Mule accounts

Ce contenu n’est pas encore disponible dans votre langue.

In short

A money mule is an account, and usually a person, used to receive money and pass it on, so the criminal behind it stays hidden. Mules are central to fraud in West Africa: proceeds of scams, MoMo fraud and romance fraud flow through chains of mule wallets and bank accounts within hours.

Some mules know exactly what they are doing. Many don’t: they have been recruited with a “job offer”, paid a small fee to “receive money for a friend”, or had their account taken over. Your job is not to decide which; it is to recognise the pattern and act.

What it looks like

A wallet registered six weeks ago to a 21-year-old student in Cape Coast receives GHS 2,000–4,500 from 23 different senders over two days, GHS 61,000 in total. Within hours of each credit, the balance is sent on to three wallets and one bank account. The balance is never more than a few hundred cedis.

The three classic shapes:

FAN-IN                  FAN-OUT                 PASS-THROUGH
sender ─┐               ┌─▶ recipient           in ──▶ [account] ──▶ out
sender ─┼─▶ [account]   [account] ─┼─▶ recipient    (same day, ~same amount)
sender ─┘               └─▶ recipient

A mule often shows fan-in followed by fan-out: many victims or feeders pay in, and the money is spread out to the next layer.

Which rules surface it

Rule	What it catches
D1 Fan-in	Many distinct senders to one account
D2 Fan-out	One account to many distinct recipients
D3 Fan-in followed by fan-out	The classic mule shape, checked every night over the last 72 hours
D4 Circular flow	Money passed around a chain of accounts and back to where it started
C5 Rapid in-and-out	Most of what comes in leaves within a short window
C4 New account, high value early	Fresh accounts suddenly moving large sums
D5 Shared device, phone or ID	One device or phone controlling many accounts
D6 Counterparty linked to a prior case	Money to or from someone already in a confirmed case
G4 Wallet-to-bank sweep	Many inbound wallet payments swept to a bank account
I3 Personal account, business-like volume	A personal account behaving like a merchant

Red flags and innocent explanations

Red flag	Possible innocent explanation	How to tell them apart
Many unrelated senders	A small business, church, susu group, or event collection	Do the senders repeat over months (regular customers)? Is there a reference or purpose in the narration? Does the customer’s profile say “business”?
Money leaves almost as soon as it arrives	A trader paying suppliers from customer receipts	Do outgoing payments go to the same few suppliers regularly? Mules send to changing recipients
New account, high activity	A new business ramping up	Is there evidence of a real business? Does activity grow gradually or explode on day one?
Profile doesn’t fit (student, unemployed, elderly)	Collecting on behalf of family	Small, occasional amounts fit; tens of thousands from strangers don’t
Several accounts on one device	A family sharing a phone	2–3 related names is common; 10 unrelated names on one device is not
Victims complain or request reversals	—	Reversal requests and fraud complaints naming the account are strong evidence

How to investigate

Draw the flow. List the inbound senders and outbound recipients with amounts and times. Even a rough sketch shows whether money is resting (normal) or passing through (suspicious).
Measure the retention. What share of the inflow is still in the account after 24 hours? Mules keep very little.
Look at the senders. Are they many unrelated individuals? Has any of them complained of fraud, requested a reversal, or appeared in another case?
Look at the recipients. Are they other new accounts? Do they share devices, phone numbers or ID numbers with this customer or with each other? Are any abroad?
Check the customer’s profile and onboarding. Age, occupation, account age, KYC tier, how and where they onboarded. Mule recruiters often target students and young job-seekers.
Check device and channel data. Logins from many devices, or one device shared with many customers, suggest control by someone else.
Follow the money one step further where you can see it inside your own institution. If recipients are also your customers, consider opening linked cases.
Decide and act quickly. Mule money moves in hours. If you believe funds are fraud proceeds still in your system, escalate immediately so your institution can consider its options under its policy and the law.

What to record

The flow: senders, recipients, amounts, timings, and retention.
Links found: shared devices, phone numbers, IDs, previous cases.
Profile mismatch: why the activity doesn’t fit the customer.
Any fraud complaints or reversal requests and their references.
Linked case numbers if you opened cases on related accounts.

When to escalate or report

Escalate immediately when there are fraud complaints, when funds may still be recoverable, or when the account is linked to a confirmed case.
Report where the pattern is consistent with laundering fraud proceeds and there is no credible legitimate explanation. Mule networks often justify reports on several linked customers; tell the FIC about the links in each narrative (see Writing an STR).
Consider a designation (for example watchlist) on linked customers so their future activity gets closer attention. Use Flag on the customer’s page; see Flagging a customer.