What evidence may show control of a mule account?¶

Control is shown by converging evidence of who could access, direct, authorise and benefit from the account - not solely its registered name or one login.

Technical and decision-making control may differ¶

Provider records can show endpoints, sessions, IP-related data, authentication, contact changes, beneficiary creation and approvals. An endpoint may contain the application, credentials, notifications, messages or screenshots. Cash use, card possession and CCTV can connect physical acts.

A remote controller may instruct the holder to complete actions personally, so technical access and decision-making can sit with different people.

Build a period-specific attribution¶

Identify who opened the account, received codes and provider contacts, and controlled changes before and during the disputed activity. Communications may evidence recruitment, rental, transfer instructions, commission or warnings.

Shared homes, businesses, endpoints and networks can create innocent overlap. Combine provider, device, communication, withdrawal, repetition and retained-benefit evidence and distinguish ownership, access, instruction, authorisation and benefit.