FIU [IMN] ¦ Money Mule Typologies

Money mules: how vulnerable account holders facilitate laundering and predicate crime

Money mule activity remains a practical challenge for banks, payment firms and other regulated businesses. Criminals use individuals and their accounts to receive, move or withdraw illicit funds, creating distance between the proceeds and the people responsible for the underlying crime.

The method is often associated with organised crime, but it does not always involve a willing participant. Some account holders knowingly sell access to their accounts for a fee. Others are manipulated, threatened or deceived into moving money on behalf of criminals. Romance scam victims, young adults and people in financially or socially vulnerable circumstances may all be used as intermediaries.

The account holder may not have participated in the predicate offense that generated the funds. Nevertheless, transferring or withdrawing criminal proceeds can amount to money laundering or related conduct, depending on the applicable law and the person’s knowledge, suspicion or involvement.

The laundering method

A money mule typically receives funds from another person and then transfers them onward, withdraws them in cash or converts them into another form of value. The mule may retain a commission, although payment is not always involved.

The arrangement supports several stages of laundering. Funds may first enter an account through a cash deposit, a payment from a third party or an international transfer. They are then rapidly moved to another account, withdrawn or exchanged into another currency. This activity can obscure the origin of the money and make it more difficult to identify the person who controls the proceeds.

The predicate offense is often fraud, cybercrime, drug trafficking or human trafficking. In some cases, the account is used to launder proceeds from a romance scam. The same customer may therefore be both a victim of crime and an unwitting participant in the laundering of funds obtained from another victim.

Bastian Schwind-Wagner _Follow

"Money mules remain a key channel for laundering proceeds from fraud, drug trafficking, cybercrime and other predicate offenses. Criminals may exploit vulnerable people or recruit individuals who knowingly allow their accounts to receive, withdraw or transfer illicit funds.

Warning signs include unexplained third-party credits, rapid onward transfers, unusual cash activity, cross-border payments and apparent control of an account by someone other than the holder. Effective controls should combine transaction monitoring with attention to coercion, exploitation and the need to protect potential victims."

Cash deposits followed by immediate movement

One recurring pattern involves a young or otherwise vulnerable adult receiving cash or third-party credits into a personal account. The funds are transferred electronically or withdrawn in cash on the same day, often for the benefit of another person.

The activity may be inconsistent with the customer’s previous account use. Payment references such as “loan”, “loan repayment”, “deposit” or “car deposit” can be used to give transactions an appearance of legitimacy. Such descriptions are not conclusive, but they should be assessed alongside the customer’s financial profile, the source of funds, the timing of transactions and the identity of the recipient.

References may also point toward drug-related activity. Where local information suggests drug supply or movement of proceeds, apparently ordinary transfers can take on a different significance. An account used to pass funds from an individual involved in drug trafficking to another person may be part of a wider laundering chain.

Vulnerability should not be assessed solely from the customer’s appearance or conduct. A person who appears nervous, evasive or suspicious may be under pressure rather than acting as a willing and informed member of a criminal group. Criminals may target teenagers, young adults, women, elderly people and others who can be persuaded or controlled.

Romance scams and cross-border payments

Romance scams provide another route into money-mule activity. A vulnerable person may receive payments into a domestic account and send money internationally to a purported romantic partner. Payments may be made through online services, payment platforms or branch-based channels.

The customer may fund the transfers with cash, money borrowed from relatives or friends, or a personal loan. Payment providers may sometimes reverse or refund transactions, but this does not remove the underlying concern. Repeated credits, refunds and onward payments can indicate that the account is being used as a conduit for scam-related funds.

Branch disclosures can be particularly important. A customer may describe the relationship, explain why money is being sent or reveal that the recipient has requested urgent financial assistance. Such information can help identify both the customer’s vulnerability and the possible cross-border flow of fraud proceeds.

The customer may be exposed to further financial harm, particularly where the scammer continues to request money. At the same time, the customer’s account may receive funds connected with the victimisation of another person. A sound response therefore requires both financial crime reporting and appropriate safeguarding considerations.

Third-party control of a newly opened account

A customer who appears to present a low financial risk may open a new savings account and attend the branch with another person. The third party may obtain access to the account or appear to direct how it is used.

Funds can arrive through international payments, benefit or pension payments, or cash deposits. They may then be withdrawn in full or transferred to another person shortly after receipt. The speed and completeness of the movement can suggest that the account was opened primarily to facilitate access to funds controlled by someone else.

Behaviour at the branch may provide important context. The account holder may appear nervous, distressed or unusually deferential toward the accompanying person. Statements such as “I don’t have an account”, “no bank will give me an account” or “I am waiting for my card” may indicate that the third party is the actual intended user of the account.

These indicators do not establish criminal conduct on their own. They should, however, prompt questions about beneficial control, the purpose of the account, the relationship between the parties and the expected source and destination of funds.

Currency exchange and drug trafficking proceeds

A further risk arises where a customer with limited funds or a low income, including a person receiving benefits, seeks to exchange a large amount of domestic currency into another currency. An explanation such as travel to the United Kingdom may be offered, but the stated purpose may not adequately explain the amount or urgency of the transaction.

Large or unusual currency exchanges may be indicative of drug trafficking between countries. Local knowledge, previous account activity and information about suspected criminal activity can increase the significance of the transaction.

Currency exchange can support the movement of criminal proceeds across borders while reducing the usefulness of transaction records that would otherwise show direct transfers between accounts. It can also allow cash to be transported physically, creating additional challenges for tracing and recovery.

What regulated firms should assess

The strongest warning signs often arise from combinations of facts rather than from a single transaction. Relevant factors include third-party control of an account, cash deposits or incoming credits followed by immediate onward transfers, unusual withdrawals, unexplained currency exchange and activity that differs sharply from the customer’s normal financial behaviour.

Payment references should be treated as contextual information, not proof of a legitimate transaction. “Loan”, “car purchase” or similar descriptions may be genuine, but they can also be used to disguise payments connected with fraud, drug trafficking or other criminal activity.

Transfers involving digital banks and payment firms, including multi-currency services, should be assessed according to the full transaction pattern. The use of a challenger bank is not inherently suspicious. It may become relevant where it forms part of rapid movement between several accounts, unexplained international payments or attempts to separate the customer from the true controller of the funds.

Staff should also remain alert to signs of coercion. A customer may be accompanied by a person who answers questions, handles the customer’s phone or appears to control the interaction. Fear, reluctance, confusion or sudden changes in behaviour may point to exploitation rather than deliberate participation.

The importance of the predicate offense

Money mule cases should not be treated only as account misuse. The underlying predicate offense may determine the nature, scale and urgency of the risk.

Where funds are linked to drug trafficking, the account may form part of a supply network. Where they arise from romance scams, the customer may be both a victim and a channel through which additional fraud proceeds are moved. Where payments follow cybercrime or payment fraud, the mule account may be one of many accounts used to layer and disperse stolen funds.

Identifying the predicate offense helps firms improve transaction monitoring, assess the wider network and provide more useful information to the financial intelligence authorities. It also supports appropriate action to protect vulnerable customers from further exploitation.

Reporting and safeguarding

A regulated business that identifies a reasonable basis for suspicion should follow its applicable reporting procedures and avoid alerting the customer or any third party to a potential report. The quality of the report will depend on clear explanations of the account history, transaction sequence, parties involved, stated purpose, relevant customer behaviour and any indicators of coercion or vulnerability.

Where there is a safeguarding concern, financial crime controls should operate alongside measures designed to protect the customer. A person used as a mule may require support from law enforcement, social services or other relevant authorities. Treating every mule as a willing criminal can result in missed opportunities to prevent further victimisation.

Money mule activity is best understood as a link between the proceeds of a predicate offense and the financial system. Rapid movement of funds, third-party control, unusual cash activity, cross-border payments and signs of vulnerability can reveal that link. Effective detection depends on bringing those facts together, understanding the customer’s circumstances and examining both the immediate transaction and the criminal conduct that may sit behind it.

Dive deeper

• Isle of Man, Financial Intelligence Unit (FIU), Ellan Vannin Unnid Tushtag Argidoil ¦ Documents & Reports, Money Mule Typologies, September 2020 ¦ Link