Money mules work by lending a criminal their bank account. A scam victim is told to pay an account that looks ordinary, because it is: a real person's account at a real bank. Within minutes the mule sends the money on, to other accounts, to a cash machine, onto a card, until it has been split and moved enough times that it cannot be traced or recovered. The UK Financial Conduct Authority found criminals usually cash out somewhere between the second and the fifth account in the chain. For the bank holding the first mule account, the problem is time: everything that can be stopped is stopped in the first hour. Botminds' Money Mule Detection is an agentic solution for that bank, and the sample case below, run through it on fictional people and a fictional bank, follows one morning minute by minute.
The account belongs to a twenty-year-old student at Corvane National Bank, opened online 80 days earlier, with about $1,140 a month of part-time wages coming in. Two days before, he had asked the bank whether his new employer's deposits were all right.
One morning in a money mule account, minute by minute
- Arriving from three retirees9:14–10:58
- Leaving47 min
- Left$562
- No alert yet9:14–11:46
- To freeze18 min
- Unaware9:14–11:52
- Recall11:52
How do money mules work?
The FBI defines a money mule as "Any individual who transfers funds, on behalf of, or at the direction of another", and lists the routes the money takes: cryptocurrency, cash, "Bank transfers (wires, ACH, EFT)", money services businesses and "Pre-paid cards" (FBI, I-120321-PSA). The scheme has three parts. A recruiter finds someone with a clean account, usually through a job offer, a romance or an appeal for help. A scam sends victims' money into that account. And the mule moves it on, keeping a cut or a "stipend", on instructions that arrive by message.
Criminals use mules because a real account, held by a real person with a real history, passes checks that a criminal's own account would not, and because every extra account makes the money harder to follow. The FCA's enforcement director put the effect plainly: muling "makes it harder to recover stolen cash and helps criminals move and hide the proceeds of serious offending" (FCA, September 2026).
9:14 to 10:58: how the money arrives
At 9:14 a $9,500.00 wire arrives from a 78-year-old man at another bank, with the memo "PAYMENT FOR SERVICES". At 10:02 a 71-year-old woman sends $3,400.00 by P2P from a third bank. At 10:58 a 69-year-old man's same-day ACH credit of $5,500.00 lands from a fourth. Three first-time senders, three retirees, three payment systems, $18,400.00 in an hour and 44 minutes, into an account that usually receives $1,140 a month.
This is the pattern FinCEN told banks to look for in 2020: a personal account that "starts to receive transactions that do not fit his or her transactional history profile" and that "generally had a low balance until the customer became involved in a money mule scheme" (FinCEN Advisory FIN-2020-A003). Each credit, alone, is unremarkable. Together, and against the account's history, they are the clearest moment in the case, and the one most monitoring misses: the FCA found firms that watched money going out closely and money coming in barely at all. Since June 2026, Nacha has required every receiving bank to have risk-based processes to spot ACH credits sent as a result of fraud; the wire and the P2P payment sit outside that rule.
The money flow: three retirees in, six payments out, the exit time first
How fast do money mules move funds?
In this case, all of it within 47 minutes of the last credit. At 11:06, eight minutes after the ACH credit landed, the account holder takes $7,400.00 from a cash kiosk, in person, with chip and PIN. At 11:12, 11:19, 11:27 and 11:33 four P2P payments of $2,000.00 to $2,500.00 go to four new recipients at two banks. At 11:45 the last $1,500.00 goes onto a prepaid card. $562.18 is left, of which $500.00 is the morning's money.
That speed is typical rather than extreme. Reviewing UK firms in 2025, the FCA described "rapid dispersal of funds through networks of accounts, often within minutes of receipt" among the signs firms used to catch mules early (FCA, January 2025). Its 2026 analysis found card payments "the most common cash-out method", used "to make lots of low-value transactions, or higher-value payments to local businesses and retailers", which look like ordinary spending (FCA, September 2026).
The sample case in three numbers
47min
for $17,900.00 to leave the account after the last credit landed
1min
between the last payment out and the monitoring alert
$6,862
still reachable at the alert: $562 here and $6,300 in two linked accounts
How are money mules paid?
Mules are usually paid a cut of what they move or a small up-front payment that makes the "job" feel real. FinCEN's advisory describes the work-from-home version: the target "earns money by taking a percentage of the funds that he or she helps to transfer per the instructions of the 'employer'" (FinCEN Advisory FIN-2020-A003). In a case charged in 2023, a man who processed payments for a tech support fraud was alleged to have received "3% of the revenue in return" (U.S. Department of Justice, 2023).
In the sample case the hook was a $350.00 "training stipend" from a staffing company eight days earlier. The pattern matched five of six markers of a remote payment processing job in the bank's library: a job that pays you to receive and send money, a small up-front payment, instructions to move money fast and often in person, cash kiosks, P2P and prepaid cards to cash out, and accounts opened for "colleagues" on the same phone. Whether the student knew is a separate question; the unwitting money mule takes it up.
What is a second hop transfer?
A second hop is the transfer out of the first mule account into the next one. In the sample case the four P2P recipients at two banks are second hops; if they in turn send the money on, those are third hops. The FCA calls them generations: "First-generation mules receive money directly from the fraud victims, the subsequent recipients are referred to as second-generation mules, and so on" (FCA, 2025).
The second hop matters because recovery stops there unless someone follows it. The FBI's Recovery Asset Team will extend a freeze request beyond the first receiving bank when the details of "second hop" transactions are supplied (IC3 2025 Annual Report), and the FCA found that most cash-outs fall between the second and fifth mule account, most often at the second (FCA, 2026). Our page on money mule networks follows the second hop.
11:46: why the alert came one minute too late
The transaction monitoring alert fired at 11:46, one minute after the last payment out. That is not a failure of one rule; it is what monitoring built around outgoing money produces. By the time outflows look abnormal, they have happened. In the Federal Reserve Financial Services survey, only 28% of institutions screened received transactions in real time, and about half said they identify mule activity only after losses (FRFS Risk Officer Survey, 2026; the report gives 51% in one place and 49% in another, says it is not independent academic research and puts its margin of error at ±6%).
The money arrived over an hour and 44 minutes and left in 47. The alert arrived in the 48th minute. Almost everything the bank could still freeze was money that had arrived the day before.
11:46 to 12:05: what the receiving bank could still do
Quite a lot, because the account was not alone. In the three minutes after the alert the agents in Money Mule Detection traced all nine legs, found two more accounts signing in from the same phone (41 and 27 logins), opened in August days after the first, holding $4,180.00 and $2,120.00 sent the previous afternoon by two more retirees, aged 74 and 77, and drafted a notice to every sending bank. Then people took over.
What the bank could see, and do, at each minute after the alert
| Time | What the bank could see | What it did |
|---|---|---|
| 11:46 | The alert on an account already emptied | The case was assigned; agents began tracing |
| 11:49 | Every leg in and out; two linked accounts holding $6,300.00; the mule type weighed | Agents drafted notices to three sending banks and a return plan |
| 11:52 | A recall from one sending bank for its customer’s $3,400.00 | The recall was matched to the case and the notice to that bank rewritten to answer it |
| 11:58 | $6,862.18 still reachable across three accounts | The investigator requested a freeze of all three, reason code F2 |
| 12:00–12:02 | Notices, return plan and exit drafted; tipping-off checks passed | Sent to the checker; the referral to the BSA team sealed |
| 12:04–12:05 | The evidence behind each request | The fraud operations manager approved the freeze, then the notices |
One freeze request covers the whole network
Who the money belonged to
Five people sent money into the three accounts in this sample network, aged 69, 71, 74, 77 and 78. That is the usual shape. The Justice Department describes mules as receiving money "from victims, many of them elderly", and in 2025 the FBI's complaint center recorded 201,266 complaints from people aged 60 and over, with $7.7 billion in reported losses (IC3 2025 Annual Report). Of the 3,900 freeze requests its Recovery Asset Team made in 2025, 642 involved victims aged 60 or over, and it helped freeze $32,865,655 of their $65,367,648 in reported losses.
For the receiving bank this changes the conversation about its own customer. The account holder may be a victim of a fake job; the senders are victims of something worse, and some of them may still be talking to the person who deceived them. In the sample case, the notice to one sending bank ends: "Please contact Ms. Mercer: she may still be in touch with the person who deceived her." A mule case is the receiving bank's best chance to warn a victim's bank before the next payment.
How do money mules get caught?
Mostly late, and often because someone else raised the alarm. In the Federal Reserve Financial Services survey, 53% of institutions said they identify mule accounts when another institution alerts them, and when that happens the most frequent trigger is a check deposit (41%) followed by a wire clawback (20%) (FRFS, 2026). Law enforcement catches them in campaigns: the US Money Mule Initiative announced in December 2019 took action against more than 600 mules in over 85 federal districts, interviewed more than 550 people and served over 500 warning letters (U.S. Department of Justice, 2019).
Mules are also caught by their own repetition. The FCA found accounts that had been used for mule activity several times before firms closed them, a sign of standing criminal infrastructure rather than one-off misuse (FCA, 2026). An account found once, with its device and address, is how the next one is found.
What happens to the money a mule receives?
Whatever can be traced goes back to the victims' banks; the rest is usually gone. In the sample case, the balances in the two linked accounts traced one to one to the retirees who had sent them, so $4,180.00 and $2,120.00 go back in full, the second as an ACH return. The $500.00 left of the morning's money was mixed, so it is shared in proportion to what each of the three senders paid in: $258.15, $92.39 and $149.46. The account holder's own $62.18 goes to him by official check when the account closes. In all, $6,800.00 of $24,700.00 sent by five people goes back, after the freeze is approved and each sending bank confirms its recall.
The return plan: traceable money back in full, mixed money shared pro rata
Every minute in this morning had a price. How to turn those minutes into a business case for a tool is in money mule account detection tools, priced by the hour; how the agents divide the work, and what they never do, is on the Money Mule Detection page.
The first ten minutes after a mule alert
- Find out what is still there, and where
In this account, in accounts on the same device or address, and with the same senders.
- Freeze every linked account in one request
With a reason code a checker can test against the evidence.
- Tell every sending bank the same day
Amounts, times, what is frozen and what you propose to return.
- Answer recalls already waiting
A victim’s bank may have asked before your alert fired.
- Start the SAR clock at the alert
Thirty calendar days from initial detection, for the BSA team.
- Say nothing to the customer yet that reveals a report
A neutral restriction now; a considered conversation or exit later.
Questions people ask
How do money mules move money?
By whatever leaves the banking system fastest: P2P payments to more mules, cash withdrawals, prepaid and debit card spending, wires abroad and cryptocurrency. The FCA found card payments the most common cash-out method in the cases it traced, often as many small purchases that resemble ordinary spending.
Why do criminals use money mules instead of their own accounts?
A mule's account belongs to a real person with a real history, so it passes checks, and each extra account puts another layer between the victim and the criminal. Many of the organizers are abroad: the Justice Department describes mules forwarding proceeds to "foreign-based" perpetrators.
Can money sent to a money mule be recovered?
Sometimes, if the receiving bank freezes it before it moves. The FBI's Financial Fraud Kill Chain froze $679 million of $1.16 billion reported in 2025, and the FBI's advice to victims is that "time is of the essence". Money that has reached a third or fourth account, or left as cash, is rarely recovered.
Do money mules know they are money mules?
Many do not, at first. The FBI distinguishes unwitting, witting and complicit mules, and says witting mules "generally begin as an unwitting mule". In the Federal Reserve survey, 67% of institutions had seen mule accounts belonging to legitimate customers who had been scammed.
How long does a money mule scheme last?
Often only until the account is closed, then the network moves to another. The FCA found accounts used repeatedly before firms shut them down, and nearly half of suspected mule accounts closed by UK firms in 2025 were closed within a year of opening.