Money Mules

A scam victim can be talked into sending money almost anywhere, but the money has to land in an account first. The FBI defines a money mule as "someone who transfers or moves illegally acquired money on behalf of someone else," and says criminals use mules to put distance between victims and the people who profit, which makes the money trail harder to follow [1]. Mules can move funds through bank accounts, cashier's checks, cash, virtual currency, prepaid debit cards, or money service businesses [1]. In practice, that makes the mule the link between a crime and the regulated financial system.

The scale is large. BioCatch, a fraud-detection vendor, received reports of nearly 2 million mule accounts from 257 financial institutions in 21 countries in 2024, and called that "only a fraction" of the real number [2]. In the UK, 35 firms surveyed by the Financial Conduct Authority (FCA) closed 238,396 accounts as suspected mules in 2025 [3].

For investigators, one fact matters more than any other: the mule is the bank's own customer. The fraudster may sit on another continent, but the account that receives the money carries a name, an identity document, a device history, and a transaction record [4][3].

That record is where the network becomes visible.

That record is also where the hard questions start. The person named on an account may be a paid participant, a deceived job applicant, someone under threat, or an identity-theft victim whose account someone else runs [1][5][6]. Two questions decide most mule cases: who controlled the account, and what did the account holder know? This article follows them from recruitment to the courtroom.

The person, the account, and the operator

Investigators deal with two linked things: the mule, who is a person, and the mule account, which is the bank, payment, or crypto account that person controls or lends [1]. "Mule" is an investigative label, not a single statutory offense. Whether a mule has committed a crime depends on what they did, where the money came from, what they knew, and which country's law applies [7][8].

The FBI sorts mules into three types [1]:

Criminals get control of an account in four main ways:

• Rented or sold. A real person lends or sells an existing account, card, and login. Australian police say mules there are offered $200 to $500 per account plus a typical 10 percent commission [9].
• Opened for the purpose. A recruit opens new accounts. Geoffrey Auyeung opened 81 accounts at 24 institutions, using at least nine business entities, to move $97.1 million in investment-fraud proceeds [10].
• Taken over. Criminals buy stolen online banking credentials, known as "bank logs," and run a real customer's account without that customer knowing [6].
• Synthetic or fake. Accounts are opened with fabricated or AI-altered identities. FinCEN, the U.S. Treasury's financial intelligence unit, has warned that such accounts serve as funnel accounts for fraud [11].

The categories can shift over time. The FBI notes that a witting mule may have started out unwitting and kept going [1]. Sometimes this is from a lack of awareness, but it could be fear based on coercion. An account takeover victim has not acted as a mule at all, even though the account behaved like one [6].

In practice, telling these situations apart means separating four roles: the account, the identity registered to it, the person operating it, and the person who ends up with the money.

A division of labor

The mule is rarely the organizer. A study of 15 closed Dutch police investigations into financial cybercrime networks found that core members needed several kinds of co-offenders, which the authors grouped as professional facilitators, recruited facilitators, and money mules [12]. Some were paid as promised, while others were manipulated and possibly forced to cooperate under threats of violence. Not every network had to go looking: some co-offenders found their own way in [12].

Mule recruitment is also sold as a service. "Your Mule Cashout" (YMCO) recruited more than 15,000 U.S. mules for cybercrime gangs from September 2007 onward, using spam from fake companies, and moved funds on through Western Union and MoneyGram, both money services businesses, to Moldova, Ukraine, Russia, and Latvia; one of its leaders pleaded guilty in October 2026 [13]. On Telegram, vendors sell "drops," receiving accounts for stolen money, alongside stolen identity sets and insider help [14]. INTERPOL reported in 2026 that some West African syndicates bought crime-as-a-service from outside providers, often through the dark web, to outsource money laundering [15].

A mule investigation usually has to separate these roles:

In practice, on a payment graph alone, a low-level account holder can look central just because a lot of money passed through the account. The person who controls the arrangement may never receive a visible payment (on paper).

Counting what no one counts

No agency counts mules directly. Banks, regulators, fraud-data bodies, and vendors each measure a different slice of the problem, so no two figures below measure quite the same thing.

Most of these counts are rising, but they do not count the same thing. An offboarding is a decision by a firm, and changes in the count can reflect better detection, customer growth, or reporting practice as much as more crime [3]. A SAR is a filing, not a finding. It's a suspicion. Many people never appear in any count at all: FCA data for 25 firms showed that only 37 percent of the 194,084 mules they offboarded between January 2022 and September 2023 were reported to the National Fraud Database, the UK's shared fraud register [24].

How mules are recruited

Recruitment usually starts with something ordinary: a job, a relationship, a favor, or a debt [25].

Dutch researchers tested recruitment ads directly. In a quasi-experiment on Instagram, up to about 3 percent of young users engaged with mock mule-recruitment ads. Ads that showed a luxury lifestyle or used "neutralization" language, wording that makes the act sound harmless, drew the most engagement, and men and night-time users engaged more [30]. Follow-up doctoral research at VU Amsterdam surveyed more than 3,000 young people and reviewed 15 police investigations. It found recruitment happening offline as well as online, and that many young people do not realize they can be held accountable [29].

Why people say yes

A UK Home Office study published in July 2026 surveyed 208 people chosen for their willingness to engage with muling scenarios. Ninety-nine of them reported past involvement, and the researchers also interviewed nine former mules and 11 professionals [5]. The sample is not representative, and all nine former mules interviewed had been unwitting, so the study shows how some people experience muling, not how common each pathway is [5].

Within that sample, 53 percent of all respondents had never heard the term "money mule" or did not know what it meant. Among those with mule experience, 83 percent felt pressure to earn more, and 80 percent of muling activities were requested by someone the person knew [5]. The same pattern shows up in Ireland: 47 percent of 18 to 24 year olds had never heard the term, and 27 percent said they would consider moving money for a cut [20].

Mules skew young. Under-30s accounted for 57 percent of UK muling cases filed with Cifas, a fraud-prevention service, in the first half of 2026, and 17 percent involved people under 21 [19]. Of the UK mule accounts closed in 2025, 71.9 percent belonged to 18 to 39 year olds [3]. In Ireland most mules are 18 to 24, some as young as 14 [20]. Age alone does not identify a mule. Couriers in elder scams and the student recruits in Chinese laundering cases show how varied the population is [21][4].

Keeping control

Involvement is often short. In the Home Office sample, 36 percent of muling activities were one-off and most involvement lasted under a month. When mules hesitated, recruiters escalated from persuasion to coercion and threats [5]. In student cases, a handler may escort the recruit to the bank as a "translator" or "friend" [4]. The Dutch police files describe the same range, from paid co-offenders to people manipulated or threatened into taking part [12].

Some mules start as victims. The U.S. Attorney's Office in Miami says many mules begin as victims of romance or lottery scams before being used to move other victims' money, and one of its cases involved recruits of high-school age [31]. That person then plays two distinct roles: victim of the original scam, and channel for later losses.

What mule networks carry

Europol's guidance links mule transactions mainly to cybercrime, including phishing, malware, business email compromise (BEC), and romance scams [32]. Each crime type uses mules in its own way.

Scam and fraud proceeds

Romance, BEC, investment, and unemployment fraud all need receiving accounts. Manaseh Mintah was convicted in September 2026 of laundering at least $1.2 million in romance-scam proceeds through personal accounts and a shell company, Dazionking LLC; his conviction included a count of operating an unlicensed money transmitting business [33]. Oluwasegun Baiyewu received 95 months in August 2026 for laundering $3.1 million from BEC, romance, and unemployment fraud, partly by buying used and salvaged cars for shipment to Nigeria [34]. Geoffrey Auyeung received five years in June 2026 for a laundering conspiracy that moved $97.1 million through his accounts, with proceeds going to Nigeria and Russia and into crypto [10].

A guilty plea in October 2026 shows how far apart the pieces of one scheme can be. Robert Wayne Boling Jr. ran a fraud from the Philippines using personal data stolen by a civilian medical records administrator working for the U.S. Army in South Korea. U.S. mules supplied bank accounts for the stolen funds and helped send part of the money to the Philippines. Sentencing is set for January 14, 2027 [35].

Account takeover and drops

Not every mule account belongs to a willing mule. A SentiLink study of one Telegram marketplace found 1,210 listings covering an estimated 3,250 accounts. Some came with a browser profile for the Octo Browser tool, which lets a buyer reconstruct the victim's browser environment and impersonate the victim online [6]. Stolen funds are pushed to drops and cashed out at ATMs or through crypto [14]. FinCEN found that most elder-scam filings referenced account takeover [23].

Check fraud and walkers

Check-fraud SARs nearly doubled, from more than 350,000 in 2021 to more than 680,000 in 2022, as mail theft surged [22]. Fraudsters recruit "walkers" on Telegram to deposit stolen or altered checks at branches into taken-over or synthetic accounts. A broker helps the walker learn the stolen identity and even dress for the part [27].

Cash and gold couriers

Elder scams increasingly end with a courier at the door. FBI Boston reported 1,737 courier instances nationwide from 2023 to May 2025, with about $186 million in losses. Victims are told a code word, password, or serial number so the courier seems legitimate, and drivers sometimes take victims to the bank to withdraw money. Some drivers are not always aware they are part of a crime [21]. For an investigator, this means a courier can do a mule's work without ever providing a bank account.

Students and cartel cash

Chinese money laundering networks need many accounts to place cash, and FinCEN's 2025 advisory sets out how they get them. Account holders list occupations such as "student" or "housewife," make structured cash deposits, buy cashier's checks, and sometimes use counterfeit passports [36]. The Institute for Financial Integrity documents students recruited through cultural obligation and through gambling debts that West Midlands Police traced to illegal casinos [4]. In October 2026 Shu Jun Zhen was sentenced to nine years and ordered to forfeit about $23 million for working as a courier for a Chinese money laundering organization that laundered more than $92 million, using real and fake identities and shell-company accounts [37]. Mexican cartels are clients of these networks: in May 2026 two men were indicted in Virginia for laundering money for the Sinaloa Cartel and the Jalisco New Generation Cartel (CJNG) [38]. The wider system is covered in the site's shadow banking section.

Crypto mules

On the crypto rail, mules provide the link to regular money. Chinese-language "running point" brokers (跑分) rent out bank accounts, wallets, and exchange deposit addresses, and "motorcades" (车队) of mules move funds through many accounts [16]. Mule methods include in-person dealer meetings, ATM cash converted to crypto, third-party payment platforms, and card and gift-card schemes [39]. The FBI warns that mules are sometimes told to deposit cash into crypto kiosks [1], and FinCEN has flagged kiosk transactions structured below reporting thresholds or spread across several machines [40].

Synthetic identities and deepfakes

Generative AI makes fake identities cheap. FinCEN describes criminals altering or generating identity images, using webcam plugins to defeat live checks, and using the resulting accounts as funnel accounts [11]. The Financial Action Task Force (FATF), the global anti-money-laundering standard-setter, lists AI-enabled deepfakes among the methods behind cyber-enabled fraud [41]. Mitek and Datos Insights project U.S. synthetic identity losses above $3.1 billion in 2026, up from $1.8 billion in 2020 [42].

Insiders

Some networks buy help inside the bank. TD Bank admitted that three laundering networks moved more than $670 million through its accounts, and at least one scheme involved five bank employees [43]; see the TD Bank entry in the timeline. Telegram vendors also advertise "inny" insiders at banks and telecom companies [14].

Inside a mule account's life

The FCA's September 2026 review of 35 firms gives the most detailed public picture of how mule accounts behave [3]:

• Lifespans vary by provider. 47.1 percent of offboarded mule accounts were closed within a year of opening. At e-money institutions, 74.1 percent closed within six months. At retail banks and building societies, 45.4 percent had been open for more than two years [3].
• Chains, not single hops. In a 140-case intelligence exercise, cash-out was concentrated between the second and fifth mule account, most often at the second [3].
• Card spending is the main exit. Card payments were the most common cash-out route. International transfers went to recurring destinations in South Asia, West Africa, and the Middle East, and international and crypto cash-outs were higher in value [3].
• Reuse. The same accounts appeared across several fraud types, which the FCA reads as established infrastructure rather than one-off misuse [3].

The money moves fast. Using Lloyds Bank data, researchers at the Royal United Services Institute (RUSI) found that nearly 28 percent of the money entering mule accounts in their sample left within 15 minutes, and a further 25 percent within an hour. They caution that one bank's data gives only a partial picture [44]. BioCatch documented a coordinated cash-out that ran for 40 days at one U.S. credit union [18].

The organizations behind the accounts

The Prince Group case appears in the site's timeline. The DOJ's Scam Center Strike Force has charged two Chinese nationals over a scam compound in Burma and seized a Telegram channel used to recruit trafficking victims to a compound in Cambodia [51].

Group names need care. INTERPOL's Jackal operations targeted West African groups including Black Axe, but the results cover many networks, and not every West African fraud is Black Axe [47][15]. The next round, Jackal IV in 2026, reported 58 arrests and 263 suspects identified; those are operational counts, not convictions [15]. Countries named in an operation can be the location of victims, banks, suspects, assets, or cooperating authorities.

Where the trail crosses borders

The law: knowledge decides

United States

The site's laws page covers the 1986 statute behind sections 1956 and 1957, and the wire fraud entry covers the general federal fraud charge. Enforcement explains how these charges are used against individuals.

Section 1957's $10,000 figure is an element of that offense, not a safe amount: other charges reach smaller sums [56][7]. Section 1960 has several routes, from state licensing to federal registration, and an occasional intermediary is not automatically a money transmitting business [59].

Knowledge, willful blindness, and warnings

Laundering requires knowledge that the money came from crime. A defense firm's analysis of the Auyeung case says the government proves knowledge through circumstances: account patterns, commission structures, and how the person responded to red flags [62]. At his sentencing, the judge said Auyeung "had every reason to know there was something wrong here" [10]. Courts allow a willful-blindness instruction where a defendant deliberately avoided the truth, and the Fourth Circuit has held that failures to act or investigate can count as deliberate avoidance [63].

In practice, the FBI's three types [1] map onto this test: unwitting mules usually lack the required knowledge, witting mules are the contested middle, and complicit mules are ordinary defendants. In December 2020, DOJ announced action against about 2,300 mules in a global crackdown: about 2,000 received warning letters and more than 35 were charged or arrested [64]. Europol announced a parallel European Money Mule Action the same day [64], and an earlier Europol-coordinated action identified more than 3,800 mules and led to 228 arrests [65]. Its Miami office describes the same spectrum of prosecutions and warning letters [31], and a defense firm describes prosecutors sorting intermediaries between warning letters and indictments [62]. A warning letter is not a conviction, but the FBI notes that witting mules may have been warned by bank staff and kept going [1].

Continuing after notice is costly. In the Auyeung case, the defendant took about $400,000 more in commissions after his indictment. He is forfeiting about $2.3 million and agreed not to contest the civil forfeiture of about $7.1 million seized from crypto wallets [10].

England and Wales, Singapore, and Australia

In England and Wales the Proceeds of Crime Act 2002 creates three principal laundering offenses: concealing or transferring criminal property (section 327), entering into an arrangement (section 328), and acquiring or possessing it (section 329). Property counts as criminal when the defendant knows or suspects it is a benefit from crime [8]. The Modern Slavery Act's section 45 defense may apply to people compelled to offend, with different tests for adults and children and some offenses excluded [66].

Singapore went further on mental state. From February 8, 2024, it became an offense to launder money rashly, going ahead despite suspicion without asking further questions, or negligently, ignoring red flags any reasonable person would notice. Disclosing one's own Singpass credentials (Singpass is Singapore's national digital identity login), or obtaining or supplying someone else's, to facilitate an offense also became a crime [54]. In Australia, money laundering carries a maximum penalty of life imprisonment [9].

Who pays the victim

Reimbursement decides who has a financial reason to find mule accounts [67].

• United Kingdom. Since October 7, 2024, sending and receiving payment firms must reimburse most victims of authorized push payment (APP) fraud, up to £85,000, and receiving firms have a financial incentive to stop fraud for the first time [67]. In the first nine months, 88 percent of the money lost to APP scams and claimed back from a payment firm was returned, up from 66 percent, totaling £112 million [52]. The government also moved to let payment firms delay suspicious outbound payments by up to four business days [45].
• United States. Under Regulation E, the U.S. rule on electronic fund transfers, a transfer made by a fraudster using credentials obtained by deception can count as unauthorized, which differs from a consumer personally sending money to a scammer [68]. Scams the customer authorized are the contested ground. The Consumer Financial Protection Bureau sued three large banks over Zelle scams in December 2024 and dropped the case in March 2025. New York's attorney general sued Zelle's operator, Early Warning Services, in August 2025, alleging more than $1 billion in losses from 2017 to 2023 and that the company failed to require banks to reimburse consumers for certain scams [69]. See the site's ACH and instant payments section for how these rails work.

Seeing mules from inside the bank

A sending bank may see the deception at the moment of payment. A receiving bank sees what happens next: unrelated payers, a sudden change in behavior, money leaving almost as soon as it arrives. The FCA expects firms to use proportionate controls at onboarding, in monitoring, in intelligence sharing, and in governance and training [70].

In practice, every one of these signals can have innocent explanations. Marketplace sales, family support, household devices, and commission-based work can all look like mule activity. The flags tell an analyst where to look, not what happened.

Networks, models, and sharing

Mules share devices, addresses, documents, and counterparties, and the FCA recommends timely intelligence sharing to identify linked accounts, including under the Economic Crime and Corporate Transparency Act 2023 [3]. In the U.S., section 314(b) of the USA PATRIOT Act gives financial institutions a safe harbor to share information about suspected money laundering, and FinCEN's June 2026 guidance clarifies that this covers fraud [46]. Participants must register and take reasonable steps to verify that the other institution is also registered [71]. The site's PATRIOT Act entry covers the statute, and Bank Secrecy Act the reporting system behind SARs.

Two FinCEN documents shape how banks talk to police and customers. Banks must hand over SAR supporting documentation to FinCEN and appropriate law enforcement on request without legal process, after verifying who is asking [72]. A September 2026 joint statement from FinCEN and the banking agencies says SAR confidentiality does not stop banks from talking with customers about potentially fraudulent transactions or account closures [73]. When filing, FinCEN asks banks to use key terms such as "CMLN-2025-A003" for Chinese money laundering network activity [36].

Machine learning is spreading. India's central bank built MuleHunter.AI, a mule-detection tool now live at 26 banks [55]. In our assessment, a deployment announcement says nothing about accuracy, and models trained on past account closures risk learning past decisions, mistakes included. BioCatch's figures come from behavioral data, and it reports mule activity rising at U.S. mid-market institutions even as overall fraud sessions decline [18].

Building a case that reaches the organizer

In practice, a mule case has four things to prove, and each needs its own evidence. First, the underlying crime and the original loss. Second, what money entered and left each account. Third, who controlled the account or approved the payment. Fourth, the state of mind the charge requires [7][8]. A bank statement proves a payment arrived; it does not prove the holder knew where it came from. A shared device links accounts, but someone still has to show who used it.

In practice, the trail is rarely a straight line. One account can receive from several victims, keep a fee, pay several intermediaries, and also hold a real salary. Adding up every hop overstates the loss. Cash breaks the paper trail, and crypto shifts it to an exchange's records and a public ledger, which the site's crypto rails article covers in depth.

Street language

Recruiters sell muling as easy money with no victims [5][9]. Their vocabulary helps in reading seized messages, but none of these words is an admission on its own.

Interviews

In practice, unwitting mules often hold the evidence that leads upward: the recruiter's messages, payment instructions, and onward account details. The Home Office study found that professionals described a fragmented support system, with banks and police responding to mules inconsistently [5]. For an investigator, this suggests an interview should establish how the arrangement started, who supplied the payment destinations, who held the phone, card, and passwords, and what happened when the person tried to stop. Where coercion is plausible, the person should be spoken to away from the suspected controller (especially if in-person, like in a bank branch).

Intervening without losing the network

Closing an account stops the next payment, not the recruiter, who can live on to supply another account. The FCA found accounts reused across fraud types [3], and in practice, when one route closes, activity can move to another provider, an associate's account, or a different payment channel.

Closure also has costs for the account holder. The Home Office study found that account closures and fraud markers left former mules struggling with employment and housing, while 30 percent of mules reported no consequences at all [5]. It found that concrete consequences, such as losing a phone contract, a student loan, or a mortgage, landed harder than abstract threats of prosecution, and it pointed to Jobs Aware for checking job offers [5]. For the U.S., FinCEN directs elder victims to the DOJ Elder Fraud Hotline and the FBI's Internet Crime Complaint Center (IC3) [23].

The FBI warns that mules may be held personally liable for repaying money lost by victims [1]. In our assessment, prevention works best when it offers a practical way out: stop moving money, contact the bank through a verified channel, keep the messages, and get help if threatened.

What the research can and cannot show

Each source looks through a different window. A bank sees its own accounts. A police file sees the people who were caught. A survey sees what respondents chose to say. None of them describes the whole mule population.

Open debates

A working method

1. Identify the account. Start from a victim report, a fraud alert, or a SAR and establish whether the holder is a mule, a takeover victim, or a synthetic identity [6][11].
2. Classify the mule. Use the unwitting, witting, and complicit types to decide between support, warning, and investigation [1].
3. Map the network. Link shared devices, addresses, documents, and counterparties, and follow funds past the first account; in the FCA's cases, cash-out came at the second to fifth account [3].
4. Find the funnel. Look for accounts that collect from many mules, usually run by complicit mules or recruiters [1].
5. Move fast. More than half of incoming money in RUSI's sample was gone within an hour [44].
6. Interview where safe. Recruitment often runs through email and messaging apps, so an unwitting mule's phone may hold the recruiter's messages [5].
7. Warn and document. A recorded warning matters later if the customer continues [1][31].
8. Share and file. Use 314(b) where eligible, report to shared fraud databases, and use FinCEN key terms in SARs [71][24][36].
9. Support victims. Refer older victims to the DOJ Elder Fraud Hotline and IC3 [23].

What to watch through 2027

• AI-made identities. Synthetic identity losses are projected to keep rising [42], and FinCEN's deepfake red flags will matter more at onboarding [11][41].
• U.S. liability. The New York case against Early Warning Services will shape whether U.S. banks carry more scam losses [69].
• Student targeting. Debt bondage and cultural pressure on students recruited by laundering networks [4][36].
• Marketplaces under pressure. Whether OFAC's designation of Xinbi Guarantee and the Scam Center Strike Force's seizures change how scam operators find laundering vendors [49][51]. The site's sanctions and transnational organized crime entries explain the tools.
• Pending cases. Boling's sentencing on January 14, 2027 [35] and Mintah's on March 16, 2027 [33].
• Information sharing. How far FinCEN's 314(b) fraud guidance and the UK's data-sharing powers widen what banks can see beyond their own accounts [46][3].