Money mule detection that shows where the scam money went and what is still reachable, with every freeze, notice and exit decided by one person and checked by another
Mule accounts frozen while the money is still there, and every victim's bank told.
See one case, screen by screen ↓Money Mule Detection is software for bank and credit union fraud and AML teams that finds accounts moving scam proceeds, then prepares the freeze, the notices to the sending banks, the exit and the SAR referral for people to decide. Seven agents draw the money in and out of an alerted account, find sibling accounts on the same phone, address or senders, weigh the mule type and draft every notice and letter. An investigator decides, and a manager checks each freeze, notice, return and exit.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
Every money mule scheme needs a receiving account. A retiree talked into a wire, a romance victim and the buyer of a car that does not exist all send money to a real account at a real bank, and from there it leaves in minutes through cash kiosks, P2P payments and prepaid cards. The FCA finds that criminals usually cash out between the second and fifth account. The receiving bank is the last place the money can be stopped, and Nacha's rules now expect every receiving bank to monitor incoming credits sent under false pretenses.
Mule account monitoring today ends in a score, and the work starts after it. The investigator pulls inbound wires and ACH from the payments hub, P2P activity from the network gateway, card loads from the card processor, devices from digital banking and the customer from the core, often after the account has emptied. Sibling accounts on the same phone are found by luck, the sending banks are phoned one by one, and the exit letter and the SAR referral are written by hand, where one wrong word tips off the customer. Money Mule Detection puts agents on each alert, and the investigator decides what happens with the money that is still there.
Estimated split of the working hours one mule review takes, by hand and with the agents. Our estimate, kept modest, from the 2 to 4 hours we estimate a review assembled by hand takes; in the working solution the sample case ran from the alert at 11:46 a.m. to the approved freeze at 12:04 p.m.
Seven agents trace the money, find the sibling accounts and draft every notice; the investigator decides and a manager checks.
Tyler Brennan, 20, opened an Everyday Checking account at Corvane National Bank online on August 3, 2026. Until this week it saw about $1,140 a month of part-time wages, and on October 20 he asked the bank in a secure message whether his new employer's deposits were OK. On Thursday, October 22, at 11:46 a.m., the transaction monitoring system raises alert A-77213. Here is what happens next, screen by screen, in the working solution.
Between 9:14 and 10:58 a.m., $18,400.00 arrived from three retirees at three other banks: a $9,500.00 wire from Harold Pfeiffer, 78, a $3,400.00 P2P payment from Joan Mercer, 71, and a $5,500.00 same-day ACH credit from Walter Osei, 69. The flow agent draws every leg out: $7,400.00 at a cash kiosk operator, four P2P payments and a $1,500.00 prepaid card load. Each leg opens its source record, and opening one is logged.
"Funds left in 47 minutes" · $6,862.18 still reachable across 3 accounts
Kiara Benning's account, opened August 11, signs in from Tyler's phone D-7F3A (41 logins), shares his address and holds $4,180.00 sent by P2P yesterday by Ruth Adeyemi, 74. Elias Montrose's account, opened August 9, is on the same phone (27 logins) and holds a $2,120.00 ACH credit from Leon Hartsell, 77. The links score 0.96 and 0.91. Dana Brennan shares only a surname and an old address, scores 0.22, and is shown and left out.
"Left out: a family or household link is not a mule link (O3)"
The agent weighs the three FinCEN mule types: witting 0.64, unwitting 0.24, complicit 0.12. Tyler asked about his "employer's" deposits and was paid a $350.00 "training stipend" by Northgate Staffing LLC, but one phone signs in to three accounts in three names, and he used the cash kiosk with chip and PIN 8 minutes after the last credit. The recruitment pattern matches JS-03, a remote payment processing job, on 5 of 6 markers. The investigator records the type, which never appears on a customer-facing record.
"No type reaches 0.70, so the agent does not decide."
Marisol asks to freeze all three accounts: $562.18 in Tyler's, $4,180.00 in Kiara's and $2,120.00 in Elias's, $6,862.18 in all. She picks reason code F2, "Mule activity confirmed by money flow", and writes why for the checker. Nothing is frozen until a different person approves.
Three notices cover five senders and $24,700.00. Bramwell Savings Bank and Sable Ridge Bank are registered for 314(b) sharing and get full detail; Harrowgate Bank and Trust is not, so it gets payment facts and the return only. Sable Ridge's notice answers the recall request RQ-3318 it sent at 11:52. Before anything leaves, the agent checks the amounts against the payments hub and that no notice mentions a SAR, a referral or the BSA team.
Kiara's and Elias's balances trace one to one, so $4,180.00 goes back to Ruth Adeyemi and $2,120.00 to Leon Hartsell as an ACH return. The $500.00 left of the morning's money is mixed, so it is shared pro rata: $258.15 to Harold Pfeiffer, $92.39 to Joan Mercer and $149.46 to Walter Osei. $6,800.00 goes back in all, once the freeze is approved and each bank confirms its recall; Tyler's own $62.18 stays for the exit.
The exit agent drafts the closure of all three accounts on November 6, 2026, what happens to each balance, with Tyler's $62.18 paid by official check, and re-open flags on name and SSN and on phone D-7F3A. The tipping-off check passes: no reason for the closure, no mention of a report, an investigation, fraud, law enforcement or the BSA team, and the same wording for all three accounts. A manager checks the exit.
"…we have decided to close your account ending 4417. The account is restricted now and will close on 6 November 2026."
The referral goes to the BSA team's restricted space with its 30-day clock to November 21, and only the SAR access list can open it. Beside it, a live preview shows what a teller at Dorrance Main sees: status Restricted, $0.00 available and a number to call Fraud Operations. The branch note, the contact center script, the app message, the closure letters and the statement are all checked.
"You will not see whether a SAR is filed, and nothing about it appears anywhere a customer or the branch can see."
Grant sees six requests waiting, four of them on this case. The freeze comes with Marisol's reason and the evidence the agents put in front of him: $18,400.00 in and $17,900.00 out in 47 minutes, the shared phone with two linked accounts at 0.96 and 0.91, and Sable Ridge's recall. He approves the freeze at 12:04 and the notices at 12:05.
"The maker cannot check their own request"
Tyler's case now shows $6,862.18 frozen across three accounts, three sending banks notified for five senders, and 18 minutes from alert to freeze against a 30-minute target. The watch still ranks two live cases by what can be stopped: Fitch Mobile Detailing LLC, with $17,600.00 still reachable while the agents trace it, and Rosa Quintero, waiting for a late card feed.
The same case, seen by the five people who carry it: what their day looked like, and what it looks like now.
Seven agents trace the money, find the sibling accounts and draft every notice; the investigator decides and a manager checks.
Walks every hop in and out of an alerted account across ACH, wire, P2P, card and cash, in time order, cites the source record for each one, and works out the exit time and what is still reachable.
Finds sibling accounts that share a device, an address, a phone, an email, senders or recipients, each link with its evidence and confidence, under versioned link rules.
Weighs whether a customer is an unwitting, witting or complicit money mule, with every signal cited, and names the recruitment pattern from the bank's library of money mule typologies.
Drafts a fraud notice to every sending bank, checks each bank's 314(b) registration to decide what may be shared, and proposes the return plan.
Drafts the neutral closure letters, the fund disposition and the re-open flags, and runs the tipping-off check on every letter and note.
Builds the referral for the BSA team (subjects, activity, timeline and evidence) in its restricted space and starts the 30-day SAR clock.
Keeps the append-only case record and builds export packs with redaction and a manifest.
Decide, check, file. The agents propose; a named person decides.
The investigator can ask about the money, the people or the next step. Every answer cites the records it came from, and the assistant can open the screen it talks about.
Where did Tyler Brennan's money go?
Out in 47 minutes after the last credit at 10:58: $7,400.00 to a cash kiosk operator at 11:06, $9,000.00 by P2P to four new recipients at two banks, and $1,500.00 onto a prepaid card at 11:45. $562.18 is left.
Which other accounts share his phone?
Two: Kiara Benning, holding $4,180.00, and Elias Montrose, holding $2,120.00. Both were opened in August from phone D-7F3A; Kiara also shares his address. Dana Brennan shares only a surname and an old address, so I left her out.
Could Tyler be a victim too?
Possibly at the start. On 20 October he asked us whether his "employer's" deposits were OK, and he was paid a $350.00 "training stipend". But one phone signs in to three accounts in three names. The typology agent says witting, 0.64. You decide.
What does the branch see on Tyler Brennan's account?
Only "Restricted", and a number to call Fraud Operations. Nothing about a report, an investigation or the BSA team appears on any branch, contact center or customer view.
13 screens from the working solution, on its sample data. Pick one to see it large.
The clocks, thresholds and reason codes the agents follow are settings. A change is proposed, and the Head of Fraud Strategy approves it; the proposer cannot.
| Setting | Default | Choose from |
|---|---|---|
| P1 · money moving | Freeze decision within 30 min | P2 money landed: first decision within 4 h; P3 dormant or slow pattern: 2 business days |
| Escalation | To the operations manager at 80% of the SLA | A request waiting for a checker over 15 minutes alerts every checker on shift |
| Link thresholds | Propose at 0.75; include in the freeze draft at 0.90 | Never on surname or protected characteristics alone |
| Mule type | "Unclear" below 0.70 | The investigator records the type; an override needs a code O1–O5 |
| Reason codes | Freeze F1–F5 · return R1–R4 | Close as not a mule N1–N6, with 10% sampled to the checker |
| Retention | Case records 5 years from closure | Referrals and SAR material 5 years from filing, restricted; device and login data 24 months |
| SAR access list | BSA Officer, FIU analyst, internal auditor (read only) | Sealed from the fraud team once a referral is sent |
| Masking | SSNs last four only, except for the BSA team | Dates of birth shown as ages; other banks' customers as initials in export packs |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate of where a mule review's working hours go · “typical” = published figures: FCA, “Firms crack down on money mules but need to do more”, September 23, 2026 (238,396 suspected mule accounts closed in 2025; cash-out usually between the second and fifth account), and FTC consumer fraud data for 2024, March 2025 ($12.5 billion). Rules: FinCEN Advisory FIN-2020-A003 (mule types); SAR timing and confidentiality, 31 CFR 1020.320; 314(b) information sharing, 31 CFR 1010.540; record retention, 31 CFR 1010.430; Nacha R17 returns. Corvane National Bank, the other banks, the companies and the people named on this page are fictional — characters and sample data in the working solution.
Money Mule Detection is software for bank and credit union fraud and AML teams that finds accounts moving scam proceeds, then prepares the freeze, the notices to the sending banks, the exit and the SAR referral for people to decide. Seven agents draw the money in and out of an alerted account, find sibling accounts on the same phone, address or senders, weigh the mule type and draft every notice and letter. An investigator decides, and a manager checks each freeze, notice, return and exit.
FinCEN describes a money mule as a person who transfers illegally acquired money on behalf of or at the direction of another. In banking, the mule account is where a scam victim's money lands before it moves on, often within minutes, through cash kiosks, P2P payments and prepaid cards. FinCEN distinguishes unwitting, witting and complicit mules, and the solution weighs all three.
The red flags for banks show up in the money and the devices together. In the working solution's sample case, three first-time senders aged 69 to 78 paid an 80-day-old student account, 97% of the money left within 47 minutes, and the same phone signed in to two more accounts. The flow agent and the link agent bring those signals onto one screen, each cited to its record.
The response can differ, so the decision is recorded. The typology agent weighs unwitting, witting and complicit with every signal cited and says "unclear" when no type reaches 0.70. The investigator records the type, and an override of the agent needs a reason code. The type never appears on a customer-facing record.
The investigator requests a freeze of every linked account with a reason code, and a different person approves it. The recovery agent drafts a notice to each sending bank, sharing full detail only with banks registered for 314(b), and proposes a return plan: traceable balances back in full, mixed money shared pro rata. A manager checks the notices and the plan before anything leaves.
The referral is sealed in the BSA team's restricted space with its 30-day clock, and only the SAR access list can open it. The exit agent's tipping-off check reads every letter, branch note, contact center script and app message, and the branch, the contact center and the customer see only a neutral status.
Yes. The agents trace, link, weigh, draft and record; they never freeze, move money, send notices, close accounts or file SARs. A person makes every decision, a different person checks it, and overriding an agent's proposal needs a reason code.
The Agentic Solution Engine builds and deploys it from your requirements and documents (your fraud policy, your reason codes, your letter and notice templates and a sample of past mule cases), and it goes live once every quality gate has passed. We will walk you through it on your own alerts first.
Takeover transfers held before they leave; the real customer called on a trusted number.
1-min demoAPP Fraud DetectionScam payments stopped mid-call, with every question and answer kept for the claim.
1-min demoElder Financial Exploitation DetectionEvery concern about an older member acted on the same day, with each step on the record.
1-min demoWe'll run Money Mule Detection on a sample of your own past mule alerts.