Money mules revealed. Exposing mule strategies, global impacts, and the urgent need for real-time detection

Organised crime groups (OCGs) exploit vulnerabilities in financial institutions (FIs) to recruit and onboard money mules to launder billions of dollars annually. Criminals have adapted alongside changing technologies to target FIs and their customers at scale, leveraging social media platforms, crime-as-a-service (CaaS), AI-powered tools, and breached identity data to socially engineer victims, create fake identities, and bypass security measures like identity verification (IDV) and know your customer (KYC).

Money mules play an increasingly crucial role in legitimising OCG profits from digital crimes such as authorised push payment fraud (APPF), identity theft, and phishing, along with proceeds from physical crimes, including drug trafficking, smuggling, and human trafficking. Three main types of money mules—compromised, recruited, and fake mules—highlight how criminals exploit FIs and use mule accounts to launder money.

Global and regional task forces and regulatory bodies are taking steps to address the serious money mule and money laundering problem. These efforts drive changes in AML and fraud prevention practices that impact money muling.

FIs globally continue to grapple with financial losses and increased operational costs, and some FIs now face regulatory penalties as illicit funds flow through their systems and fuel more criminal activity. The dynamics of money mules are unique in each region and country. For instance, in the UK, APPF and money muling are increasingly intertwined and impactful. New regulations around APPF reimbursement are expected to drive more investment in mule detection technologies. In contrast, new digital banks, person-to-person mobile money transfers, and payment services across Latin America are increasing financial access for underbanked people and businesses but making it easier for OCGs to commit digital crimes and onboard money mules to launder illicit profits. Regulations remain inconsistent across the region.

Regardless of the region or country, FIs are facing money mule and money laundering risks due to the real-time availability of their digital products and services, but lack real-time solutions. They are unable to detect if funds customers receive are from illicit sources or identify if a customer is exhibiting malign behaviour in real-time. Traditional fraud prevention and AML methods which use unsupervised machine learning (ML) are reactive and ineffective against money mules, allowing mules to launder money unchecked and creating a vicious cycle of crime.

Money muling is a real-time problem that requires a real-time solution. FIs need to detect and stop illicit funds and mules in real time to block suspicious activity, prevent illicit funds from leaving their systems, and shut down mule accounts.

FIs must use supervised ML models that learn from labelled data and retrain daily to avoid drift and performance degradation given ever-evolving criminal tactics, customer behaviours, and emerging technologies. These models detect more money mules while blocking fewer legitimate transactions.

Lynx’s Daily Adaptive Models (DAMs) use supervised learning, retrain with the latest transaction data daily, and integrate diverse non-transaction data sources to detect more money mules. Key benefits from DAMs include real-time detection, improved accuracy, reduced operational costs and analyst fatigue, and enhanced regulatory compliance.

Lynx built one Tier 1 banking customer, a money mule DAM, which achieved a 65% account detection rate (ADR) and a 70% value detection rate (VDR) at a low rate of 10 false positives per 10,000 transactions—a significant improvement over the bank’s previous model—with a response time of less than 100ms.

Reach out to schedule a proof of concept; no PII is required. Lynx will analyse your transaction data to demonstrate how many undetected or dormant mule accounts you have and how much money you could save.