FraudCodex FraudCodex
Sign in
Anti-Money Laundering Traditional Finance

Money Mules

Recruiting individuals to receive and transfer illicit funds through their own accounts to obscure the money trail.

1 Introduction

A money mule is a person recruited to receive illicit funds into their personal bank account and forward them on, usually keeping a small commission. Criminals find recruits through fake job ads, romance scams, and social media offers of easy money. By passing proceeds through a chain of ordinary-looking personal accounts, launderers add distance between the original crime and the final destination, breaking the audit trail during the layering stage of money laundering. Europol's annual European Money Mule Action (EMMA), run with law enforcement and the banking sector, leads to thousands of arrests each year.

Thousands

Mule arrests per year via Europol EMMA

Often young

Many recruits are under 35, lured by quick cash

Many hops

Layered transfers obscure the source of funds

2 Interactive Money Mule Network

Phase: Illicit Source

Fund Flow Network

Layering Metrics

Step 1 - Illicit Source: A single large sum of criminal proceeds sits in a controller's account. At this point the money is concentrated and easy to trace back to the predicate crime.

3 Detailed Analysis

Witting vs. Unwitting Mules

Witting Mules

People who knowingly rent out or sell access to their bank accounts for a commission. They understand the funds are illicit and may recruit others, making them complicit participants in the laundering chain.

Unwitting Mules

Victims deceived by fake jobs, romance scams, or work-from-home offers who believe they are processing legitimate payments. They are often prosecuted or have accounts frozen despite not realising the funds were criminal.

Detection Methodology

Banks and financial intelligence units detect mule activity by profiling account behaviour rather than single transactions. Models flag newly opened accounts that suddenly receive and forward funds, rapid pass-through where money leaves almost as fast as it arrives, transfers structured just below reporting thresholds, and shared device, IP, or contact details across seemingly unrelated accounts. Network analytics link clusters of accounts that move funds in coordinated fan-out and re-aggregation patterns, and collaborative efforts such as Europol's EMMA combine bank reporting with law enforcement to dismantle recruitment rings.

Red Flags

  • Funds that arrive and are forwarded within hours, leaving little or no balance behind
  • A new or dormant personal account suddenly handling high transfer volumes
  • Many incoming payments structured just below cash or reporting thresholds
  • Shared logins, devices, or beneficiary details linking otherwise unrelated accounts

Related Fraud Types

Structuring (Smurfing)

Breaking large transactions into smaller amounts to avoid regulatory reporting thresholds.

Round-Tripping

Moving funds out and back through related entities to create the appearance of legitimate revenue or activity.

Shell Companies

Using corporate entities with no real operations to obscure the ownership and movement of illicit funds.