Money mules move criminal funds through accounts that look ordinary on paper: a student, a gig worker, a new customer who opened online last week.

Some know what they are doing. Many have answered a job ad or a message offering easy money for receiving and forwarding payments. Either way, the account becomes one link in a chain that moves fraud proceeds away from the victims and out of reach.

Why mules are hard to catch

The customer passes onboarding. The documents are genuine, because the person is real. The first transactions are small. By the time a monthly rule notices unusual volume, the account has often done its work and gone quiet.

Each alert, seen alone, also looks harmless. One incoming transfer from a stranger is a refund or a shared bill. One outgoing payment to an exchange is an investment. The pattern only appears when the transfers are read together, and when the account is read next to the other accounts opened that week.

The pattern in the first days

Incoming transfers from many unrelated senders, followed within hours by outgoing payments to a few accounts or crypto exchanges. Balances that never rest. A device or address shared with other new customers.

• Several incoming transfers from senders with no visible link to the customer.

• Funds moved out within hours, often in round amounts.

• Outgoing payments to a small set of accounts, exchanges or prepaid cards.

• Activity that does not match the declared occupation or income.

• The same device, phone number or address as other recent accounts.

• Login locations that differ from the customer's stated address.

No single signal is enough. Three or four together, in the first two weeks of an account's life, usually are.

Timing is the strongest of these. Ordinary customers let money sit, even briefly. A mule account is a corridor: money arrives and leaves the same day, often to destinations the customer has never paid before opening the account.

What the agents connect

Alert Triage groups the transfers by counterparty, and KYC Refresh compares the onboarding data with other recent accounts. Shared devices and addresses become one finding instead of five separate alerts.

The grouping works in both directions. Starting from one suspected mule, the agents look for the senders who paid it and the accounts it paid. Other new accounts that received money from the same senders, or paid the same recipients, join the same case. The analyst sees a network, drawn from the bank's own data, with each link sourced.

Act before the account goes quiet

Mule accounts are often abandoned within weeks. Cases that reach an analyst in the first days, with the network already drawn, can be stopped while the funds are still moving.

Speed matters here more than in most typologies. A structuring case that is worked in a week loses little. A mule case worked in a week may find an empty account. Teams that route new-account alerts to the top of the queue catch more of these while there is still something to hold.

Onboarding is part of the answer

Many mule signals are visible before the first transaction. A device already used to open three other accounts this month, an email address created the same day, a phone number shared with another applicant. These are not reasons to refuse an account on their own, but they are reasons to watch it closely in its first weeks.

When KYC Refresh finds that a new account shares onboarding data with an account already in a mule case, it raises the new account's monitoring level and tells Alert Triage. The first unusual transfer then reaches an analyst at once, with the link to the existing case already drawn. Nothing is blocked automatically. The account simply starts its life under closer watch, and the team decides what that watch should lead to.

What stays with the analyst

The agents do not freeze accounts or close them. They recommend, and the analyst decides whether to restrict the account, contact the customer, file a SAR or all three. Some customers turn out to be victims themselves, recruited without understanding the scheme. How the bank treats them is a judgment for people, not a rule.

Every recommendation carries the evidence that led to it, so the analyst can see why the account was flagged and decide quickly.

What to do on Monday

Take every account opened in the last 30 days and list the ones that received transfers from five or more unrelated senders. For each, check how fast the money left. If any moved funds out within the same day, review those accounts first, and check who else shares their device or address.