Money Mule Detection

The money mule warning letter: what it says and when to send it

A money mule warning letter tells someone that the money moving through their account is likely scam proceeds and what happens if they continue. Law enforcement has sent thousands; banks may send their own, and a dated warning is what later shows a customer knew. Botminds' Money Mule Detection keeps every customer letter checked, approved and on file.

Updated · 12 min read

A money mule warning letter is a written notice telling a person that money passing through their account appears to come from fraud, that moving it for someone else is a crime, and what will happen if they continue. US law enforcement sends them by the thousand: in its 2021 campaign, agencies "served approximately 4,670 letters warning individuals that their actions were facilitating fraud schemes". Banks can send their own, and since a joint statement of September 2026 there is little doubt they may. For a fraud team the letter matters twice: it may stop a deceived customer, and if it does not, it is the dated evidence that the customer was told. Botminds' Money Mule Detection, an agentic solution for mule cases, does not write warnings, but every letter it drafts is checked for tipping off, approved by a second person and kept on an append-only trail, and the same discipline belongs on a warning.

A money mule warning letter, line by line

122 October 2026 · sent by post and to your secure inbox

1The date and the channel are the point. A warning nobody can prove was sent cannot later show that the customer knew.

2We have restricted your Everyday Checking account ending 4417. You cannot send money from it, use its card or withdraw cash until we have spoken with you.

2Allowed: the 2026 joint statement lists telling a customer about a restriction that “may be related to suspected fraud”.

3Your account received payments this week from people you do not appear to know. Criminals often ask people to receive money for a “job” or a friend and send it on. The money usually comes from victims of scams. This is called being a money mule.

3Allowed and encouraged: information about “known ‘money mule’ schemes”. Describe the scheme, not the bank’s suspicion of the customer.

4Please do not move any more money for anyone, and stop replying to the person who asked you to. Keep every message and receipt.

4The FBI’s own advice to people who think they are being used.

5Moving money for someone else in this way can lead to your accounts being closed, difficulty opening accounts in future, and prosecution, even if you did not know the money was stolen.

5The consequences the FBI lists, “even if unwitting”. This line is what turns a later repeat into knowledge.

6Please call Fraud Operations on the number below within five days. You can also report what happened to the FBI at ic3.gov.

6A route back for a deceived customer, and a reason for the bank to talk before it decides.

7[Nothing about a report, an investigation, a referral or law enforcement.]

7Not allowed: anything that would reveal a SAR. The statement covers what a bank may say; the regulation covers what it may not.

An illustrative bank warning written for this guide on the sample case's fictional customer, not an output of Money Mule Detection and not legal advice. Annotations cite the FBI's 2021 notice on money mules and the 2026 interagency statement on SAR confidentiality.Source: Joint Statement on SAR Confidentiality, 2026; FBI, I-120321-PSA

What is a money mule warning letter?

It is a notice, not a charge. When the Justice Department first described its letters, in December 2019, it said they "informed recipients that they could be prosecuted if they continue aiding and abetting fraud schemes" (U.S. Department of Justice, 2019). By 2020 the wording was that recipients "were facilitating fraud and could face civil or criminal consequences for continuing their actions" (2020). In 2024 the department said whom they were for: "warning letters intended to advise those who may have been unknowingly recruited by fraudsters" (2024).

A bank's warning does the same job from closer range. It reaches the customer while the money is moving, from the institution that can see the account, and it can be followed by a restriction, a conversation or an exit.

US law enforcement has sent thousands of money mule warning letters

December 2019 campaign
500+
December 2020 campaign
~2,000
December 2021 campaign
~4,670
May 2023 campaign
4,000+
May 2024 campaign
~2,970
Warning letters served in each announced US Money Mule Initiative, as the Justice Department reported them. Criminal charges in the same campaigns ran to dozens: more than 30 in 2019 and 2021, more than 25 in 2023, more than 20 in 2024.Source: DOJ 2019; 2020; 2021; 2023; 2024

Who sends money mule warning letters?

In the United States, federal law enforcement in coordinated campaigns: the Justice Department's Consumer Protection Branch, the FBI and the U.S. Postal Inspection Service led them, with agencies such as Homeland Security Investigations and several inspectors general. The letters are served during interviews or by mail; the 2019 campaign alone "interviewed more than 550 individuals and served over 500 warning letters on individuals who recently served as money mules for fraud schemes".

Banks warn too, though they rarely call it a warning letter: a restriction notice that explains the scheme, a call from the fraud team, a secure message. The FBI's definition of a witting mule assumes they do: one of its marks is a person who has been warned by bank staff and goes on opening accounts (FBI, 2021).

Three letters a mule account holder may receive, and what each may say

LetterSent byIts jobMust not say
Law-enforcement warningDOJ, FBI, USPIS and partner agenciesTell the person they are facilitating fraud and what continuing will cost(Their own rules apply)
Bank warningThe bank’s fraud teamExplain the scheme, stop the next payment, open a conversation, create a dated noticeAnything that reveals a SAR, a referral or law-enforcement contact
Bank exit letterThe bank, usually deposit operationsClose the account and say what happens to the balanceThe same; a reason is optional
The bank's limits come from 31 CFR 1020.320(e) and the September 2, 2026 joint statement; neither requires a reason for a closure, and neither forbids one that does not reveal a report.Source: 31 CFR 1020.320; Joint statement, 2026

Should banks warn suspected money mules?

Yes, and regulators now say so in terms. The September 2, 2026 statement from the Federal Reserve, FDIC, FinCEN, NCUA and OCC lists, among communications that "would not typically reveal the existence of a SAR", providing "warnings or educational resources to a customer about fraud schemes or typologies", including where a customer "may be participating, knowingly or unknowingly in a fraud scheme" (Joint Statement on SAR Confidentiality). Its conclusion is the rule to write on the wall: banks may communicate with a customer about suspicious transactions or a closure "so long as that communication does not reveal the existence of a SAR".

The UK regulator goes further and expects warnings before the event. It found firms' "efforts to educate customers about money mule risks fall short" and asked them to "improve their communication strategies and awareness initiatives" (FCA, 2023).

When should a bank send a money mule warning?

Send it at the first sign that a customer is being used, before the money moves again, and only where the evidence points to deception rather than knowing participation. Three moments fit. The first is the customer's own question: in a sample case run through Money Mule Detection, a student asked the bank in a secure message whether his new employer's deposits were all right, two days before $18,400.00 arrived. An answer that day, explaining the scheme, is a warning. The second is the first alert, when the type is unclear and the amounts are small. The third is the conversation after a restriction, when the bank decides to keep a deceived customer open under watch.

A warning is the wrong tool when the evidence already says the customer knew: several accounts in other names on one device, recruiting, coaching. There the bank restricts, exits and refers, and a letter that describes what the bank has seen in detail risks telling the network what to change. Whoever decides, a second person should check the letter before it goes, and it should be filed with its date, as any customer notice in a mule case is.

Timing has a statistical side too. In the Federal Reserve Financial Services survey (FRFS, 2026; the survey says it is not independent academic research, with a margin of error of ±6%), 34% of institutions left some mule accounts open while filing SARs and 23% left some open under highly restrictive rules. Every one of those accounts is a customer the bank decided to keep, and the warning is what makes keeping them defensible.

What should a money mule warning say?

It should say what is happening, what to stop, what continuing costs and how to reach the bank, in plain words, and nothing about any report. The annotated letter above follows that order. Three choices deserve care. Describe the scheme, not the customer: criminals often ask people to receive money and send it on informs, where we suspect you of laundering accuses and may tip off. State the consequences as the FBI states them, including that they apply "even if unwitting". And give a deadline and a route, because the purpose is a conversation the bank can document.

What a money mule warning letter should, and should not, contain

  1. The date, the channel and the account

    So that later it can be shown exactly what the customer was told, and when.

  2. What the bank has done to the account

    Restricted, and what that means for payments, cards and cash.

  3. The scheme in plain words

    A “job” or a friend asking you to receive and send money; the money is from scam victims.

  4. What to stop, and what to keep

    Stop moving money and replying; keep messages and receipts.

  5. The consequences of continuing

    Closure, difficulty opening accounts, prosecution, even if unwitting.

  6. A way to talk to the bank, and to report

    A direct number, a deadline, and IC3 for the customer’s own report.

  7. Nothing that reveals a report

    No SAR, referral, investigation or law-enforcement contact, in the letter or its envelope.

The letter is evidence: dated, approved and kept

A warning letter's second life begins if the money moves again. The FBI's witting mule is the person who received warnings and carried on, and prosecutors have charged on that basis: in the 2023 campaign, offices in California and Nebraska "charged individuals who, despite warnings from law enforcement, continued facilitating fraud" (U.S. Department of Justice, 2023). For a bank, the warning becomes part of the case for an exit and of the BSA team's view of the subject. Supporting documentation for a SAR is kept five years and counts in law as filed with the report itself (31 CFR 1020.320(d)), so a copy of the warning belongs in that file.

It works the other way too. A UK bank filing a customer to the National Fraud Database needs evidence that the customer knew, or suspected, that the money was criminal, and the FCA found firms struggle to prove whether a customer took part willingly (FCA, 2025). A dated warning, ignored, is the cleanest such evidence. How a warning moves a customer from one mule type to another is in types of money mules.

Before the warning, the customer may not have known. After it, the question is only whether they read it, and a dated, approved letter answers that too.

Every decision and every letter on an append-only trail

The audit trail of a sample mule case. Entries from 11:49 to 12:05 list who did what and why: agents weighing the mule type and drafting notices, the recovery agent matching a recall, the investigator opening the case, opening a source, requesting a freeze with reason code F2, sending notices and a return plan to the checker, requesting an exit and sending the referral with a 30-day clock to 21 November 2026, and the manager approving the freeze and the notices. Tabs filter by decisions, agents, access and exports, and a button builds an export pack.
Sample data on a fictional bank. Who did what, when, why and on which evidence, kept five years. A warning a bank sends belongs on the same trail as its exit letter.

What happens if you get a money mule warning letter?

If it comes from law enforcement, nothing happens immediately: it is a warning that you appear to be facilitating fraud and that continuing could bring civil or criminal consequences. The Justice Department's 2021 letters "outlined the potential consequences for transferring money acquired illegally" (2021). If it comes from your bank, your account is usually restricted and the bank will want to talk to you. In both cases the FBI's advice applies: stop moving money, stop replying to the person directing you, keep the messages and report to IC3. What usually happens next to the account is set out in the unwitting money mule.

Does a money mule warning letter mean charges?

No. The letters are the opposite of a charge: the Justice Department describes them as "intended to advise those who may have been unknowingly recruited by fraudsters", alongside prosecutions "designed to punish those intentionally assisting fraudsters" (2024). In the campaigns announced in 2019, 2021, 2023 and 2024 the letters outnumbered the charges by thousands to dozens. A letter does mean that continuing becomes harder to defend.

Can a bank close my account after a warning?

Usually yes, under the terms of the deposit account agreement, and the 2026 joint statement confirms a bank may tell a customer that a closure may relate to suspected fraud. In a sample case run through Money Mule Detection, the exit letter reads: "Under your deposit account agreement, either of us may close the account at any time", and gives no reason, a choice the sample bank made, not one the law requires. Before it goes, a tipping-off check confirms it mentions no report, investigation, fraud, law enforcement or BSA team, and a manager approves it.

The exit letter Money Mule Detection drafts, checked before it goes

The exit tab of a sample case: three accounts to close on 6 November 2026 with what happens to each balance, the letter the customer receives saying the account is restricted now and will close on 6 November 2026 under the deposit agreement, any balance belonging to the customer sent by official check, and a tipping-off check that passed: no reason given, no mention of a report, investigation or fraud, no mention of law enforcement or the BSA team, the same wording for all three accounts, reading grade 7.
Sample data. The exit agent drafts; a manager approves. A bank that also sends warnings can hold them to the same checks.

Questions people ask

How do I know a money mule warning letter is genuine?

Check it through a number you find yourself: the agency's public contact details, or the number on your bank card. Be wary of any letter that asks you to pay or move money to settle the matter; the FBI's advice to anyone who thinks they are being used as a mule is to stop transferring funds and report to IC3.

Do you have to respond to a money mule warning letter?

A law-enforcement warning usually asks you to stop, not to reply. A bank's warning usually asks you to call, and doing so is the best way to show you were deceived and to keep any chance of the account staying open.

Can a bank tell me why it is closing my account?

It can say the closure may be related to suspected fraud or other suspicious activity, according to the September 2026 interagency statement. It cannot say anything that reveals a suspicious activity report, so many banks give no reason at all.

How many people get money mule warning letters?

In US law enforcement campaigns, about 2,000 in 2020, about 4,670 in 2021, more than 4,000 in 2023 and about 2,970 in 2024, by the Justice Department's figures. Bank warnings are not counted publicly.

Does a warning letter go on my record?

A law-enforcement warning is not a conviction. A bank keeps its own warning in the case file with its date, and may flag the account and the customer's details against re-opening if it exits them.

Money Mule Detection.
See it on your own files.

An agentic solution from Botminds. Fraud and AML teams find accounts moving scam proceeds, then freeze, exit and refer them Book a demo, or explore how it works.