; overdrawn after a returned check | Recovery, offboarding, SAR, information sharing |
Inbound vs outbound. Sender-side scam detection finds victims, while receiver-side mule detection finds the infrastructure the money lands in. Real-time inbound scoring on instant rails (score a credit before making it available) is still rare. The FBI's IC3 notes that a single ATO incident can involve 50 or more transfers to different accounts at multiple banks. A multi-institution fan-out like that only becomes visible through sharing.
Common variants
| Variant | What's different | Where it shows up |
|---|---|---|
| Job-scam mules ("payment agent") | Unwitting; receives and forwards "client payments" | Banks, P2P |
| Romance-recruited mules | Victim forwards money "for their partner" | Banks, crypto |
| Account sellers and renters | Complicit; credentials and devices handed over | Neobanks, fintechs with fast onboarding |
| Student mules | Accounts lent for a fee; FinCEN found | Banks near universities, fintechs |
| Business or shell mules | LLCs or sole-prop accounts receiving "invoice" payments | Business banking; scam-center laundering (FinCEN 2026) |
| Crypto off-ramp mules | Receive fiat, buy crypto, send to wallets | Exchanges, kiosks |
| Marketplace and rewards mules | Seller accounts or reward-payout accounts that receive fraud proceeds | Marketplaces, cashback apps |
| Check mules | Deposit counterfeit or stolen checks and withdraw before return | RDC; see Check and Mobile Deposit Fraud |
Where it shows up
- Neobanks and Consumer Fintech: fast digital onboarding, instant availability and P2P make them preferred mule venues. Expect higher mule rates than incumbents unless you invest in inbound monitoring.
- Payments and P2P: receiving end of APP scams, so mule tokens and handles accumulate here.
- Brokerage and Investing: cash-out accounts for ACATS and ramp-and-dump proceeds, and receiving accounts for investment-club funding.
- Online Marketplaces: seller accounts used to receive stolen-card or scam proceeds as "sales." See Triangulation Fraud and Seller Non-Delivery and Fake Listings.
- Cashback, Coupons and Rewards: payout accounts (bank, PayPal, gift card) that consolidate balances from farmed or taken-over accounts. Payout destinations shared across many reward accounts are a mule pattern.
- Retail and Ecommerce: gift-card and resale cash-out, and reshippers.
Impact
- Direct loss: mostly borne by the victim's institution or the victim. Receiving institutions bear return losses on check and ACH deposits, and increasingly share scam liability where regulation requires it (see Case Study - UK APP Scam Reimbursement Rules (2024)).
- Regulatory: hosting mule accounts creates BSA/AML exposure: SAR obligations, CDD failures, and in the extreme, enforcement. See Case Study - TD Bank AML Failures (2024) and BSA-AML and SAR Filing.
- Scale indicators: FinCEN's analysis of Chinese money laundering networks (2020–2024) covered 137,153 reports and about $312B in suspicious activity. Its 2026 scam-center alert describes money mules and shell companies as standard laundering infrastructure for digital-asset investment scams.
- Ops cost: mule investigations are graph problems. Without Graph Analytics and Case Management Systems they swallow analyst time.
Red flags
- Inbound credits from many unrelated senders, or one-time large credits out of profile → Transaction Pattern Anomalies, Payee and Counterparty Risk, Payout Destination Intelligence
- Funds out within minutes or hours of arrival → Fast In Fast Out Patterns
- Devices, IPs, emails or phones shared across accounts → Device Reputation and Linkage, Entity Link Analysis, IP Reputation and Proxy Detection
- New or dormant account suddenly active, or a spike in inbound count or unique senders → Customer Tenure and History, Velocity Signals
- Account opened with marginal identity results, or identity elements that don't fit the activity → Identity Verification Outcomes, Identity Element Consistency
- Counterparty appears in other institutions' fraud reports → External Intelligence Feeds
Prevention and detection at a glance
| Layer | Control or signal | What it does here |
|---|---|---|
| Prevent | KYC and Customer Identification Program (CIP) + Document Verification and Liveness + device linkage | Stops purpose-opened and synthetic mules at the door |
| Prevent | Funds Availability Holds calibrated by tenure and source | Gives returns and recalls time to land |
| Detect | Inbound-focused Transaction Monitoring (real-time where rails allow) | Catches activation of lent or aged accounts |
| Detect | Graph Analytics across devices, beneficiaries, wallets | Turns single-account weak signals into networks |
| Respond | Offboarding with Negative Lists and Deny Lists; SAR; law-enforcement referral | Prevents re-onboarding and feeds intelligence |
| Respond | Consortium and Data Sharing (314(b), network and consortium mule lists) | FinCEN's 2026 314(b) fact sheet explicitly covers mule recruitment and real-time sharing |
| Educate | Outreach to likely-unwitting mules (students, job seekers) | Cheap, and reduces repeat use |
Emerging variants and adversary adaptation
- Mule-as-a-service. Account supply is now a specialized role in the fraud economy. FinCEN's 2026 scam-center alert describes operators outsourcing financial accounts and front companies to professional launderers through escrow-style marketplaces. See Fraud-as-a-Service Ecosystem.
- Synthetic and AI-assisted mules. GenAI-made identity documents and deepfake selfies lower the cost of opening accounts in non-existent or stolen names (FinCEN deepfake alert; FINRA 2026 report).
- Business-account mules. Shell companies and sole-proprietor accounts receiving "invoice" payments are harder to flag on consumer behavior models.
- Fan-out to defeat thresholds. IC3 notes ATO incidents with 50+ transfers across multiple banks. Expect more dispersal across institutions to stay under per-account limits, which strengthens the case for consortium visibility.
- Faster sharing. FinCEN's June 2026 314(b) fact sheet confirms real-time sharing and coverage of attempted transactions and mule recruitment. Receiving and sending banks can now coordinate while a scam is still in progress as well as afterward.
- Enforcement by disruption. Most US action against mules has come through warning letters and civil steps rather than prosecution. The DOJ-led Money Mule Initiative ran coordinated national sweeps with the FBI, the Postal Inspection Service and other agencies. Over 600 mules were targeted in 2019. The third sweep (2020) took action against about 2,300, mostly through warning letters plus civil injunctions and administrative actions, run alongside Europol's EMMA operation. The fourth (2021) reached 4,750 mules. The releases highlight a handful of criminal cases rather than national charge counts. For practitioners, warning letters mean many mules stay active and bankable unless institutions offboard and share.
Related mechanisms
- Authorized Push Payment (APP) Scams, Investment Scams (Pig Butchering), Impersonation Scams: the main inbound flows
- Account Takeover (ATO), Payout Redirection, ACATS Transfer Fraud: ATO cash-outs into mules
- Account Farming and Resale, Synthetic Identity Fraud, Multi-Accounting: account supply
- Fraud Rings and Collusion, Insider Fraud, Fraud-as-a-Service Ecosystem: the organizational layer
- Seller-Targeted Scams (Fake Payment and Overpayment): overpayment as an unwitting-mule recruiter
Real-world examples
- Case Study - TD Bank AML Failures (2024): laundering networks and complicit employees moving funds through a major bank
- Case Study - Prince Group Pig Butchering Enforcement (2025): scam-compound proceeds and the laundering infrastructure behind them
- 2026-09-03 FinCEN scam center alert and what it asks of fraud teams: FinCEN describes US mule and shell-company accounts and sham MSBs receiving scam-center victim funds
Sources and further reading
- FinCEN Section 314(b) Fact Sheet (June 2026): mule recruitment, attempted transactions and real-time sharing in scope
- FinCEN Alert FIN-2026-Alert005 on scam-center money laundering: mules, shell companies and professional launderers in scam proceeds
- FinCEN Financial Trend Analysis: Chinese Money Laundering Networks 2020–2024: US-based mules; students lending accounts (14% of reports)
- FinCEN Financial Trend Analysis: Elder Financial Exploitation: mule recruitment through employment, romance and lottery scams; victims as unwitting mules
- FinCEN Alert FIN-2024-Alert004 on deepfake media: GenAI-made identities used to open receiving and funnel accounts
- FinCEN Advisory FIN-2020-A003 on Imposter Scams and Money Mule Schemes: foundational mule advisory (July 2020)
- FBI IC3 2025 Internet Crime Report: ATO incidents fanning out to 50+ accounts; overpayment schemes; kill-chain freeze results
- FBI IC3 PSA: Money Mules: A Financial Crisis (2021): FBI definitions of unwitting, witting and complicit mules; recruitment red flags
- DOJ (E.D. Ky.): US law enforcement takes action against approximately 2,300 money mules in global crackdown (December 2020): third Money Mule Initiative: ~2,300 mules, ~2,000 warning letters, participating agencies, Europol EMMA
- DOJ (D. Me.): US law enforcement targets fraud facilitators, doubling last year's enforcement (December 2021): fourth Money Mule Initiative: 4,750 mules