Your verified customer is moving stolen money. Here is how mule accounts pass KYC, and how to catch them.

Picture a customer you onboarded eight months ago. Real ID. The government record matched. The selfie matched and the liveness check was clean. Since then the account has done almost nothing: a small top-up, a phone bill, long stretches of silence.

Then one Tuesday it receives eleven transfers from people it has never dealt with. Each one leaves again within minutes, to a recipient it has never paid before. By the evening the balance is back where it started.

Nobody stole that account and nobody forged anything to open it. The customer is exactly who they said they were. They were offered a little money to let someone else use it.

That is a money mule account. It is the hardest kind of fraud to see at onboarding, because at onboarding there is nothing wrong to see.

What a mule account costs you

The stolen money is not yours, but the consequences are.

• You are where the money went. When a victim's bank traces a payment, the trail ends at your customer. The recall requests, the police enquiries and the frozen balances all arrive at your door.

• You are asked what you saw. The customer was verified, so the question is not who they were. It is why an account that sat quiet for months moved that much money in a day and nobody looked.

• One mule is rarely alone. The FATF describes proceeds of fraud being "rapidly laundered through a network of accounts" (opens in a new tab). If one of yours was recruited, ask who else was.

• Your customer may be a victim too. Closing the account ends your exposure. It does not tell you whether you just exited a criminal or someone who was deceived.

The scale is not small. In its Money Mule and Financial Exploitation Action Plan (opens in a new tab) of March 2024, the UK Home Office cites a National Crime Agency estimate that over £10 billion is laundered through money mule activity in the UK each year. Europol says more than 90% of the mule transactions (opens in a new tab) identified through its European Money Mule Actions are linked to cybercrime. We have not found a figure of the same quality for African markets, so we will not offer one.

How mules are recruited, and why they pass KYC

The UK plan describes one of the most common routes plainly: a criminal offers cash in exchange for the use of someone else's bank account. The joint FATF, INTERPOL and Egmont Group report on cyber-enabled fraud (opens in a new tab) (November 2023) fills in the rest.

• The offer. Mules are recruited through job offers, advertisements and social media. The pitch is easy money for receiving and forwarding payments.

• The knowledge. The report says mules may be knowingly complicit, deceived, or simply negligent. INTERPOL makes the same point (opens in a new tab): they can be laundering illegal funds without being aware of it. Victims of romance fraud are sometimes turned into mules.

• The handover. Some mules move the money themselves. Others surrender their banking credentials, cards and tokens so the criminals control the account directly.

• The short life. Some mules only allow their accounts to be used for a limited period.

Now look at that list as an onboarding team would. The identity is real. The document is genuine. The face belongs to the person on the ID. Every check answers the question it was built for, which is whether this person is who they claim to be. They are.

The FATF report says so directly: the limited time period, together with "legitimate onboarding procedures" (opens in a new tab), makes it relatively difficult for institutions to detect abnormal activity. Mule accounts do not beat KYC. They sit outside what it measures.

The signals that give a mule away

A mule account has a job to do, and the job leaves a shape. None of these proves anything alone.

• In and straight out. Funds arrive and leave again in matching amounts within minutes. The FATF report calls these pass-through transactions.

• Many senders, one account. Unrelated people paying in over a short window, often called smurfing.

• A quiet account wakes up. Months of little activity, then a burst far outside what is normal for that customer.

• A first payment to a new recipient. Sizeable, and to someone the customer has never paid.

• Small test payments. The report notes criminals may send small amounts first to check an account still works.

• Someone else is at the controls. A new device, a new location, a password reset or a new beneficiary shortly before the money moves. That is what a handed-over account looks like from the inside.

• Shared hardware. Several of your customers onboarding or logging in from the same phone.

What to do, and what Toden does and does not do

Three things, in the order they pay off.

1. Score the money as it moves. Toden's transaction monitoring has built-in rules for the patterns above: pass-through, rapid movement, smurfing, dormant-then-active, new beneficiary, and a baseline that compares each amount with what is normal for that customer. Each transaction comes back as allow, review or block, and a review opens an alert. Our guide to tuning monitoring rules covers the thresholds.

2. Send the account activity too. Logins, device changes and new beneficiaries are scored alongside payments. When a login looks wrong, a step-up sends the customer a hosted re-authentication challenge and you continue only if they pass. We wrote about that in account takeover and step-up.

3. Use what onboarding can still tell you. Device Intelligence reports how many other people were seen on the same device, and whether anyone on it was previously declined for fraud. Face search finds a person who already holds an account with you, and a confirmed mule can be added to a blocklist so the same face, ID, phone or device is declined next time. Silent capture shows a reviewer who was holding the ID during the document scan, which matters when a recruiter is walking someone through sign-up.

Now the limits, which matter more than the features.

• Toden only sees what you send. The flow rules need a direction and a counterparty on each transaction. Without them, those rules stay dormant.

• It sees your customers, not the rest of the financial system. A mule who behaves at your institution and misbehaves at another is invisible to you here.

• It cannot tell a complicit mule from a deceived one. Nothing in a transaction pattern shows intent. That is a conversation and a judgement.

• A shared device is not proof of fraud. Families and agents share phones. Treat it as a reason to look.

• An investigation groups alerts for one customer. Linking several customers into one network is still an analyst's work.

• It does not freeze funds or file reports for you. It drafts a suspicious activity report in goAML format for you to review, export and submit.

What you must do when you find a mule differs by country: when to report, whether you may tell the customer, and how to treat someone who was exploited. The UK plan, for example, notes that moving criminal money can carry up to 14 years in prison there, and also asks that vulnerable or exploited people are not removed from banking altogether. We have cited international bodies and the UK here, not your regulator. This is not legal advice for your situation.

Questions to ask a provider

• Which mule patterns do you detect out of the box, and what data must I send for each one to work?

• Is the decision returned in real time, before the money leaves, or in a report the next day?

• Can I test a rule change against my own past transactions before it goes live?

• Do logins and device changes feed the same score as payments, or a separate product?

• When a rule fires, can my analyst see exactly why?

• What can you not see? Ask this one last, and distrust a short answer.

On Toden: the patterns and their required fields are in the public documentation, decisions come back on the request, rule changes can be replayed against recent scored events before you save, activity and payments share one risk engine, and every alert lists the rules that contributed. The limits are the six above.

Want to see how your own transactions would score? Open a Toden workspace (opens in a new tab) or read how transaction monitoring works.