What evidence may show control of a mule account?¶

Control of a suspected mule account is shown by evidence of who could access, direct and benefit from its use.

Avoid the dangerous assumption¶

The dangerous assumption is that the named account holder either controlled everything or had no involvement because another device appears in the records.

Relevant provider evidence may include registered devices, login history, IP addresses, sessions, authentication events, contact-detail changes, beneficiary creation and transaction approvals.

Device examination may show banking applications, saved credentials, payment notifications, messages, screenshots and active sessions.

Communications can reveal recruitment, instructions, account rental, transfer requests, commission and warnings.

Cash withdrawals, card possession and CCTV may connect a person to physical use.

Look at who opened the account, supplied identity information, received security codes and responded to provider contacts.

A controller may use remote-access software or direct the holder to complete actions personally.

That distinction matters because technical access and decision-making control may sit with different people.

Shared households, business networks and common devices can create innocent overlap.

Do not rely on one IP address or device identifier alone.

Compare all evidence across the relevant period and identify changes before, during and after the suspicious activity.

Retained funds, repeated participation and attempts to conceal access may support knowing control.

When reporting, distinguish legal ownership, technical access, instruction, authorisation and benefit.

Operational takeaway¶

Establish mule-account control through converging provider, device, communication, withdrawal and benefit evidence rather than relying on the account-holder name or a single login record.