FinCrime Intelligence
Money mule accounts are not a peripheral feature of fraud. They are the financial infrastructure that allows a scam, account takeover, business email compromise campaign, investment fraud or cyber-enabled theft to convert victim payments into criminal proceeds that can be moved, fragmented and extracted. Without access to receiving accounts, even sophisticated fraud operations struggle to monetise at scale.
Account leasing makes that infrastructure easier to acquire. The term is not a single legal classification; it describes arrangements in which a genuine customer permits another party to use an account, temporarily or permanently, in exchange for payment, coercion, deception or another inducement. Access may be limited to receiving a transfer and sending it onward, or may involve surrendering online-banking credentials, cards, security tokens and one-time-password access. FATF research confirms that mule operators may obtain direct control through credentials, cards, tokens or powers of attorney, while some accounts are made available only for a short operational window—long enough to process illicit funds, but short enough to complicate detection.
Listen the podcast
Watch the video
Why mule accounts matter now
The strategic importance of mule accounts has increased because fraud and payments have become faster, more digital and more geographically dispersed. A victim can be manipulated in one country, instructed to pay an account in another, and see the funds dispersed across several institutions or converted into cash, e-money or virtual assets within minutes. FATF, INTERPOL and the Egmont Group describe cyber-enabled fraud proceeds as moving rapidly through pass-through accounts across providers and jurisdictions, creating delays in tracing, freezing and recovery.
For financial institutions, the core problem is that many mule accounts do not look criminal at the point of entry. The customer may have passed genuine identity checks, supplied authentic documents and opened the account through a standard digital journey. The risk emerges later, when control is transferred, the account is repurposed or the customer begins facilitating transactions for a criminal network. Europol notes that accounts may be opened through impersonation or identity theft, but also documents intensive recruitment of students, migrants and financially vulnerable people through social media. The population therefore includes deliberate facilitators, deceived participants and exploited individuals—not one homogeneous offender type.
The scale is visible in regulatory and industry data. The UK FCA reported that 25 firms offboarded 194,084 money mules between January 2022 and September 2023, but only 37% were reported to the National Fraud Database. Cifas subsequently recorded more than 106,000 misuse-of-facility cases in 2025 and a further 22,000 cases under a newly introduced money-mule filing category. These figures are UK-specific and affected by reporting practices, but they illustrate both the volume of account misuse and the intelligence gaps created when confirmed cases are not shared consistently.
How criminal actors industrialise account leasing
At the retail end, recruitment is presented as easy work, a payment-processing role, a business opportunity or a favour for someone trusted. Europol and INTERPOL describe recruitment through job advertisements, spam, social media, romance fraud and promises of commission. In more coercive situations, trafficking victims, migrants or people in severe financial distress may be instructed to open accounts or hand over access. A person can therefore move from scam victim to financial intermediary without fully understanding that the incoming funds belong to other victims.
At the organised end, mule herders or specialist service providers recruit account holders, test whether accounts remain operational, coordinate access and replace accounts that are blocked. INTERPOL has warned about herders obtaining broad authorisation to use victims’ personal accounts, while Europol’s 2026 organised-crime assessment describes networks specialising in money-laundering-as-a-service and recruiting mules to transfer or withdraw proceeds for commission. This separates the predicate offender from the regulated account and turns account access into a purchasable criminal service.
Fresh personal accounts are valuable because they begin with little adverse history. Business accounts can be even more useful where the fraud pretext requires a commercial beneficiary, particularly in business email compromise, fake investment or merchant-related schemes. FATF observed that syndicates have shifted towards corporate first-layer accounts in some BEC and trading-platform cases to preserve a façade of legitimacy. The account name, product type and payment narrative can be matched to the scam, making the beneficiary appear plausible.
Once activated, the account is rarely the final destination. Criminals may send low-value test payments, then route larger proceeds through chains of personal and corporate accounts. Funds can be split, recombined, withdrawn at ATMs, moved through remittance firms, exchanged into virtual assets or transferred internationally. Each additional account creates distance between the victim, the fraud organiser and the eventual cash-out point.
Account leasing also overlaps with collusive account takeover. The customer may approve a new device, disclose an OTP, reset credentials or falsely claim that access was unauthorised after funds have moved. In other cases, the customer retains control but follows instructions transaction by transaction. Institutions therefore need to reconstruct control, intent and benefit across the full account lifecycle.
Why mule infrastructure scales so efficiently
The first reason is supply. Recruitment can be broadcast through social platforms, encrypted messaging, gaming communities, fake job sites and personal networks. Recruiters target young people, students, migrants and individuals under financial pressure with language that minimises perceived wrongdoing: “rent your account”, “receive a business payment” or “keep a percentage”.
The second reason is replacement economics. Mule accounts are expendable. Criminal groups do not need every account to survive for months; they need enough accounts to remain functional long enough to receive and disperse funds. FATF notes that some accounts are used only for a limited period and that legitimate onboarding combined with short usage windows makes abnormal activity harder to detect. When one route is blocked, the next victim payment can be redirected.
The third reason is the cold-start problem. Behavioural models become stronger after observing normal activity, but new accounts have little history. The FCA has warned that machine-learning models may require time to establish a baseline and should be combined with tactical rules and other signals. A fresh account can therefore move from apparently low-risk onboarding to high-velocity pass-through activity before the institution has learned what “normal” means.
The fourth reason is institutional fragmentation. The sending bank sees the victim; the receiving bank sees the beneficiary; downstream firms see later generations of movement; law enforcement may receive reports after the funds are gone. Where notifications are slow, thresholds differ or firms focus only on first-generation recipients, the network benefits. The FCA found that some firms were less responsive to alerts involving later generations, despite clear risk factors.
What a resilient control stack looks like
The first layer is risk-sensitive onboarding. Institutions should capture enough information to assess whether early activity is consistent with the account’s stated purpose, income, occupation or business turnover. Device profiling, geolocation, behavioural biometrics, address analysis and fraud-marker checks can strengthen the decision, but no single indicator should determine the outcome. Multiple customers using one device or address may be legitimate; the control value comes from resolving whether the relationship is plausible.
The second layer is early-life monitoring. New, recently reactivated or materially changed accounts should receive intensified monitoring based on risk. Relevant patterns include unexpected credits from unrelated parties, deposits exceeding stated income or turnover, immediate dispersal, near-total balance depletion, rapid beneficiary creation, ATM cash-out and movement to higher-risk jurisdictions or virtual-asset channels. Inbound monitoring is essential: the FCA found that firms focused heavily on outbound transactions could identify mule activity only after funds had arrived and departed.
The third layer is control-of-account analysis. Firms should connect authentication, device and transaction events. A telephone-number change, new-device registration, password reset, alert suppression and sudden pass-through activity is more significant as a sequence than as isolated events. Device-sharing across unrelated customers, repeated access from common infrastructure and inconsistent geography can reveal a mule herder controlling multiple accounts.
The fourth layer is network analytics. A mule account should be treated as a node in a wider system, not as a closed case. Graph analysis can trace later-generation beneficiaries, identify shared devices and contact points, expose fan-out payment patterns and prioritise accounts at important junctions. The FCA found value in visualising fund movement across Faster Payments, while FATF case studies show how clustering and cross-account registries can uncover networks that individual alerts miss.
The fifth layer is rapid, proportionate response. Institutions need playbooks for restricting activity, preserving evidence, contacting customers safely, notifying counterparties, considering suspicious activity reporting and initiating recovery. Speed matters because proceeds dissipate quickly. Proportionality matters because the same pattern may involve a knowing facilitator, a coerced person or a victim manipulated through romance or employment fraud. Safeguarding and evidential standards should sit alongside disruption.
How institutions can turn mule activity into defensive intelligence
Every confirmed mule case should improve the control environment. Investigators can extract devices, IP addresses, phone numbers, email domains, introducers, beneficiaries, cash-out locations and linked identities, then feed those indicators into onboarding, authentication and transaction monitoring. The objective is not only to close one account but to identify the recruiter, controller and downstream network.
Cross-institution intelligence is critical because no firm sees the complete flow. The FCA found that detection tools become more effective when alerts are corroborated with additional information, and that delayed responses between firms can prevent cases from meeting reporting standards. FATF similarly emphasises public-private partnerships, rapid information exchange and coordinated freezing mechanisms as ways to reveal hidden laundering networks and improve recovery.
Institutions should also measure effectiveness beyond account closures. Useful outcomes include time from first fraudulent credit to intervention, value frozen or returned, linked accounts identified, cases shared through lawful channels, recurrence after warning, and detection at later payment generations. These measures expose whether the programme is disrupting infrastructure or merely processing alerts after loss.
What this means for financial crime leaders
The right way to think about money mules is as an enterprise financial-crime risk connecting fraud, AML, digital identity, payments, cyber intelligence, customer vulnerability and operational response. Account leasing is especially important because it exploits a legitimate banking relationship and can make criminal control resemble ordinary customer behaviour.
Strong KYC at account opening is necessary but insufficient. The decisive capability is lifecycle intelligence: understanding who controls the account, whether activity matches its declared purpose, how it connects to other entities and how quickly the institution can act when fraud proceeds arrive.
Mule networks are designed to absorb disruption. Closing one account does little if the recruiter, shared infrastructure and downstream routes remain active. Institutions that combine early-life monitoring, inbound and outbound analytics, device and behavioural intelligence, graph investigation, lawful data sharing and proportionate safeguarding will be better positioned to attack the operating model rather than its most disposable component.
Money mule accounts are the bridge between deception and monetisation. Disrupting that bridge is one of the most direct ways financial institutions can reduce fraud profitability, improve recovery and prevent regulated payment systems from becoming the hidden logistics network of organised financial crime.
Money mule accounts and account-leasing arrangements are not merely secondary by-products of fraud; they are essential components of the infrastructure that allows criminal proceeds to enter, move through and exit the financial system. By exploiting legitimate accounts, genuine identities and increasingly digital recruitment channels, criminal networks can create a layer of apparent legitimacy between the victim and the ultimate beneficiary.
The challenge for financial institutions is therefore broader than identifying suspicious transactions. Effective disruption requires an understanding of account control, customer behaviour, device intelligence, payment networks and the wider relationships connecting recruiters, mule herders, beneficiaries and cash-out channels. Static rules and account-by-account investigations are unlikely to be sufficient against networks designed to replace compromised accounts rapidly and adapt to enforcement pressure.
A more resilient response depends on continuous monitoring, stronger early-life controls, inbound and outbound transaction analysis, network analytics and timely intelligence sharing. It must also recognise the difference between knowing facilitators, coerced individuals and customers manipulated through employment, romance or investment scams.
Ultimately, the most effective strategy is not simply to close mule accounts after losses occur. It is to identify and dismantle the operating model that supplies, controls and replaces them. Financial institutions that treat mule activity as a connected enterprise risk will be better positioned to reduce fraud profitability, recover funds more quickly and prevent the financial system from serving as the hidden distribution network of organised crime.