Money mules: how mule accounts move stolen money, and how to spot them
A money mule is a person who receives stolen money into their own account and forwards it on, often keeping a small cut. Criminals recruit mules with fake job ads or romance scams. For platforms with payouts, mule accounts show up as fresh accounts that receive funds and withdraw them almost immediately.
Updated · RiskCogs team
Key facts
- Money mules help launder the proceeds of fraud, scams and other crime.
- Many mules are recruited through fake work-from-home job offers or social media.
- Acting as a money mule is a crime in many countries, even if the mule did not know the source.
- Fast in-and-out movement of funds is the classic mule account pattern.
How a money mule scheme works
A criminal steals money through fraud, account takeover or a scam and needs to move it without leading back to themselves. A recruited mule receives the funds, forwards them by transfer, cash withdrawal, gift cards or crypto, and the money is layered through further accounts until it is hard to trace.
Warning signs of a mule account
- New account receiving incoming funds from unrelated senders.
- Balance withdrawn or forwarded within minutes or hours.
- Payout details changed shortly before a large withdrawal.
- Several accounts sharing one device, IP or payout destination.
- Activity that does not match the stated purpose of the account.
Where fraud and AML teams meet
Mule activity sits between fraud and money laundering. Fraud teams see the account takeover or scam that created the funds; AML teams see the movement. Sharing device, account and payout links between the two teams makes mule networks visible much earlier than either view alone.
How RiskCogs helps flag mule-like behaviour
RiskCogs scores events such as payouts and changes to payout details, not only card payments. Velocity, account age and links between accounts by device and IP feed into the score, and rules can send fast in-and-out patterns to review.
RiskCogs supports fraud decisions; it is not an AML screening or reporting system, and it does not process payments.
See what you would have blocked — free shadow modeFrequently asked questions
What is a money mule?
A money mule is someone who lets their bank or payment account be used to receive and pass on money that came from crime. Some mules know what they are doing, others are tricked by fake job offers or romance scams, but in many countries it is a criminal offence either way.
How can a platform detect money mule accounts?
Look for new accounts that receive funds and move them out quickly, payout details that change just before withdrawals, and accounts linked by device, IP or payout destination. Combining these signals in a risk score and reviewing high-scoring payouts catches many mule accounts before money leaves.
Is money mule activity fraud or money laundering?
Both. The money usually comes from fraud such as scams or account takeover, while moving it through mule accounts is a money laundering technique. That is why fraud and AML teams benefit from sharing signals and case information about suspected mule accounts.
Sources and related reading
- Europol, European Money Mule Action (EMMA), public campaign materials.
- FATF, International Standards on Combating Money Laundering (FATF Recommendations), public edition.
Measure first. Enforce when ready.
Run RiskCogs in shadow mode next to your existing payment setup and review the decisions before they affect a single customer.