Money mule typologies — the indicators that hold up
A money mule account is not defined by any single transaction — it is defined by a shape. Funds arrive from parties the account holder has no evident relationship with, and leave almost immediately, almost entirely, to a destination that repeats across accounts. Each element is individually explicable. Together they are the most reliably detectable typology in retail payments, and the one where per-account monitoring performs worst.
1. The shape, in four elements
| Element | What it looks like | Why it is weak on its own |
|---|---|---|
| Unassociated inbound | Credits from senders with no evident link to the account holder | Common in legitimate use — refunds, friends, marketplaces |
| Rapid pass-through | Outbound within hours or a day of receipt | Many customers genuinely hold no balance |
| Near-complete drain | Outbound close to the full credited amount | Round-tripping is not inherently suspicious |
| Shared destination | The same beneficiary across otherwise unconnected accounts | Invisible unless the model aggregates on the counterparty |
Annex III to Regulation (EU) 2024/1624 supports the first element directly: payment received from unknown or unassociated third parties is a named product, service, transaction or delivery-channel risk factor. The fourth element is the one that turns a weak alert into a case, and it is the one that requires the model to look outside the account.
2. Recruitment patterns and what they leave behind
Recruitment matters to detection because it leaves signatures at onboarding rather than in transactions. Three recur:
- The witting recruit — a person who knowingly rents out an account. Often shows a normal onboarding and a long dormancy before activation.
- The deceived recruit — someone who believes they have taken a job processing payments, or who is in a romance or investment relationship with the controller. Often reacts to intervention with a rehearsed explanation, which is itself a signal.
- The compromised account — a genuine customer whose account is taken over. Distinguished by a change in device, contact detail or behaviour immediately preceding the flow.
The three need different responses. The first is an exit and reporting decision; the second involves a victim; the third is a security incident as much as a financial-crime one. A control that treats them identically will handle at least two of them badly.
3. The dormancy-then-activation signal
The single most specific behavioural indicator is an account that has been open and quiet for a period, then suddenly transacts at volume with the four elements above present. It is specific because it is hard to produce accidentally: legitimate customers who become active usually do so gradually, with a mixture of transaction types, and with counterparties that overlap with their earlier activity.
Two refinements make it more precise still. First, look at what else changed in the days before activation — a new device, a changed phone number or email, a new beneficiary added. Second, look at whether the first active transaction is inbound from an unassociated party, which is the mule pattern, rather than outbound to a known payee, which is ordinary reactivation.
4. Handling the case
Facts: an account dormant for four months receives five inbound transfers from unrelated senders over three days, and forwards 96% of the total to a single beneficiary. Four other accounts show the same beneficiary in the same week.
What the rules engage: Article 34(2) — an unusual pattern, and transactions without apparent economic or lawful purpose — requiring examination of the origin and destination of the funds and the purpose. Article 71 governs refraining from carrying out transactions, and Article 69 the reporting of suspicions.
What the practitioner does: builds the case on the beneficiary, covering all five accounts in one assessment rather than five parallel ones; records the assessment and its basis under Article 77(1)(b) regardless of outcome; and keeps the customer-facing handling consistent with the Article 73 prohibition on disclosure, which covers telling the customer that activity is being assessed — not merely that a report has been made.
FAQ
What is the strongest single indicator?
Not one indicator — the combination of unassociated inbound, rapid near-complete pass-through, and a beneficiary shared with other accounts. The shared beneficiary is what converts a weak signal into a case.
Are all mules complicit?
No. Deceived recruits and compromised accounts produce similar transaction shapes with entirely different culpability, and the response differs accordingly — including because one of them involves a victim.
What can we tell the customer?
Article 73 prohibits disclosing that activity is being or has been assessed, that information is being or will be transmitted, or that an analysis may be carried out — so customer-facing explanations need to be agreed in advance and kept non-specific.
Related: Aggregated mule reporting in Spain · Money muling in Italy · Structuring and smurfing
