Table of contents
A money mule is a person who receives money from a third party into their own account and transfers it onward, in return for a fee or because they have been deceived, so that criminals can move the proceeds of fraud or other crime without the funds being traced to them. Mules may be complicit, careless or genuine victims of a job or romance scam.
Mule accounts are the plumbing of authorised push payment fraud, romance scams, business email compromise and online marketplace fraud: the victim pays a legitimate-looking account, and the money is gone within hours through a chain of further mules. For a regulated firm, a mule account is both a fraud problem and a money-laundering problem, and it is caught after onboarding by transaction monitoring rather than at onboarding by identity checks, because the mule is a real person with a real identity.
Types of money mule
- Complicit mules knowingly rent out their account or open accounts for a fee, often recruited through social media with promises of easy money.
- Witting mules suspect the arrangement is wrong but continue because they are paid or threatened.
- Unwitting mules believe they have a genuine job (payment agent, mystery shopper, work-from-home finance role) or a genuine relationship, and are told the transfers are legitimate.
- Account herders are the recruiters who manage networks of mules, sometimes hundreds of accounts, for an organised group.
Red flags for a money mule account
- Incoming payments from many unrelated senders, followed by rapid onward transfers or cash withdrawals that leave a near-zero balance.
- Activity out of line with the account holder’s profile: a student or new customer receiving business-sized payments.
- Several accounts at the same institution sharing a device, address or counterparty.
- Newly opened accounts that go dormant and then receive a burst of funds.
- Transfers to crypto exchanges or money remitters shortly after receipt.
Consequences for the mule
Acting as a money mule is money laundering, and unwitting mules are still investigated. Consequences include closed accounts, entries on fraud databases such as Cifas in the United Kingdom that make it hard to open accounts for years, and prosecution. Europol’s annual European Money Mule Action coordinates arrests across the EU each year, and firms are expected to report suspected mule accounts, not just close them.
How Zyphe detects mule activity
Mule networks show up in the field most rule builders do not expose: counterparties shared across supposedly unrelated identities. Zyphe’s transaction monitoring reads that field alongside velocity sums and counts over 1 hour to 30 days and 24-hour net flow, evaluates every payment before funds move, and hands the resulting alerts to the transaction monitoring alert triage desk with the fired rules attached. At onboarding, biometric uniqueness across a flow catches the same face opening several accounts under different identities, which is how account herders build their networks.
Written by Michelangelo Frigo (Co-Founder at Zyphe) Reviewed September 18, 2026 Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.