What is a mule account?¶

A mule account is a bank, payment, wallet or other financial account used to receive and move funds on behalf of offenders or a fraudulent scheme.

Avoid the dangerous assumption¶

The dangerous assumption is that the account type itself proves the named holder is a willing money mule.

An account may be deliberately opened for criminal use, recruited after opening, sold, rented, shared, compromised or controlled through stolen credentials.

The account holder may be knowing, suspicious, deceived, coerced or entirely unaware.

A mule account often shows incoming payments followed by rapid transfers, cash withdrawals, purchases of digital assets or movement through several services.

Those patterns are useful indicators, but they are not conclusive by themselves.

Relevant evidence may include account-opening information, authorised users, devices, login history, IP addresses, beneficiaries, payment references, communications and retained balances.

Look for changes shortly before the activity, such as new devices, new contact details, password resets or added beneficiaries.

Compare the disputed transactions with the account’s normal use.

Do not assume that every payment into a suspected mule account forms part of the same fraud.

The account may contain legitimate wages, benefits, business income or family transfers alongside criminal proceeds.

Map each transaction separately and identify its source, destination and status.

Where the account was compromised, the holder may also be a victim.

When reporting, distinguish the account’s use as a movement point from the holder’s knowledge and practical control.

Operational takeaway¶

Identify how the account was recruited, accessed and used, and prove the holder’s knowledge and control separately from the suspicious movement of funds.