Money mule networks are groups of accounts, usually controlled or directed by the same people, through which scam proceeds are passed until they can be cashed out. A victim pays the first account; within minutes the money moves to second-generation accounts, often at other banks, and then on again. The UK Financial Conduct Authority traced 140 fraud cases through such chains in 2025 and found that most of the cash-out happened between the second and the fifth mule account, and most often at the second. A bank that sees only its own alerted account sees one node of that network. Botminds' Money Mule Detection is an agentic solution that, from one alert, finds the other accounts sharing a device, an address, a phone or the same senders, each link with its evidence, and drafts the notices that let other banks act on the next hop. A person confirms every link.
One sample mule network: three accounts on one phone, six second hops
How do money mule networks work?
A network works by spreading one victim's money across enough accounts, banks and forms that no single institution sees the whole movement. The FCA's 2026 findings describe the pattern: criminals "moved fraudulent funds through multiple accounts, usually cashing out between the second and fifth account. By this stage, funds had been broken into smaller, less conspicuous payments, making them harder to detect and trace" (FCA, September 2026). They are also reused: "Some accounts had been used multiple times for mule activity before firms shut them down", across different fraud types, which "suggests an established criminal infrastructure rather than isolated or opportunistic misuse".
Networks are run by people the UK calls herders. The FCA's 2023 review found firms onboarding customers where "multiple customers are using the same device with no clear reason", which it called "a typical mule characteristic where the customer may have sold on their account details to a 'mule herder' who now has control of their account", and multiple customers at one address (FCA, 2023). US prosecutions show the scale one organizer can reach: in a case charged in 2023, a defendant was alleged to have "opened approximately 80 bank accounts (purportedly on behalf of 65 different companies), laundering approximately $35 million" (U.S. Department of Justice, 2023).
What is a second hop in a fraud?
The second hop is the payment out of the first receiving account into the next one, and it is where recovery usually stops. The FBI's Recovery Asset Team, which asks banks to freeze money for fraud victims, will carry its freeze requests past the first receiving bank when the victim's complaint carries details of "second hop" transactions (IC3 2025 Annual Report). The FCA calls the same thing generations: "First-generation mules receive money directly from the fraud victims, the subsequent recipients are referred to as second-generation mules, and so on" (FCA, January 2025).
Banks tend to stop at the first generation too. Reviewing a widely used mule detection tool, the FCA found "most firms investigated alerts relating to funds arriving into suspected mule accounts at the first generation; however, they were less responsive to alerts that fired at later generations, despite the presence of clear risk factors". A second-hop alert is an alert about an account that has not yet received a victim's money directly, which is exactly why it is the last chance to stop it.
The second hop in the FBI's freezes
3,900
Financial Fraud Kill Chain incidents in 2025
Domestic and international
58%
of $1.16 billion attempted was frozen
50+
transactions to accounts at multiple banks in some account-takeover incidents
How big are money mule networks?
No one measures a network's size directly, but the counts of mules are large. UK firms surveyed by the FCA offboarded 656,600 customers as suspected mules between 2023 and 2025 (FCA, 2026). US law enforcement reported "over 12,000 actions" against mules across its first five campaigns, and in one charged case a single defendant "opened 11 bank accounts at seven separate financial institutions" (U.S. Department of Justice, 2023).
Suspected mules offboarded by 35 UK firms, by year
How do banks find money mule rings?
They find rings through what the accounts share. The useful links are a device or phone signing in to accounts in different names, a shared address or home network, the same senders paying several accounts, and the same new payees receiving from several accounts. FinCEN's 314(b) fact sheet of June 12, 2026 lists the same kinds of evidence among what banks may share with each other, including "device identification numbers", "cyber-related data (such as IP addresses and geolocations)" and "multiple accounts with the same or similar identifying information" (FinCEN Section 314(b) Fact Sheet).
The FCA asks UK firms to look past the first account: "Firms should consider indicators beyond the initial receiving account, including linked accounts within the institution, payment characteristics, the broader transaction context, and customer" (FCA, 2026). In the sample network above, the two linked accounts were opened eight and six days after the first, from the same phone, and held money sent the previous afternoon by two more retirees. Without the link, the freeze would have held $562.18. With it, it held $6,862.18.
Who shares what with the alerted account
How do you link mule accounts without over-linking?
Link on evidence of shared control, score each link, and write down why a weak one was left out. Households, students in shared flats and relatives share addresses and sometimes devices for innocent reasons; the FCA's advice is to check whether the explanation is "genuine, such as being members of the same household" (FCA, 2023). Links should never rest on a surname or a protected characteristic. A frozen account that belonged to a mule's grandmother is a harm the bank caused.
Evidence that links mule accounts, and evidence that does not
- Strong: one device or phone, many accounts in different names
Especially with many logins and accounts opened days apart.
- Strong: the same senders, or the same new payees
Victims paying several accounts, or several accounts paying one payee.
- Supporting: a shared address or home network
Weighed with something else; on its own it fits a household.
- Supporting: opened close together, similar first activity
Timing tells you about a recruiter’s batch, not about knowledge.
- Not a link: a surname, a family tie, an old address
Show it, score it, leave it out, and say why.
- Never a link: a protected characteristic
Nationality, ethnicity or age alone are not evidence of control.
Can banks share data about money mule networks?
Yes. Section 314(b) lets registered US financial institutions share information about suspected fraud and money laundering under a safe harbor, and FinCEN's 2026 fact sheet names money mule schemes and says sharing may happen "in real time as activity is occurring" (FinCEN, 2026). Each institution's notice to FinCEN lasts one year, and before sharing a bank has to take reasonable steps to check that the other has filed one (31 CFR 1010.540). In the UK, the FCA points firms to the information-sharing provisions of the Economic Crime and Corporate Transparency Act 2023.
The permission is wider than the practice. In the Federal Reserve Financial Services survey, fewer than one in five institutions shared under 314(b) on a regular basis.
How US institutions use 314(b) to share fraud information
2024
- Not enrolled · 27%
- Enrolled, share nothing · 16%
- Case by case · 44%
- Regularly · 13%
2025
- Not enrolled · 23%
- Enrolled, share nothing · 14%
- Case by case · 46%
- Regularly · 18%
What is network analysis in fraud, and what can it not see?
Network analysis treats accounts, devices, addresses and payments as a graph and looks for structures no single account shows: clusters on one device, fans of payments out to new payees, many senders converging on one account. Its limit is the edge of the data. A bank's graph ends at its own customers; the four P2P payees in the sample network sit at two other banks and are invisible to it except as names and amounts.
Networks also have memory, if someone keeps it. In April 2025 the FBI's Recovery Asset Team, handling a $6 million business email compromise against an Oregon city office, found that the same recipient account had been the subject of an earlier freeze request in March. Because of that earlier notice and freeze, the receiving bank alerted the sending bank, which recalled the $6 million wire (IC3 2025 Annual Report). One flagged account stopped a second fraud.
The third hop is where the money disappears
By the third account the money is usually leaving the banking system. The FCA found that card payments were the commonest way to cash out, crypto cash-outs "lower in volume but larger in value", and that recurring destinations abroad "included South Asia, West Africa and the Middle East" (FCA, 2026). A network is stopped, if at all, at the first or second hop. That is why the receiving bank's notice to the other banks, the same day, with the payees and amounts, is part of detecting the network rather than an afterthought. Who owes which report, and by when, is in how to report a money mule.
Notices that let the other banks act on their side of the network
Following a money mule network with Money Mule Detection
In Money Mule Detection, one alert opens the network. The link agent looks for every account sharing a device, an address, a phone, an email, senders or recipients with the alerted one, and proposes each link with its evidence and a confidence under versioned link rules. It proposes at 0.75, drafts an account into a freeze only at 0.90, and never links on a surname or a protected characteristic alone. In the sample case it proposed the two accounts on phone D-7F3A at 0.96 and 0.91 and showed the relative at 0.22, left out with the reason.
The FIU analyst then merges related alerts into one case, so that one ring is worked once: in the sample, alerts A-77213, A-77215 and A-77216 became a single case with one deadline. The freeze covers every included account in one request, the recovery agent drafts a notice to every bank whose customers sent money in, and the exit agent puts re-open guards on the name and SSN, the phone and the address, so the same network cannot simply open the next account. Over the sample program's first three weeks of October, the link agent found 19 sibling accounts that held $96,200 of the money frozen, with a link precision of 0.94, on fictional data.
How graphs compare with rules, scores and agents as a detection method is in how mule accounts are detected; the minute-by-minute movement through the sample network is in how money mules work. The agents' limits, including never linking on a surname, are on the Money Mule Detection page.
Questions people ask
What is a money mule herder?
A herder recruits and controls mules, often holding their account details or devices. The FCA describes customers who have sold their account details to a herder, who then controls the account, which is why one device signing in to many accounts is a strong sign of a network.
How many accounts are in a money mule network?
It varies from a handful to dozens. The FCA found cash-out usually happens between the second and fifth account, and US prosecutors have charged individuals with opening 11 accounts at seven institutions and, in another case, about 80 accounts for 65 companies.
Can one bank see a whole mule network?
Rarely. Networks deliberately cross institutions. A bank sees its own customers and the names and amounts of payments to others; the rest needs 314(b) sharing, the sending banks' cooperation or law enforcement's Financial Fraud Kill Chain.
Do banks share information about money mule accounts?
They may, under 314(b) in the US, and FinCEN's 2026 fact sheet explicitly covers money mule schemes. In practice, the Federal Reserve survey found 23% of institutions not enrolled in 2025 and only 18% sharing regularly.
How do you stop a money mule network?
Freeze every linked account that still holds money, notify every bank on both sides the same day, refer the network to the BSA team as one case, flag devices and addresses against re-opening, and keep the network's details so the next alert on one of its accounts is recognized at once.