Money mule account detection tools, priced by the hour

A money mule account detection tool is software that helps a bank find accounts receiving and moving scam money, and the four kinds sold under the name do different jobs: screening at account opening, scoring transactions as they arrive and leave, tracing payments across banks, and assembling the case after an alert so a person can freeze what is left. The right way to compare them is by the clock. A mule account typically empties within the hour, so a tool is worth the minutes it removes between a credit landing and a freeze, and the money that is still reachable when the freeze lands. Botminds' Money Mule Detection is an agentic solution for the last of the four jobs: agents trace the money, find linked accounts and draft the freeze, notices and exit, and people decide. This guide prices that work, and says plainly what it does not replace.

What is a money mule account detection tool?

It is any product that flags an account as likely to be receiving and passing on criminal money. The UK Financial Conduct Authority, which reviewed one "widely used commercially available money mule account detection tool" in January 2025, described the kind it looked at: a tool that "can trace the proceeds of fraud across the Faster Payments System" and "provides regular alerts about suspected mules and a visual representation of the movement of funds" (FCA, January 2025). That is one of four kinds. Knowing which kind you are looking at tells you, before any demonstration, which minutes it can save.

Each kind fails in a known way. Onboarding checks cannot stop a mule who opened an honest account first: in the Federal Reserve Financial Services survey, 67% of institutions saw mule accounts belonging to legitimate customers who had been scammed (FRFS Risk Officer Survey, 2026; the survey says it is not independent academic research, with a margin of error of ±6%). Scoring that watches only outbound payments sees the mule as the money leaves; the FCA found some firms "focus on outbound transaction monitoring and do not have adequate inbound transaction monitoring" (FCA, 2023). Cross-bank tracing produces alerts that someone must work, and the FCA found firms paid less attention to alerts on accounts further down the chain. Case assembly needs an alert to start from and the bank's own feeds to read.

How fast can a mule account be detected?

Fast enough to matter only if inbound money is watched. The FCA found that firms which identified mule activity promptly relied on "unexpected or unexplained deposits", money spread across networks of accounts within minutes of arriving, transfers abroad and rapid ATM withdrawals (FCA, 2025). In the sample case above, the alert came 48 minutes after the last credit and one minute after the last payment out. A rule on the first large inbound wire to an 80-day-old account could have fired at 9:14.

Most banks are slower still. About half of the institutions in the Federal Reserve Financial Services survey said they identify mule activity only after losses (the report gives 51% in one place and 49% in another), and 53% said they find mule accounts when another institution alerts them. Detection in minutes is a design choice, and the money in the account is the measure of whether it worked. How money mules work follows the sample case minute by minute.

How much money is lost to mule accounts?

Nobody publishes a figure for money lost through mule accounts as such, because the loss is counted where the scam starts, not where the money lands. What is published shows the scale of what passes through them. US consumers reported losing more than $12.5 billion to fraud in 2024, and the FTC noted that "consumers reported losing more money to scams where they paid with bank transfers or cryptocurrency than all other payment methods combined" (FTC, March 2025). Every bank transfer among them landed in an account somewhere, usually at a bank or a payment firm.

Can a receiving bank be liable for mule losses?

In the UK, yes, directly: since 7 October 2024 the Payment Systems Regulator's mandatory reimbursement for authorised push payment scams has sending and receiving firms share the cost of reimbursement equally, up to £85,000 a claim, which for the first time puts part of the bill on the firms that hold the fraudsters' accounts (PSR). The regulator also publishes how much scam money each receiving firm takes in: in its data for January to October 2024, one firm received £3,132 of APP scam payments for every £1 million it received (PSR, APP fraud performance data).

In the United States the receiving bank's exposure runs through network rules, recall indemnities and its own supervisors rather than a reimbursement rule like the UK's. The network rules have moved: since June 2026 Nacha requires every RDFI to put in place risk-based processes and procedures for spotting credits sent as a result of fraud, and to review them at least once a year (Nacha; the guide to the 2026 Nacha rules quotes the text). For ACH credits, monitoring incoming money is no longer optional. For wires and P2P, it is still the bank's own judgment.

What does mule detection software cost, and how should you price it?

List prices are rarely published, so price the tool against what it changes: money still reachable when you freeze, hours your investigators spend per case, and, in the UK, the share of reimbursements you carry as the receiving firm. The formula below is the shape of that calculation. Each term is the bank's own number; the sample figures only show which term is large.

Put rough numbers on the hours term to see its size. Botminds estimates that a mule review assembled by hand takes 2 to 4 hours; with agents doing the pulling, linking and drafting, our modest estimate is about 40 minutes of a person's time. On the sample program's 44 confirmed mule accounts in three weeks, saving about 2.85 hours each is about 125 hours. At the median wage BLS publishes for the occupation group that includes fraud examiners, $38.99 an hour (O*NET, Financial Specialists, All Other, 2025; fraud examiners are not published separately), that is about $4,900 before benefits. In the same three weeks the sample bank froze $286,400. The hours pay for the work; the minutes pay for the tool.

Money moving now, ranked by what can still be stopped

How do you measure mule detection performance?

Measure it in money and minutes, not alert counts. A tool that raises more alerts may simply move work; a tool that raises the share of money still in the account when the freeze lands has changed the outcome. The FCA's 2023 review adds a discipline most banks skip: it found alerts that fired when their rule's conditions had not been met and others that stayed silent when they had, and asked firms to test that alerts fire as designed (FCA, 2023).

On the sample program's insights screen, for 1 to 22 October, the measures look like this: a 26-minute median from alert to freeze on the most urgent cases, against a 30-minute target and down from 41; $286,400 frozen, 27.8% of the $1.03 million that passed through confirmed mule accounts; $214,900 returned to sending banks, 75% of what was frozen; and 19 linked accounts found that held $96,200 of the money frozen. These are results on fictional sample data, shown to illustrate the measures, not a customer's results.

Measure the program in money and minutes

How to run a fair trial of a money mule account detection tool

Run it on your own closed cases, not the vendor's demonstration data, and score it on the clock. Pick a few weeks of alerts that include confirmed mules, cleared customers and cases your team argued about. Hold the outcomes back. For each confirmed mule, record when the first victim's money landed, when your alert fired, when the freeze landed and how much was still there. Then ask the tool to work the same alerts and compare four numbers: minutes from alert to a decision-ready case, share of inflow still reachable at that minute, linked accounts found that still held money, and genuine customers it would have restricted.

Test the drafts as hard as the detection. Every notice to a sending bank should match the payments system to the cent and respect each bank's 314(b) status; every customer letter should pass a tipping-off check. A tool that is right about the mule and wrong in a letter has created a different problem. The federal agencies' 2018 statement on innovation said pilot programs "should not subject banks to supervisory criticism even if the pilot programs ultimately prove unsuccessful" (Joint Statement on Innovative Efforts, 2018), though it was written for BSA/AML programs, so record the trial's design and results as carefully as its conclusion.

Build, buy, or staff the gap?

Some banks close the hour after the alert with people rather than software, and the UK regulator has encouraged it: "Some firms would benefit from having dedicated resource allocated to actively investigating mules", not only to detect mule accounts but to "work on notifications from other firms in a timely manner" (FCA, 2023). A dedicated team is the right answer where volumes are low. It stops scaling when alerts arrive in hundreds a week: the sample bank saw 962 mule alerts in the first 22 days of October, about 310 a week, of which 44 were confirmed.

Building in-house means owning four things: the feeds from payments, P2P, card, device and core systems; link rules that do not over-link households; drafts that respect 314(b) and SAR confidentiality; and the maker-checker trail an examiner will sample. Buying means checking that a product does all four on your data. Either way, price it on the minutes, because that is where the money is.

Where Money Mule Detection fits, and where it does not

It fits the receiving bank's hour after an alert. The agents walk every payment in and out across wire, ACH, P2P, card and cash, mark any leg a late feed hides, find the accounts sharing a device, address or senders, weigh the mule type, and draft the freeze request, the notice to every sending bank with its 314(b) status checked, the return plan, the neutral exit letters and the sealed referral for the BSA team. A manager approves each decision. The design target is that every sending bank receives a fraud notice and a return plan the same day.

It does not score accounts at opening, it is not a consortium database, and it does not trace payments through other banks' systems; it starts from the alerts your transaction monitoring raises and reads your own payments hub, P2P gateway, card processor, device data and core. It never freezes, moves money, sends a notice, closes an account or files a SAR. If your problem is that alerts never fire, fix the scoring first; our guide to how mule accounts are detected covers that decision, and mule account detection using machine learning sets out which tasks a model should take.

Questions people ask

What is the best money mule account detection tool?

The one that closes the gap your bank actually has. If alerts arrive late, the gap is inbound monitoring; if alerts arrive on time but the money is gone before anyone acts, the gap is the hour of tracing, linking and drafting after the alert. Test any tool on your own past cases and compare the share of money still reachable when the freeze lands.

Is a mule detection tool required by regulation?

No rule requires a particular tool. For ACH, Nacha now requires every RDFI to have risk-based processes to identify credits initiated due to fraud, reviewed at least annually. In the UK, the receiving firm pays half of each APP reimbursement, which gives it a direct financial reason to detect mules early.

How many mule accounts do banks close?

UK figures are the most complete: 35 firms surveyed by the FCA offboarded 238,396 suspected mules in 2025 and 656,600 customers over 2023 to 2025. Nearly half of suspected mule accounts closed in 2025 were closed within a year of opening. No comparable US figure is published.

Does a mule detection tool replace transaction monitoring?

Usually not. Most mule tools either feed transaction monitoring with better signals or work the alerts it raises. Money Mule Detection takes alerts from the bank's transaction monitoring system and does the case work after them.

What is the UK receiving bank reimbursement share?

Half. Under the Payment Systems Regulator's rules in force since 7 October 2024, sending and receiving firms split the cost of reimbursing APP scam victims 50:50, up to £85,000 per claim, with an exception for complicit claimants and a gross-negligence exception that does not apply to vulnerable consumers.