Money-Mule Herding & Recruitment
Networks recruit individuals, often students, job-seekers and the financially vulnerable, to open or hand over accounts that receive and forward illicit funds. A controlling herder coordinates many newly-opened accounts that share common funders or beneficiaries, rapidly moving proceeds of fraud and other crime while distancing the controllers from the money.
What it is
Networks recruit individuals, often students, job-seekers and the financially vulnerable, to open or hand over accounts that receive and forward illicit funds. A controlling herder coordinates many newly-opened accounts that share common funders or beneficiaries, rapidly moving proceeds of fraud and other crime while distancing the controllers from the money.
Control objective
Detect mule accounts and the herder networks controlling them by identifying newly-opened accounts exhibiting rapid receive-and-forward behaviour with shared funders, beneficiaries, devices or control signals.
Data required
- Account age and onboarding details (device, IP, contact details)
- Inbound credits, sources and the proportion forwarded onward
- Time between inbound credit and onward transfer
- Shared funders or beneficiaries across multiple accounts
- Shared device IDs, IP addresses, phone numbers or addresses across accounts
- Customer profile (age, declared occupation, expected activity) versus observed flows
- Fraud reports, chargebacks or law-enforcement requests linked to inbound funds
- Dormancy followed by sudden high-velocity activity
Related typologies (Money Laundering)
Rapid Movement of Funds
Funds received and immediately transferred onward with minimal dwell time, suggesting the account is being used as a pass-through to layer illicit proceeds and obscure audit trails.
Structuring / Threshold Avoidance
Deliberate splitting of transactions to remain below reporting thresholds or monitoring triggers. Commonly associated with layering proceeds of crime or avoiding CTR filings.
Behavioural Change Indicators
Sudden or unexplained changes in a customer's transaction behaviour relative to their established profile, such as new geographies, increased volumes, or different payment types, potentially indicating account takeover or use for laundering.
Mule Account Activity
Accounts used to receive and rapidly disburse funds on behalf of criminal networks. Mule accounts are often opened by individuals who are recruited, coerced, or deceived into facilitating the movement of illicit proceeds.
Shell Company Indicators
Use of corporate entities with no genuine commercial activity to obscure beneficial ownership, layer funds, or create false invoicing chains. Shell companies are commonly used in trade-based money laundering and corruption schemes.