Money mule detection: how to identify and stop mule accounts

In Singapore, someone accepted S$2,400 in "fast cash" for letting an unknown person control their Singpass account. That identity was then used to open two bank accounts, which received more than S$337,000, at least S$114,000 of it from 21 scam victims. The person was convicted. The sentence was eight months' imprisonment, as the Singapore Police Force reported on 4 November 2024.

The victims paid into accounts that looked ordinary, in a name that was not the criminals' own, and the money moved on from there. Among the money laundering methods and typologies, the mule account is where a scam victim's money first lands. Detection means finding that account while the money is still there.

What is money mule detection?

Money mule detection is the work a receiving firm does to find accounts that take in and pass on criminal funds, and to act before the money moves on. The FCA's money mules review of 23 September 2026 defines the activity as "a form of money laundering in which a person transfers or receives criminal funds on behalf of others". US regulators, in a joint statement of 2 September 2026, count the accounts as mules too. The people involved "can be witting or unwitting".

Detection looks at the account more than at the money mule behind it. The firm that holds the account has three outcomes: refuse it at onboarding, hold money before it leaves, or exit the customer and report.

In the Singapore case, refusal means an application that fails at opening because someone else controls the identity. A hold means money stopped while part of the victims' S$114,000 is still there. Then only exit and report remain.

Why does mule detection matter more in 2026?

Suspected mule accounts closed by UK firms, by firm type (FCA survey of 35 firms, 23 September 2026). Tenure is the age of the account when it was closed, not when the mule activity began. Growth at e money institutions, payment institutions and challenger banks may reflect broader customer growth alongside better detection, the FCA says.

In 2025, UK firms in the FCA's survey closed 238,396 suspected mule accounts, against 184,935 in 2023 and 233,269 in 2024, so growth slowed in the final year. The survey covered 35 retail banks, building societies, challenger banks, payment institutions and e money institutions. E money institutions recorded the largest rise, though the FCA notes this does not necessarily mean mules make up a larger share of their business.

Read the tenure column with care. The FCA's data shows how old each closed account was, not when the mule activity started, so a long held account may have been used for years or may have changed recently. The patterns still point to different controls: strong onboarding checks where closures cluster in the first six months, and behavior checks that keep running where accounts close after years.

Cost is the second reason. Under the UK's APP scam reimbursement rules, sending and receiving firms split each reimbursed loss 50:50, as the Payment Systems Regulator sets out. A receiving firm that lets a mule account through pays half of every reimbursed APP fraud loss that lands in it.

Victims can claim up to £85,000 under protections that started on 7 October 2024. Between then and 31 March 2026, 88 percent (£316 million) of the money lost to APP scams was reimbursed and 82 percent of claims were closed within five business days, the PSR's reimbursement dashboard shows.

How do you detect a mule account, and when do the signals appear?

Mule signals show up in a set order, from the application to the cash out.

1. Onboarding. Application fraud checks at opening look for details that do not fit the stated purpose: an occupation, income or address that cannot explain the expected activity, and identity data that may be borrowed or bought. Why: 47.1 percent of the accounts in the FCA's 2025 tenure figures were closed within a year of opening, 55,353 within three months.
2. A quiet account turns busy. FinCEN's mule red flags (July 2020) describe an account that "generally had a low balance until the customer became involved in a money mule scheme". Why: at retail banks and building societies, 45.4 percent of closed accounts were over two years old, though the data cannot show when the activity began. An account that was sold, lent or taken over shows the same sudden change.
3. Inbound from many senders. Money arrives from various people or businesses and moves on to other accounts at the direction of a supposed employer. FinCEN also flags a free email service where a company address would be expected. Why: a personal account has no reason to collect other people's money and forward it.
4. Money leaves soon after it lands. Outbound transfers to new payees follow quickly, and the balance stays low in between. Why: this is layering in progress.
5. Cash out. The FCA found card payments the most common method, as many small purchases or larger payments to local businesses. International cash outs were typically higher in value, crypto ones fewer but larger. Why: here the money leaves the payment system.

A transaction monitoring rule joins these weak signals into one scenario, such as many new senders followed by quick outbound payments.

Is any one signal enough on its own?

No. FinCEN says "no single financial red flag indicator is necessarily indicative of illicit or suspicious activity" and asks firms to weigh context, such as the customer's history and whether several indicators appear together. If one behavior has to be named, it is pass through: money in from senders the customer does not know, then straight out again.

Why is one account at a time not enough?

Picture an illustrative chain. A victim's payment lands in account A at a wallet firm. A splits it between account B at a bank and account C at a second wallet. B starts spending on cards at local shops. The wallet firm sees one large payment into a new account and the bank sees transfers and card spend, but neither sees the chain.

So the FCA expects firms to look "beyond the initial receiving account": at linked accounts within the institution, payment characteristics, the wider transaction context and the customer. Inside one firm, the links are shared devices, payees and funding paths, and complead, formerly Sanction Scanner, resolves them across accounts in its fraud prevention product, so a mule ring shows up as one ring.

The FCA's evidence comes from a public and private cell of 22 firms that traced the highest value payments in 140 cases across seven fraud types. Most cash out happened between the second and fifth mule account, and the second account saw the most. By then the funds were split into smaller, less conspicuous payments. Some accounts had been used several times, across different scam types, before firms shut them, which the FCA reads as established criminal infrastructure.

Across firms, the UK's Economic Crime and Corporate Transparency Act of 2023 helps. Its section 188, in force since 15 January 2024, covers a firm in the regulated sector that shares information about its customer with another firm in that sector. The sharer is shielded from breach of confidence and from civil liability to the customer when the other firm asked for it, or when the sharer has decided over economic crime concerns to end, refuse or restrict the customer's service, and the sharer is satisfied the information will or may help the other firm. Privileged disclosures are excluded. Data protection law still applies.

In the US, Section 314(b) of the USA PATRIOT Act gives financial institutions that register with FinCEN a safe harbor from liability when they share information with one another to identify, and where appropriate report, possible money laundering or terrorist activity, fraud included. Sharing also runs through networks. In complead's Consortium KB, a member that confirms a typology contributes a fingerprint of it rather than the customer record, so a mule network one member has caught is not investigated from zero at the next.

What does the law let a firm do about a suspected mule account?

What the law lets or makes a firm do about a suspected mule account, as of November 2026. "No rule named here" means no source read for this page names one.

The UK delay power belongs to the sending firm. Since 30 October 2024, the Payment Services Regulations 2017 have let a payer's payment service provider delay crediting a payment, to make further inquiries, when it has reasonable grounds to suspect that a third party's fraud or dishonesty lies behind the order and has formed those grounds by the close of the business day after receipt. The delay may last only as long as needed, and no later than the close of the fourth business day after receipt.

The rule covers authorized sterling payments made wholly within the UK and not started by or through the payee. The payer must be told of the delay, the reasons and anything needed from them, unless telling would be unlawful. A receiving firm cannot use the power. It acts through refusal, restriction, exit and reporting.

The US statement is addressed to banks and credit unions, as FinCEN defines a bank, so a money services business, which falls outside that definition, cannot assume it applies.

Singapore's new offenses reach a person who carries out a transaction for someone else despite suspicions they did not follow up, or who continues despite obvious red flags any reasonable person would notice. Rash laundering carries a fine of up to S$250,000, up to five years in prison, or both. Negligent laundering carries a fine of up to S$150,000, up to three years in prison, or both. At least 74 people were charged with new offenses connected to mule activity between 9 September and 1 November 2024.

What should a firm do once it suspects a mule account?

Go back to account B in the illustrative chain: transfers from a wallet this customer has never been paid from, then card spend at local shops.

1. Hold where the law allows. B's bank received the money, so the UK delay power is not its to use.
2. Ask. Ask what the payments are for and where the money came from. The US joint statement counts that question among communications that typically reveal no SAR, and FinCEN treats a refusal to answer as a red flag. A KYC refresh form for individuals puts expected activity, source of funds and acting for others in writing.
3. Report. If the answers do not explain the money, file a suspicious activity report. Under UK anti money laundering law, staff disclose a suspicion to the firm's nominated officer, who decides whether it goes on to the National Crime Agency.
4. Exit or restrict. In the UK, that decision also lets the firm warn other firms under section 188; in the US the firm may tell the customer it is closing the account.
5. Record. A UK filing to the National Fraud Database has a stricter bar than a closure: Cifas members need reasonable grounds to believe fraud or financial crime was committed or attempted, supported by "clear, relevant and rigorous evidence". The share of offboarded customers filed fell from 17.4 percent in 2024 to 15.3 percent in 2025, when Cifas added a money muling category, so the years are not directly comparable.

The conversation with B's customer has its own legal limits. Under POCA section 333A, disclosing that a report was made, or that an investigation is contemplated or under way, is an offense when it is likely to prejudice an investigation and the information came through business in the regulated sector, unless one of the permitted disclosures in sections 333B to 333D applies. US banks may warn about mule schemes and explain decisions so long as nothing reveals a SAR.

What did 2026 bring for mule account detection?

• 12 May. India's Home Ministry cybercrime coordination body (I4C) and the Reserve Bank Innovation Hub agreed to share mule account intelligence and suspect identifiers from the Suspect Registry, to strengthen fraud detection systems such as MuleHunter.AI that banks run.
• 30 July. The PSR updated its dashboard with the first 18 months of reimbursement under the UK rules, to 31 March 2026.
• 2 September. US regulators and FinCEN confirmed that warning customers about money mule schemes typically does not reveal a SAR.
• 23 September. The FCA published survey counts of suspected mule accounts closed by 35 firms; before that, the FCA says, there was no reliable estimate of the number of mules.
• 29 October. The Council of the EU adopted its first reading position on the Payment Services Regulation, which is not yet in force.

Once found, a mule account lands on two desks. Fraud sees a victim's loss to recover. AML sees a laundering report to file, on the same account. The next question is which of the fraud and AML teams owns the case, and how the hand off keeps the money trail intact.