Money Mule Network

A money mule network is an organised group of people and bank accounts used to receive, move and cash out the proceeds of crime, so that the money cannot easily be traced back to the offence or the organisers. It typically includes recruiters, controllers who direct the flows, and many account holders (the mules) who receive funds and pass them on. Networks serve fraud gangs, scam call centres, drug traffickers and cyber-criminals.

The network is different from a single mule (bank) account. One mule account is a single node: an account that receives and forwards illicit money. The network is the whole structure: the people who run it, the layers of accounts, the cash-out points and the way they are coordinated. Investigators and banks increasingly target the network rather than individual accounts, because closing one account has little effect when the controller can switch to dozens of others.

Think of a relay race designed to lose the spectators. Stolen money is the baton. It is handed from runner to runner, each in a different lane, some crossing borders, some turning the baton into cash or crypto. By the time anyone looks, the baton has passed through so many hands that it is hard to say where it started.

The runners are often ordinary people: students offered "easy money", job seekers told they are doing payment processing, or scam victims talked into forwarding funds. The organisers stay off the track. That is why a network can survive the loss of many runners, and why police try to find the coaches rather than just the people holding the baton.

• Organisers. The criminals who own the proceeds, often linked to professional money laundering groups that sell mule capacity as a service.
• Recruiters ("herders"). People who find mules through social media, fake job adverts, campuses and romance contacts, and who sometimes handle many mules each.
• Mules. Account holders who receive and forward funds. Some are unwitting, some are complicit for a fee, and some are themselves victims of coercion.
• Collector or hub accounts. Accounts where flows from many mules are pooled before onward transfer, a pattern close to a funnel account.
• Cash-out points. ATMs, money transfer agents, crypto exchanges and merchants used to take money out of the banking system.

A typical flow starts with a predicate crime such as authorized push payment (APP) fraud, business email compromise (BEC) or a pig butchering scam. The victim's money lands in a first-tier mule account. Within minutes or hours it is split and sent on to second- and third-tier accounts, often at other banks and sometimes abroad, then withdrawn as cash, converted into crypto or used to buy goods. This splitting and hopping is the layering stage among the classic money laundering stages. Faster payment systems have shortened the time banks have to stop it, and organisers often rotate through fresh accounts every few weeks so that no single account builds up a long, suspicious history.

Single-account rules catch obvious mules but miss the structure. Banks and payment firms therefore combine several approaches:

• Transaction patterns. Transaction monitoring looks for in-and-out flows, round-sum transfers, new accounts receiving many third-party credits, and other layering indicators.
• Link analysis. Graph tools connect accounts by shared devices, IP addresses, phone numbers and counterparties to reveal clusters.
• Inbound-payment monitoring. Receiving banks score incoming credits, not just outgoing ones, because mule accounts are usually at the receiving end.
• Information sharing. Industry and public-private schemes let banks warn each other about flagged accounts.

Alerts are worked in a case management system, and confirmed activity leads to account closure, fund freezes where the law allows, and a suspicious activity report (SAR).

Law enforcement runs coordinated actions against networks. In Europe, Europol, Eurojust and the European Banking Federation set up the European Money Mule Action (EMMA) in 2016; its rounds have identified thousands of mules, and the seventh round, concluded in December 2021, reported over 1,800 arrests. In the US, federal agencies have run national initiatives against mule activity, and in the UK, banks and Cifas run awareness campaigns aimed at young people. Mules can face criminal charges for money laundering, closure of their accounts and fraud markers that limit future banking. The organisers are harder to reach, which is why network-level intelligence matters. Some mules also commit first-party fraud by later claiming their account was taken over.

• Europol
• Federal Bureau of Investigation (FBI)