How to report a money mule: who waits on whom after the freeze

How to report a money mule depends on who is reporting. A person who suspects they are being used as one should stop moving money, keep every message, tell their bank and file a complaint with the FBI's Internet Crime Complaint Center (IC3). A bank that finds a mule account owes more: a suspicious activity report (SAR) to FinCEN within 30 days, an answer to every bank whose customer sent the money, and, where it is registered, information shared with other banks under section 314(b). Each report runs on its own clock and each party waits on another, while the money keeps moving. Botminds' Money Mule Detection is an agentic solution for the receiving bank: agents trace the money, find linked accounts and draft the freeze, the sending-bank notices and the sealed SAR referral, and people decide each one.

The hard part is not knowing where to report. It is that the reports depend on each other. The sending bank cannot recover its customer's money until the receiving bank answers; the receiving bank cannot answer well until it knows which of its accounts hold the money; the BSA team cannot write the SAR until the fraud team's evidence reaches it; and law enforcement can freeze the next hop only if someone gives it the details. The figure below sets out the five parties and what each is waiting for.

How do I report a money mule account?

If you think your own account is being used, the FBI's advice is direct. Its public service announcement on money mules tells people to stop communicating with the suspected criminal, stop transferring funds, keep receipts and messages, tell their bank or payment provider and report to IC3 at ic3.gov (FBI, I-120321-PSA). The same notice is blunt about the stakes: a mule can face prison, a fine or community service even without knowing what the money was. Reporting early is the best evidence that someone was deceived rather than complicit; our page on the unwitting money mule follows what happens to that customer's account.

If you are a victim who sent money to a mule, the order is the reverse: call your own bank first and ask for a recall, then file with IC3. The FBI's 2025 report puts it plainly: "If you discover a fraudulent transfer, time is of the essence," and it asks victims to include "the full transaction details" so that IC3 can help freeze funds (IC3 2025 Annual Report).

If you are a bank that has found one, reporting is a set of obligations and options with different owners, and the rest of this page is about them.

Who do banks report money mules to?

Banks report money mules to FinCEN through a SAR, to the sending banks through fraud notices and return requests, to other registered institutions under 314(b), and, through their customers, to IC3. Only the SAR is mandatory, and it is confidential. The others are what get money back.

The sending bank waits on the receiving bank

The sending bank's recall is only as fast as the receiving bank's answer. Nacha's 2024 rules let an ODFI ask an RDFI to return an ACH entry "for any reason", leave the return at the RDFI's discretion, and add one hard obligation: the RDFI must advise the ODFI of its decision "within ten (10) banking days of receipt of the ODFI's request" (Nacha). Ten banking days is a ceiling, not a target. A mule account that keeps the money for ten days was never a mule account.

The faster tool is the receiving bank's own return. Since October 2024 Nacha has allowed, but not required, an RDFI to use return code R17 for an entry it believes is fraudulent, inside the standard two-banking-day return window (how the code works is in Nacha false pretenses). Since June 2026 every RDFI must also have written, risk-based procedures for spotting incoming ACH credits sent as a result of fraud (Nacha, Fraud Monitoring Phase 2). Both apply to ACH only; a wire or a P2P payment comes back through a recall and an indemnity.

In practice the wait is long because nobody answers. In the Federal Reserve Financial Services risk officer survey, a large community bank described being "unable to contact the receiving depository financial institution [RDFI] or originating depository financial institution [ODFI] in [a] timely manner", and 53% of institutions said they identify mule accounts when another institution alerts them (FRFS Risk Officer Survey, 2026; the survey says of itself it is "not independent academic research", with a margin of error of ±6%). The UK regulator found the same problem from the other side: "some firms in receipt of fraudulent funds are not responding swiftly enough to alerts from notifying institutions" (FCA, October 2023).

What is the FBI Financial Fraud Kill Chain?

The Financial Fraud Kill Chain is the FBI's process for asking banks to freeze money that a fraud victim has just sent. IC3's Recovery Asset Team, set up in 2018, takes the victim's complaint and contacts the receiving bank, and it will go beyond the first receiving bank when the complaint carries details of "second hop" transactions to other accounts (IC3 2025 Annual Report). In 2025 it worked 3,900 incidents and froze $679 million of $1.16 billion reported stolen.

For the receiving bank the Kill Chain arrives as a request, and its value depends on what the bank can say back within the hour: whether the money is there, where it went if not, and which other accounts look the same. The report notes that a single account-takeover incident can now send 50 or more ACH payments at once, to recipient accounts at many banks. No one answers that from memory. Our page on money mule networks follows the second hop.

How fast must a bank file a SAR on a money mule?

A bank must file a SAR within 30 calendar days of first detecting facts that may justify one, and may take up to 30 more days to identify a suspect if none was identified at detection (31 CFR 1020.320(b)(3)). For fraud, the bank regulators' rules require a filing once violations add up to $5,000 with a suspect identified, and at $25,000 whether or not one is (12 CFR 21.11(c), the OCC's version). A mule account that took in $18,400 in one morning, with its holder known, is past the first line before lunch.

The clock starts at detection, which is the fraud team's alert, not the day the BSA team hears of it. Every hour the referral spends in an inbox comes out of the BSA Officer's 30 days. The supporting documentation counts too: a bank keeps it five years and the rule treats it as filed with the SAR itself. FinCEN's 2020 mule advisory asked filers to use the key term "COVID19 MM FIN-2020-A003" and to select field 34(z), "Fraud - other", for pandemic-era mule schemes (FinCEN Advisory FIN-2020-A003), which is why a SAR on a mule account is usually filed as fraud even though the activity is also laundering. Money mule vs money laundering explains why both teams own a part of it.

Confidentiality runs the other way. No bank may disclose a SAR, or anything that would reveal that one exists (31 CFR 1020.320(e)). A joint statement from the Federal Reserve, FDIC, FinCEN, NCUA and OCC on September 2, 2026 confirmed what that does not forbid: telling a customer that a restriction or closure "may be related to suspected fraud or other suspicious activity", asking about the source of funds, and discussing "transaction dates, amounts, and parties" with other banks (Joint Statement on SAR Confidentiality, 2026). The notice to a sending bank can carry the money; it cannot carry the SAR.

What is 314(b) information sharing, and can banks share information about mule accounts?

Section 314(b) of the USA PATRIOT Act lets registered financial institutions share information with each other under a safe harbor from liability, and yes, it covers mule accounts. FinCEN's fact sheet of June 12, 2026 says fraud offenses are predicate crimes for money laundering, so "if a financial institution or association of financial institutions suspects that the information involves a fraud offense (or any other SUA)" the safe harbor applies. It names money mules directly: institutions may share information "about attempts to induce others to engage in transactions, such as in a money mule scheme" (FinCEN Section 314(b) Fact Sheet).

The conditions are mechanical and easy to miss under time pressure. Each institution files a notice with FinCEN that is effective for one year, and before sharing it "must take reasonable steps to verify" that the other institution has filed one too (31 CFR 1010.540(b)(2)–(3)). The fact sheet adds that sharing may happen in real time, in writing, verbally or on platforms, and may include device identifiers, IP addresses and clusters of accounts opened with the same or near-identical identifying details. What it never allows is sharing the SAR itself.

Use is thin. In the Federal Reserve Financial Services survey, 23% of institutions were not enrolled in 314(b) in 2025, 14% were enrolled but shared nothing, 46% shared case by case and 18% shared regularly (FRFS, 2026). A notice that has to wait for someone to look up registration is a notice that goes out tomorrow.

Money Mule Detection drafts one notice per sending bank and checks what each may be told

What happens after a mule account is reported?

After a report, four things usually happen in parallel: the receiving bank restricts or freezes the account, the sending banks receive whatever can be traced back, the BSA team decides on the SAR, and the account holder is exited or, if deceived, sometimes kept under restriction. Banks choose differently: in the Federal Reserve Financial Services survey, 58% of institutions suspended mule accounts for review and 34% left some open while filing SARs (FRFS, 2026).

Law enforcement's side is mostly warnings, then prosecution for those who carry on. In the 2024 Money Mule Initiative, agencies served about 2,970 warning letters on people whose accounts were helping fraud schemes, and charged more than 20 people "for knowingly receiving and forwarding victim funds or otherwise laundering fraud proceeds" (U.S. Department of Justice, May 10, 2024). What those letters say, and what a bank's own warning should say, is the subject of the money mule warning letter.

The SAR clock is 30 days, the ACH answer is ten banking days, and the money in a mule account leaves in minutes. The only clock that matters for recovery is the one nobody wrote down.

The hand-offs in one sample case in Money Mule Detection

Take a sample case as it runs through Money Mule Detection, on a fictional bank and fictional people. An Everyday Checking account at Corvane National Bank receives $18,400.00 from three retirees at three other banks between 9:14 and 10:58 a.m., and $17,900.00 has left by 11:45. The transaction monitoring system alerts at 11:46. Here is who waited on whom.

By 11:49 the agents had traced every leg, found two more accounts signing in from the same phone and still holding $6,300.00 sent the day before by two more retirees, and drafted notices to the three sending banks. At 11:52 one sending bank's recall arrived, and the recovery agent matched it to the case so that the notice to that bank answers it. The investigator requested a freeze of all three accounts at 11:58, sent the notices to the checker at 12:00 and sealed the referral to the BSA team at 12:02, with its 30-day clock shown to 21 November. The fraud operations manager approved the freeze at 12:04 and the notices at 12:05.

Nobody waited on a phone call. The sending banks had their answer the same day, the BSA Officer had the referral 16 minutes after the alert, and the branch saw only "Restricted".

The referral is sealed; the branch sees a neutral status

What a good report to a sending bank contains

A good notice to a sending bank answers the questions its fraud team will ask next, so that it can call its customer and send its recall in one step. The checklist below is what the 2026 joint statement allows a bank to share and what Nacha's return process needs, in the order the other bank reads it.

What the agents in Money Mule Detection do and never do, from tracing the money to sealing the referral, is set out on the Money Mule Detection page. The rules above are the bank's; the solution's job is to make each hand-off ready before anyone has to ask for it.

Questions people ask

How do I report a money mule account if I think mine is being used?

Stop moving money and stop talking to the person directing you, keep every message and receipt, and tell your bank. Then file a complaint with the FBI at ic3.gov. The FBI warns that mules can face prison, fines or community service "even if unwitting", so reporting early matters.

Does a bank have to answer a recall from another bank?

For ACH, yes in part: under the Nacha Operating Rules the RDFI decides whether to return the entry, but it must tell the ODFI its decision or the status of the request within ten banking days. For wires and P2P payments, recalls run on network rules and indemnities, and the answer is a matter of practice rather than a federal deadline.

Does a bank have to file a SAR on every money mule?

It must file when the activity meets the SAR rules: for fraud, $5,000 or more with a suspect identified, or $25,000 or more regardless. FinCEN's October 2025 FAQs add that there is no requirement to document a decision not to file, though a fraud team still documents its own freeze and exit decisions.

Can a bank tell the sending bank that it filed a SAR?

No. Section 314(b) lets registered banks share information about suspected fraud, including device and account details, but FinCEN's fact sheet says it "does not authorize financial institutions to share SARs or reveal their existence". Banks that both participate may file a joint SAR and discuss that one.

Who should report first, the victim's bank or the mule's bank?

Whoever knows first. The victim's bank usually learns first and sends a recall; the mule's bank often learns first from its own monitoring and should notify the sending banks the same day. In the Federal Reserve survey, 53% of institutions said they find mule accounts when another institution alerts them.

Is reporting a mule to IC3 the same as filing a SAR?

No. IC3 takes complaints from victims and the public and runs the Financial Fraud Kill Chain; a SAR is a confidential filing by the bank to FinCEN under the Bank Secrecy Act. A bank files the SAR; it encourages its customer, the victim, to file with IC3.