Money Mules
What is a money mule?
A money mule is a person whose bank account is used to receive stolen money from scams or other fraud and forward it to criminals. Money mules may act knowingly in exchange for payment, or unknowingly after a fake job, a romance scam or an investment offer persuades them to receive and send money via their personal account. Other names for a money mule include mule account holder and cash mule.
Money mules handle proceeds from many kinds of fraud, including authorized push payment scams, romance scams, invoice fraud and account takeover. They are separate from the fraudsters who run the scams: the fraudster deceives the victim and directs the money, while the mule supplies the receiving account and moves it along to the fraud ring. Australia's financial intelligence agency, the Australian Transaction Reports and Analysis Centre (AUSTRAC), describes a money mule as someone who transfers or moves illegally acquired money on behalf of someone else, whether as cash, bank transfers, prepaid cards or virtual assets.
How does a money mule account work?
A mule account takes in scam proceeds and moves them on quickly, typically in four stages.
- Recruitment or acquisition. An account enters mule service in one of three ways: a genuine holder is recruited and keeps control, a genuine holder sells or rents access, or an account is opened outright under a fabricated or stolen identity.
- Receipt. Scam proceeds arrive as an inbound credit that looks unremarkable to the paying bank, because the payer authorized the payment.
- Onward transfer. The balance is split across further accounts and moved between institutions and payment rails, and a single mule account may hold funds for only minutes.
- Cash-out. The chain ends with an ATM withdrawal, a purchase of goods or crypto assets, or a transfer abroad. Research from the Global Anti-Scam Alliance and Feedzai indicates that nearly half of scams run from first contact to payment inside 24 hours, so the full cycle can finish in a single day.
Are money mules always aware of the crime?
Money mules may have anywhere from zero awareness to complete awareness and consent.
A money mule scam specifically refers to cases in which the mule has little to no awareness, believing the reason for a money transfer or payment is legitimate. Potential mules, or recruits, are often approached by someone they trust, such as an online romantic partner or a new employer, who asks them to receive money in their own bank account and send it on.
Operators with complete awareness of their position as a monet mule often open or buy accounts in volume, usually under fabricated identities, and treat mule accounts as inventory. Both categories of mule accounts produce similar account behavior, so intent cannot be read from transaction data alone.
How is a money mule different from an account takeover victim?
The difference is who controls the account and whether its owner took part.
In account takeover, a fraudster gets into a legitimate customer's account, usually with stolen credentials or by exploiting a security weakness, and moves money with little or no knowledge from the owner, which often shows up as a change in the account's normal activity, device or location.
A money mule, on the other hand, is an account holder who receives funds and moves them on, knowingly or not, so the owner carries out the activity. The two can overlap if a fraudster uses a hijacked account to route money stolen from other victims, which makes the owner an involuntary mule.
What are examples of money mules?
People become money mules in a variety of ways, and the example scenarios below show three common routes.
Fake job:
- A jobseeker accepts a remote payment-processing role.
- The role involves receiving client transfers and forwarding them minus a commission.
- The account is frozen after several weeks.
Rented account:
- A student is offered cash through social media to hand over card and login credentials for two weeks.
- The credentials are used to receive and move scam funds.
- The account is meant to be handed back afterward.
Farmed account:
- An operator opens accounts at several institutions under fabricated identities.
- The accounts stay dormant for months.
- They are activated to receive scam funds within a single week.
Why do money mule accounts matter?
Scam payments have to land somewhere, so receiving accounts are where many different scams meet. UK Finance recorded £576.4 million in APP scam losses across 248,070 cases in 2025, and each of those payments were transferred to a mule account. That makes the account useful for prevention and detection in three ways: the receiving bank can see it even when the payment looks legitimate to the paying bank, one flagged account can stop several scams at once, and the same account, identity or device often appears in more than one case, which lets separate cases be connected.
Is being a money mule illegal?
Acting as a money mule can carry criminal liability in many jurisdictions, including where the account holder says they did not know the source of the funds. In the United States, the Federal Bureau of Investigation (FBI) lists federal charges that include mail fraud, wire fraud and bank fraud, and warns that mule activity can also damage credit and make it harder to open bank accounts. However, offenses, thresholds and knowledge requirements vary by country, so any specific exposure should be confirmed with legal counsel.
How can banks detect money mule accounts?
Banks mainly spot mule accounts by monitoring the receiving side. The payment that fills the account appears legitimate, but the account itself shows warning signs in its inbound activity:
- Unexpected credit velocity: a sudden run of incoming payments, often from several unrelated senders, on an account that normally receives few.
- Rapid dispersal of the full balance: funds leave within minutes or hours, usually as a few large transfers or a cash withdrawal, so little stays in the account.
- A mismatch between the declared purpose of the account and the money flowing through it, such as a student account receiving business-sized transfers from counterparties (the other parties to a payment) it has never dealt with.
- Device reuse across unrelated accounts: the same device or login pattern appearing on several accounts that have no apparent link.
These signals depend on receiving-side monitoring, not on scoring the payment itself. Payee checks such as Confirmation of Payee, the UK service that matches the name on a receiving account to the name the payer entered, also focus on the receiving account, but they confirm a name, not how the account behaves. No single signal confirms a mule account, so banks usually combine several and review the account before acting.
Talk with a fraud solutions consultant
Each institution's exposure depends on its own payment rails, customers and data. Banks that want to assess theirs can learn more by booking a meeting with FraudNet's solutions consultants.
Related terms
- Authorized push payment fraud
- Fraud prevention
- Confirmation of Payee
%20(640%20x%201229%20px).png)
Get Started Today
Experience how FraudNet can help you reduce fraud, stay compliant, and protect your business and bottom line
You might be interested in…
