Money mule red flags: how to spot mule accounts

Money mule red flags show up in two places: in how money moves through an account, and in who the account holder turns out to be. In the account, look for money that passes straight through, payments from several unrelated people, and quick cash withdrawals, cryptocurrency purchases or onward transfers that the customer's history would not predict. In the holder, look for an identity with no past, a remote job moving payments for a company that cannot be found, a recruiter who leads back to a copied website or a free email address, and the same employer or contact details on other new accounts.

This piece covers the types of mule, how people are recruited, the account patterns investigators describe and the research a reviewer can run on the holder, with a worked example. Many mules are victims of the people who recruited them, and that shapes how a fair review ends. Our guides to detecting synthetic identity fraud and linking related accounts go deeper on two of the checks.

The FBI defines a money mule as "someone who transfers or moves illegally acquired money on behalf of someone else." Mules put distance between victims and criminals, which the FBI says "makes it harder for law enforcement to accurately trace money trails." The money is often somebody else's loss: the US Department of Justice names victims of romance, lottery, government imposter and technical support scams, and Europol reports that more than 90 percent of the mule transactions identified through its European Money Mule Actions are linked to cybercrime.

The numbers are large and still being counted. Cifas, the UK's not-for-profit fraud prevention service, added a filing category for money muling in 2025, and its members reported more than 22,000 incidents to the National Fraud Database that year, 89 percent of them involving personal bank accounts. In the first half of 2026 they filed nearly 13,000, up 70 percent on a year earlier, a rise Cifas says is likely to reflect wider use of the new category alongside better detection. UK Finance, which represents more than 300 banking and finance firms, reports that data collected by its Intelligence Unit showed 12,438 money mules disrupted in 2025. In the US, one laundering organisation recruited more than 15,000 US-based mules to launder at least $10 million stolen from over 750 bank accounts, the Justice Department said when one of its leaders pleaded guilty in October 2026.

The FBI sorts mules by what they know.

• Unwitting or unknowing mules "are unaware they are part of a larger scheme." They are often approached through an online romance or a job offer, and asked to use their own bank account to receive money from someone they have never met in person.
• Witting mules "ignore obvious red flags or act willfully blind to their money movement activity." Some may have been warned by bank staff, and some "may have been unwitting at first but continue communication and participation."
• Complicit mules "are aware of their role and actively participate." The FBI says they serially open bank accounts, advertise their services, run funnel accounts that collect money from lower level mules, and recruit others.

Some mule accounts are opened in a name that is not the user's own. Europol reported in 2023 that organised mules travel to open accounts, "often using fake documentation", and Cifas says its intelligence indicates some people sell their personal information to criminal networks, which use it to open accounts.

People move between the types. A Pennsylvania man who pleaded guilty in July 2026 had first fallen victim to a romance fraud, the Justice Department says, and then "knowingly served as a money mule for the same group of fraudsters that initially victimized him." He carried on after FBI agents told him the money passing through his accounts had been stolen from other people.

Warnings far outnumber charges. In the Money Mule Initiative whose results the Justice Department announced in May 2024, US agencies took action against more than 3,000 mules: about 2,970 received letters warning them that their actions were facilitating fraud, and more than 20 were criminally charged.

Job offers are one of the main routes. Europol describes "seemingly legitimate job offers" for roles such as money transfer agents, and the Justice Department says such positions "often have ill-defined responsibilities and involve little more than sending or receiving money or packages or opening accounts." In the laundering case behind the October 2026 guilty plea, the organisation deceived its mules into believing they worked for legitimate companies, and told them the job was to "receive payments from businesses into their personal bank accounts, withdraw the money, and then wire the funds to the fake company's partners overseas." The mules were never paid.

Much of the recruiting happens on social media and messaging apps. Europol lists closed Facebook groups, Instagram, Snapchat and direct messages on apps such as WhatsApp and Telegram. Cifas calls social media "a key channel for luring new mules and advertising 'quick money' schemes".

Online romances and friendships are the other main route. The Secret Service's red flags include a partner met online who "claims to be unable to open a bank account and asks to use your account to transfer money."

Young people are a frequent target. Europol says the most likely targets are people under 35, and that criminal groups have begun recruiting people aged 12 to 21. In Cifas's 2025 data, 18 percent of money muling cases involved people under 21 and 39 percent people aged 21 to 30. Europol also names newcomers to a country, unemployed people and people in economic hardship, and the FBI's caution covers everyone: "anyone can be approached to be a money mule."

Law enforcement sources describe much the same signs.

• Money that passes through. Europol describes a mule as someone who receives money from a third party into their bank account and "transfers it to another one or takes it out in cash".
• Many unrelated senders. The Justice Department says money mules "are sent money by people they don't know and then, at the direction of someone else, provide the funds to other people."
• Quick conversion. The Secret Service's signs include being asked to receive wires, withdraw cash and buy cryptocurrency. In the Pennsylvania case, the mules made "a series of rapid financial transactions" to turn victims' deposits into cryptocurrency and move it to foreign accounts.
• A cut left behind. The FBI says unwitting mules may be told to keep a portion of the money they move.
• A change in behaviour. An account that carried a part-time wage for months and then receives five-figure sums from strangers has changed, whatever the size of each payment.
• More accounts, and paperwork. The FBI says witting mules open accounts with several banks, and the Pennsylvania defendant sent "fraudulent invoices to make the transactions appear legitimate."

A pattern like this shows that money is moving through the account on someone else's behalf. It cannot show whether the holder knows, or whose identity the account was opened in. A mule account is ordinary until you look at how the money moves through it and who the holder turns out to be. The transactions answer the first half, and research on the person answers the rest.

A real person has a past that other people wrote over years: school and employer pages, club and alumni listings, local news, professional profiles, and social accounts where friends reply. A synthetic or borrowed identity often has the documents and little of that history.

Then check that the contact details belong to the same person. A phone number or email address on the person's own older pages supports the link. One that appears nowhere else, or under a different name, is a reason to look again, because stolen details arrive with a real person's footprint attached.

The answer sorts the case. A real person with a real past, using their own contact details, fits one of the FBI's three types, and the question becomes what they knew. No past, or a past that belongs to someone else, points to an account opened with a synthetic or stolen identity, where the person whose details were used may be a victim too.

Many unwitting mules can explain why money is moving through their account, because they believe it is their job. Ask, and then check the story.

• The company. Look it up in the registry where it says it is registered. Companies House gives some details of companies on its register for free, including the registered address, date of incorporation and officers, and the National Association of Secretaries of State links to each US state's business registration pages. A registry record shows that a company was filed, and leaves open whether it trades or hired anyone.
• The website. ICANN's Lookup tool shows a generic domain's public registration record, including the date it was created. A firm that claims years of trading and a site a few weeks old do not fit together. Europol warns that mule adverts "can copy a genuine company's website and have a similar web address", so compare the text with the company it resembles.
• The email. The FBI and Europol both point to recruiters who write from free web-based email services instead of a company domain.
• The job itself. The FBI's signs include duties with "no specific job description" and being allowed to keep part of the money. The Secret Service adds being asked to register a company and a business bank account, and an employer who "refuses to show their face on camera during video communications."
• Other people's experience. The FTC suggests searching the company or the person hiring with the words "scam," "review," or "complaint."

These checks mirror the ones for a fake job applicant, and much of our guide to spotting fake candidates works in reverse.

A holder who answered an advert often has more about the recruiter than they realise: the post, the profile that sent it, phone numbers, email addresses, a website and an offer letter. Research each one.

• The advert. Note where it ran and under which account, then search for the same wording in other groups and on other platforms. The same script under a different company name links two adverts to one source.
• The profile. Check when it was created, what else it has posted, and whether it connects to the company it claims to represent.
• The contact details. Search each number and address for other adverts, complaints and accounts.
• The evidence. Save each page with the date you saw it. The FTC notes that in reshipping job scams the phone number "is often no longer connected and the website is deactivated" by the time a recruit tries to get paid.

Europol's advice is to report recruiting accounts "to the platform provider in order to be taken down", and a reviewer who has traced the advert is well placed to do it.

Recruiters rarely stop at one mule. In a Florida case, two men who pleaded guilty had been told to invite friends into the scheme, and the Justice Department says the group recruited "at least four additional, high-school-age participants."

Once one account is flagged, search your own customers for what it shares: the employer named at onboarding, the recruiter's contact details, the people sending money in, the accounts receiving it, or the same explanation in the same words. Some of these values are rare and some common, and our guide to linking related accounts covers how to weigh each one. The same unknown employer on three new accounts in two months is a strong lead to a common recruiter, and it says little about what each holder knew.

The Justice Department and Europol give someone used as a mule much the same advice: stop moving money, stop talking to the person giving directions, do not send that person any money still held, tell the bank and report it. Pass that on, explain what the job or the relationship really is, follow your own procedures for the account and the funds in it, and keep notes.

Then report the recruiter. In the US, the FBI asks people to report money mule scams to its Internet Crime Complaint Center, the IC3. In England, Wales and Northern Ireland, Report Fraud replaced Action Fraud in December 2025, and in Scotland reports go to Police Scotland on 101.

The case is a composite. Wendmoor Freight Partners is invented, its domain uses the .example names reserved for documentation, and the phone number comes from the 555-0100 to 555-0199 range reserved for fictional use.

A US fintech's monitoring flags an account opened five months earlier by a 22-year-old who gave her occupation as student, with part-time retail work. For four months it carried a paycheque every two weeks and small card payments. Then, over 19 days, 14 transfers arrive from 11 people in seven states, between $900 and $4,800 each and $36,200 in all. Most of each payment leaves within hours, as purchases at a cryptocurrency exchange or transfers to two accounts at other banks, and about 8 percent stays behind. The pattern shows money moving for someone else, and says nothing about who.

The holder. Her name and home town match a person with a long public footprint: a university society page listing her as treasurer in 2024, school sports results from 2020, and a social profile active since 2018 where friends reply to her posts. The phone number on the account is the one on the society page. The identity is hers, and by every sign so is the account.

The job. Asked about the payments, she says she works remotely as a "payment processing agent" for Wendmoor Freight Partners, passing its customers' payments to its suppliers for a commission. She found the job through an Instagram post in a student jobs group, and she shows the reviewer the recruiter's messages on Telegram.

The employer. Wendmoor's website, wendmoorfreight.example, was created seven weeks earlier, according to its registration record. Its About page copies, paragraph for paragraph, that of an established freight company with a similar name in another state. The site says Wendmoor is registered in Delaware, and the state's registry has no entity of that name. The "hiring manager" writes from a free webmail address, the offer letter lists no duties beyond receiving and remitting client payments, and he declined a video call.

The recruiter. The Instagram account behind the advert is six weeks old, has posted nothing but job adverts, and gives a contact number, +1 312 555 0147. The same advert, under a different company name, appears in two other jobs groups.

Other accounts. Two of the fintech's customers, both onboarded in the last two months, give Wendmoor Freight Partners as their employer, and one lists +1 312 555 0147 as a work number.

Put together, the account is being used as a mule account, and the evidence fits a holder who does not know what the job is: her identity is real, her story matches the recruiter's script, and she described the job freely. The team stops outgoing payments under its own procedures, explains to her what the job is, and passes on the Justice Department's advice to stop talking to the recruiter and send them nothing. It reports the advert to Instagram, files a complaint with the IC3 and opens reviews of the two linked accounts. Some questions stay open, and the file says so: who runs Wendmoor, whether the other two customers are victims or part of the recruiting, and where the money went after the exchange.

Count only independent evidence: a website and an offer letter that quote the same invented registration are one fact seen twice.

• A real person who rents out their account. Research confirms who they are and cannot read intent. The FBI says complicit mules advertise their services, "to include what actions they offer and at what prices", and a practised one may tell a rehearsed story.
• A real identity used without its owner. Stolen details arrive with a genuine footprint, so tie the phone number and email address to the person as well as the name.
• A borrowed company. When a recruiter uses a real company's name, the registry finds a real company. Contact it through its own website and ask whether it hires remote payment agents.
• Short-lived recruiting accounts. Profiles, sites and numbers disappear quickly, so capture them the day you find them.
• Deliberate variety. An organised group can give each mule a different employer, story and contact number, which leaves fewer shared details to link.

Much of what makes an account look like a mule account can have an ordinary explanation, and a fair review checks for one first.

• Plenty of genuine accounts receive money from many people: marketplace sellers, people collecting rent or shared bills, freelancers, and clubs collecting for an event. Ask what the customer does first.
• Money that leaves quickly is normal for some customers, such as people who move their pay to savings at another bank or into investments.
• A thin footprint is common among young people, newcomers to a country and anyone who keeps a low profile online. Europol notes that newcomers are also a recruiting target, so treat thinness as a reason to ask questions.
• A company missing from one registry may be registered elsewhere or trade under another name. Check spellings and other registries first.
• Age figures describe the cases Cifas and others have recorded, and say nothing about the person in front of you.
• A holder who is open about the job is giving you evidence. Many are the recruiter's victims, and the Justice Department's warning letters are written for people who may have been unknowingly recruited.

Transaction monitoring raises the alert. The research that follows is what takes the time: who the holder is, whether the employer they name exists, and where the recruiter leads. Sixtyfour's agent starts from what you already have, such as the holder's name, email address or phone number, the employer on the application, or a recruiter's handle or website. It researches public sources such as registry filings, the web footprint, news and professional profiles, links what it finds to the right person or company, and returns every finding with its source. Anything it could not establish is reported as open, and a person on your team decides. It does not see transactions or check bank accounts. There is more on how financial crime teams use it on our financial institutions page.

Read a flagged account in two parts. The transactions show money passing through for someone else, and research on the holder, the employer they name, the recruiter's advert and the other accounts that share the story shows whose account it is and whether they are likely to know. Treat an unwitting holder as the recruiter's victim, pass on the advice the Justice Department and Europol give, and report the recruiter.