Money Mule

A money mule is a person who lets their bank account, payment account or crypto wallet be used to receive money obtained through crime and pass it on, usually keeping a small share as payment. The mule may transfer the money to another account, withdraw it as cash, send it abroad through a money transfer company or convert it into cryptocurrency. Some mules know exactly what they are doing; many are deceived into it.

Mules are an essential part of fraud and money laundering. A criminal who tricks a victim into making a payment needs somewhere for the money to land that is not in the criminal's own name. The mule's account provides that distance. Because mules are the point at which stolen money enters the legitimate banking system, banks and regulators treat finding them as one of the most effective ways to disrupt fraud.

The typical sequence begins with a fraud: an authorized push payment scam, a business email compromise, a romance or investment scam, or a payment from a hijacked account. The victim's money arrives in a first mule account. Within minutes it is split and forwarded to further mule accounts, often at different banks or in different countries, then withdrawn or converted. Each hop makes tracing harder, which is the layering stage of laundering.

Speed is central. Instant payment systems let funds cross several accounts before the victim has realised what happened, so recovery depends on the receiving bank freezing the money almost immediately. Organised groups control hundreds of accounts at once through a money mule network run by recruiters known as mule herders.

• Unwitting mules. People who believe they are doing something legitimate: processing payments for an employer found through a fake job advert, or helping an online partner move funds. Romance scam victims are often turned into mules without realising it.
• Witting mules. People who suspect or ignore the signs because the money is attractive. Students and young adults are frequently targeted through social media with offers of easy cash for the use of an account.
• Complicit mules. People who knowingly open accounts for the purpose, recruit others, or sell their account credentials outright.
• Accounts without a real mule. A mule bank account may be opened with a stolen or fabricated identity, as in synthetic identity fraud, or be a genuine customer's account that criminals have taken over.

Business accounts are valued because large payments through them look less unusual, and shell companies are registered for the purpose.

Moving the proceeds of crime is an offence in most countries, and lack of full knowledge is not always a defence where the person suspected or should have suspected the source. Mules can be prosecuted for money laundering or related offences, be held liable to repay victims, and receive a criminal record.

Even without prosecution, the practical effects are severe. Banks close accounts they identify as mule accounts and record the finding in shared fraud databases, such as the Cifas register in the United Kingdom. A person so marked may be unable to open a bank account, obtain a loan or a phone contract for years. Because many mules are young, authorities and banks run awareness campaigns in schools and universities, and police forces coordinate regular international operations against mule networks.

Detection works on both sides of a payment. On the receiving side, transaction monitoring looks for the characteristic pattern: an account with little history that suddenly receives payments from unrelated people and sends the money out again almost at once, leaving a near-zero balance. Other signals include a new device or location, a change of contact details shortly before the activity, many accounts operated from one device, and payments just under reporting thresholds, a sign of smurfing.

On the sending side, banks warn customers when the name they typed does not match the account, using name-checking services such as Confirmation of Payee, and may delay or question payments to accounts flagged as risky. Controls at account opening, the know your customer checks, aim to stop accounts being created with false identities. Machine learning models and network analysis are used to link accounts that belong to the same fraud ring.

When a bank suspects mule activity it freezes or restricts the account, files a suspicious activity report with the national financial intelligence unit, and tries to return any remaining funds to the victim's bank.

A single bank sees only one leg of a mule chain, so progress depends on sharing information. Industry utilities and payment system operators in several countries now analyse payments across many banks to trace funds through networks of accounts and score the risk of a receiving account before a payment is released. Legal barriers to such sharing, chiefly bank secrecy and data protection rules, have been relaxed in a number of jurisdictions for fraud prevention.

Liability rules increasingly give receiving banks a financial reason to act. In the United Kingdom, since October 2024, the bank that holds the account receiving a scam payment bears half the cost of reimbursing the victim. These measures treat the hosting of mule accounts as a control failure by the bank, not only as wrongdoing by the account holder.