Money Mule Detection

Unwitting money mule: when the account holder is a victim too

An unwitting money mule moves criminal money without knowing it, usually after a fake job or romance, and the standard exit path was built for the opposite case. Botminds' Money Mule Detection weighs every signal and leaves the type and the route, restrict, warn, report or exit, to a person.

Updated · 12 min read

An unwitting money mule is someone who moves criminal money through their own account without knowing it is criminal. The FBI describes them as people who do not know they are part of a larger criminal scheme, typically "recruited via scams such as romance scams or more recently, employment scams", who "genuinely believe they are helping someone who is acting as their romantic partner or employer". They are victims and conduits at once: their account carried other people's stolen money, and they were deceived into letting it. For the bank, the standard response to a mule account, freeze, exit, flag, was designed for someone who knew. Botminds' Money Mule Detection, an agentic solution for fraud teams, weighs whether a customer is unwitting, witting or complicit with each signal cited, and leaves the type and what happens next to an investigator. This page maps those routes.

A decision path for an account holder who may have been deceived

  1. Agent

    Weigh the evidence both ways

    Signals for unwitting and witting, each cited: the customer’s own messages, warnings, devices, accounts, cash-out.

    Never: Decides the type, or writes it anywhere the customer can see.

  2. A person decides

    Restrict now, decide later

    Freeze what belongs to the victims at once; a neutral “Restricted” status for the customer and the branch.

  3. A person decides

    Talk to the customer

    Ask about the source of the money; explain the scheme. Both are allowed without revealing a report.

  4. A person decides

    Choose the route

    Keep open under restriction, warn and watch, or exit, and record why, with the date.

  5. A person decides

    Report regardless

    The BSA team decides on the SAR on the activity, whatever the customer knew.

The path a fraud team can follow when the typology is unclear or points to unwitting. The agent step describes Money Mule Detection; every other step is a person's decision, checked by another.

What is an unwitting money mule?

It is the first of the three types of money mule the FBI and FinCEN use, the other two being witting and complicit. FinCEN's 2020 advisory adds the motive: the unwitting mule acts out of trust in the romance, the job or the offer, believing it to be real (FinCEN Advisory FIN-2020-A003). The UK Financial Conduct Authority uses "unknowingly involved" for the same people: "They are often deceived by fraudsters who present seemingly legitimate opportunities or plausible explanations for their actions" (FCA, 2023).

They are common. In the Federal Reserve Financial Services risk officer survey, 67% of institutions had seen mule accounts belonging to legitimate customers who had been scammed, and the report's own summary turns that into two-thirds of mule account fraud (FRFS, 2026; strictly, the two-thirds is a share of institutions, and the survey describes itself as "not independent academic research"). Law enforcement sees the same: "Many money mules begin as victims of romance or lottery scams and are unknowingly lured by fraudsters into transmitting fraud proceeds based on lies" (U.S. Department of Justice, 2024). How investigators tell the types apart is in types of money mules.

How do scammers trick people into being money mules?

With a job, a relationship or a favor. The FBI lists unsolicited requests to open an account, romance scams, "Employment scams promising easy money", non-delivery scams and lottery scams (FBI, 2021). FinCEN's red flags describe the job version from the bank's side: a customer whose "purported employer asked the customer to receive funds into his or her personal bank account, so that the employer can then process or transfer funds" (FinCEN, 2020). Researchers have found recruitment in the open: 43 Dutch Instagram accounts that were probably being used to recruit mules (Deviant Behavior, 2022), and, among 543 apprehended mules in South Korea, unemployed people in their twenties with intermediate education "more likely to be recruited through social media" (Deviant Behavior, 2023).

Some unwitting mules are scam victims twice over. In a March 2025 case in the FBI's annual report, a senior citizen buying a property was sent fake wire instructions for more than $1.3 million. The FBI had the receiving account frozen and learned that its owner "was a victim of an overpayment scam and instructed to send $1 million to a fraudulent international account in Hong Kong" (IC3 2025 Annual Report). The receiving account holder was the mule, and a victim, in the same transaction.

The same account from two sides

What the customer believesWhat the bank sees
The money

What the customer believes: Client payments for a remote job, or help for a partner abroad.

What the bank sees: Several first-time senders, often older, at other banks, in one morning.

The instruction

What the customer believes: Process it quickly and send it on; keep a small fee.

What the bank sees: Outflows within minutes, by P2P, cash and cards, to new payees.

The pay

What the customer believes: A “training stipend” or a percentage.

What the bank sees: A small credit from a company with no payroll history.

The question

What the customer believes: “Is this OK?”, sometimes asked of the bank itself.

What the bank sees: Evidence, dated, that the customer did not yet know.

Built from the FBI's and FinCEN's descriptions of employment and romance recruitment and from a sample case in Money Mule Detection, in which a student asked his bank, two days before the money arrived, whether his new employer's deposits were all right.

Will I be charged if I was an unwitting money mule?

Possibly not, but it is not ruled out, and what you do next matters. The FBI warns that people acting as mules "face prison sentences, a fine or community service, even if unwitting" (FBI, 2021). In practice, US law enforcement has used warning letters for people it believed were unknowingly involved and prosecutions for those who knew or carried on: in the 2021 campaign agencies warned about 4,670 people in writing that their actions were helping fraud schemes, and charged more than 30 (U.S. Department of Justice, 2021). The Justice Department's own description of the mules it acted on: some "first interact with fraud schemes as victims and may be unaware that their actions are furthering criminal activity".

The FBI's advice to anyone who suspects they are being used is to stop communicating with the criminal and stop moving money, keep receipts and messages, "Notify your bank or payment provider" and report to IC3. The line between unwitting and witting is usually a warning ignored, which is why the money mule warning letter matters so much.

What happens to my bank account if I was a money mule?

Usually it is restricted at once and closed later, whether or not you knew. The FBI lists "the inability to open bank accounts in the future" among the consequences, and the FCA warns UK consumers that the consequences "could include losing access to your bank account and possible prosecution" (FCA, September 2026). In the UK, a bank may also file the customer to the National Fraud Database, but the FCA notes the standard of proof includes "the evidence to show that the customer knew the funds were, or might be, the proceeds of crime", and that firms "find it challenging to demonstrate conclusively whether the customer willingly participated" (FCA, 2025).

Money that came from victims goes back to the victims' banks where it can be traced, and the account holder's own money is returned to them, often by check when the account closes.

Do banks close accounts used as money mules?

Most do, eventually, but practice varies more than many customers expect. Banks in the Federal Reserve Financial Services survey reported every response from immediate closure to leaving the account open under tight rules.

What banks do when they identify a mule account

Suspend for further review before closing
58%
Account usually empty, so closing is all they do
51%
Close immediately and return funds
50%
Leave open, but report to FinCEN through a SAR
34%
Leave open with highly restrictive transaction rules
23%
Share of surveyed institutions that reported each practice in the past 12 months (declining, persistent or increasing); institutions could report several. The survey is the Federal Reserve Banks' own and says it is “not independent academic research”, with a margin of error of ±6%.Source: Federal Reserve Financial Services Risk Officer Survey, 2026, Chart 5

Can a bank keep an account open after mule activity?

Yes. No US rule requires closure, and about a third of institutions in the survey left some mule accounts open while filing SARs; 23% left some open under highly restrictive rules. Keeping an account open makes sense for a customer the bank believes was deceived, who has been told what happened, and whose account can be watched: money that arrives in future is a fresh test. It makes no sense when the evidence points to someone who knew, or when the bank cannot monitor what comes in.

The decision should be made by a person, written down with its reasons and its date, and checked. A customer kept open today and found moving money again next month is, on the FBI's own definition, now a witting mule.

Four routes for a customer who may be an unwitting money mule

RouteWhen it fitsWhat the customer is toldWatch for
Restrict and keep openClear signs of deception; a customer who engages and stopsThe account received money from a scam and must not be used to move itAny new credit from unfamiliar senders
Warn and watchUnclear type; first contact; small amountsWhat a money mule scheme looks like, and the consequences of continuingWhether the warning is dated and on file
ReportWhenever the activity meets the SAR rules, whatever the typeNothing that reveals a report existsThe 30-day clock from detection
ExitWitting or complicit signals; repeat activity; no engagementThe account will close; a reason is optionalRe-open attempts under the same name, phone or address
Routes are a bank's own policy choices; no federal rule prescribes them. Reporting runs alongside whichever route the bank chooses.

What should a bank tell an unwitting money mule?

More than many banks assume. A joint statement from the Federal Reserve, FDIC, FinCEN, NCUA and OCC on September 2, 2026 says three things a bank may ordinarily do without revealing a SAR: tell the customer that a restriction, delay or closure may be connected with suspected fraud or other suspicious activity; ask about the purpose of a payment or where the money came from; and warn the customer about fraud schemes, including ones in which a customer may be taking part without knowing it, such as money mule schemes (Joint Statement on SAR Confidentiality, 2026). The full wording, and how to turn it into a letter, is in the money mule warning letter.

What the bank may not say is that it has filed, or will file, a report. The FCA asks UK firms to go further and warn customers before they are recruited: "some customers might find themselves susceptible to providing their account details for money mule activities under influence or pressure" (FCA, 2023).

Talking to a customer who may be an unwitting money mule

  1. Ask before you conclude

    Where did the money come from? Who asked you to move it? What were you told?

  2. Explain the scheme plainly

    A job that pays you to receive and send money is not a job; the senders are likely scam victims.

  3. Say what will happen to the account

    Restricted now; what comes next and when.

  4. Tell them what to stop doing

    Stop moving money, stop replying to the “employer”, keep every message.

  5. Point them to IC3

    A complaint with transaction details helps law enforcement and shows good faith.

  6. Date and file what was said

    If the money moves again, this conversation is the evidence that they knew.

  7. Never mention a report

    No SAR, referral or BSA team, in the conversation, the letter or the branch note.

How Money Mule Detection handles a customer who may be a victim too

In Money Mule Detection the typology agent weighs unwitting, witting and complicit, with each signal opening its source, and says "unclear" when no type reaches 0.70. In a sample case on fictional people, a student who had asked the bank whether his new employer's deposits were all right, and who was paid a $350.00 "training stipend", also signed in to three accounts in three names from one phone and cashed out in person minutes after the money landed. The agent's summary: the start looks unwitting; the last three weeks look witting. The investigator recorded the type, and it appears nowhere the customer can see.

Signals for unwitting and witting, side by side, each with its source

The customer tab of a sample mule case: the typology agent's weights for witting 0.64, unwitting 0.24 and complicit 0.12, a note that no type reaches 0.70, seven cited signals labelled unwitting, witting, complicit or recruited, a recruitment pattern for a remote payment processing job matched on five of six markers, and the investigator's decision panel.
Sample data. The customer's own message to the bank is the first signal on the list, and it points to unwitting.

Whatever the type, the exit agent drafts neutral letters and runs a tipping-off check on each, and the sample bank chose letters that give no reason. A bank that decides to keep a deceived customer open, or to explain the scheme to them, can do so; the 2026 statement makes that clear. The agents draft; the bank decides the policy.

An exit letter that reveals no report

The exit tab of a sample case: three accounts closing on 6 November 2026, each with what happens to its balance, the letter the customer receives saying the account is restricted now and will close on 6 November 2026 under the deposit agreement, and a tipping-off check that passed on five points, with re-open guards on name and SSN, phone and address.
Sample data. A manager checks every exit. Re-open guards stop the same name, phone or address from opening a new account without review.

Questions people ask

What should I do if I've been used as a money mule?

Stop moving money and stop contacting the person directing you, keep every message and receipt, tell your bank or payment provider, and report the activity to the FBI at ic3.gov. Doing so early, before anyone warns you, is the best evidence that you were deceived.

Can you go to jail for being an unwitting money mule?

The FBI says mules can face prison, fines or community service "even if unwitting", though prosecutions concentrate on people who knew or carried on after a warning. In the US campaigns announced in 2019, 2021, 2023 and 2024, warning letters far outnumbered criminal charges.

Will an unwitting money mule be able to open a bank account again?

It may be harder. The FBI lists the inability to open accounts among the consequences, and banks place re-open flags on closed mule accounts. In the UK, a filing to the National Fraud Database requires evidence the customer knew, which gives deceived customers some protection.

Is the unwitting money mule also a victim?

Often, yes. The Justice Department says many mules start out as victims of romance or lottery scams, and the FBI's 2025 report describes a receiving account owner who was the victim of an overpayment scam while their account received another victim's $1.3 million.

Do banks have to report an unwitting money mule?

The SAR obligation turns on the activity, not on what the account holder knew. If the transactions meet the SAR rules, the bank files, and it must not tell the customer it has done so.

Money Mule Detection.
See it on your own files.

An agentic solution from Botminds. Fraud and AML teams find accounts moving scam proceeds, then freeze, exit and refer them Book a demo, or explore how it works.