Money mules: the account where scam proceeds stop on the way out

The distinction decides whether the bank is looking at a victim or a participant. An unwitting mule believes they have a job or a favor to do and does not know the money is criminal. A witting mule suspects something and does not ask. A complicit mule knows and is paid for it. A synthetic mule is not a person at all: an account opened with a fabricated or stolen identity, which Trustfull describes as a category of its own.

The mix matters operationally. An unwitting mule reacts to a phone call from the bank and will often freeze the transfer themselves. A synthetic account answers nothing and needs to be caught at onboarding or not at all, which pushes the control back to the identity check described on KYC in Germany.

Two routes. Either a criminal opens the account with a false or stolen identity, or an existing account holder is persuaded to hand over access. The second route is the common one and the harder one, because the account has a genuine history behind it, a salary credit, a rent debit, years of ordinary use.

Recruitment runs through fake earning opportunities that promise a share of the transferred amount, through romance and dating contacts who ask for a favor, through investment schemes with fast returns, and through social media messages aimed at students and young people. Europol has run the Don't Be A Mule awareness campaign with the European Banking Federation for exactly this reason, and its European Money Mule Action identified thousands of mules and hundreds of recruiters across more than twenty countries in a single coordinated exercise. This is a fraud pattern and not an earning option, which is how a bank's customer communication has to describe it.

At onboarding: an identity that barely passes due diligence, incomplete details, a disposable email address, a device or IP that has opened other accounts, and then a dormant period before anything happens. The dormancy is deliberate, because a new account that immediately receives and forwards money is obvious.

In the account: a sudden surge in a quiet account, credits that do not fit the stated income, round-figure transfers, and the pattern that matters most, funds received and forwarded almost immediately. Then the network shape, many senders into one account or one account out to many, and the digital signals, logins from distant locations within hours, VPN use, rapid changes of phone number, email and address. A customer who cannot explain where the money came from is the signal that converts a model score into a case.

Legally these are two regimes with two reporting paths, and a bank that treats them as one gets both wrong. The AML duty comes from the money laundering rules: customer due diligence, monitoring, and a suspicious activity report to the financial intelligence unit when a transaction looks like laundering. AML in Germany covers the German obligations and the role of the FIU.

The fraud duty is newer and commercial. It requires the receiving bank to notice that an inbound credit looks like scam proceeds and to act in time to stop the onward transfer, and under the UK reimbursement rules it makes that bank pay half the victim's loss. Organizationally they usually sit in different teams with different systems, and the mule case is exactly where the two have to talk, because the AML alert and the fraud alert concern the same account.

Everything about the operational problem. When a transfer took a working day, a fraud team had hours to recall a payment after a victim reported it, and a recall often worked. With instant payments the money is credited in ten seconds, at any hour, and the onward transfer out of the mule account can be instant too.

So detection has to move from review to real time, and the decision has to be automatic. A bank cannot hold every inbound credit for a human to look at, and it cannot let a mule account empty itself either, which leaves scoring on receipt and a hold on the onward payment, not on the incoming one. The practical consequence is that a false positive now freezes an innocent customer's money at 11 at night, which is why the thresholds are set as carefully as they are.

Lending out an account in Germany is not a gray area. Depending on what the account holder knew and did, it can amount to aiding fraud or to money laundering under section 261 of the Criminal Code, which since the 2021 reform no longer requires the predicate offense to be on a list. Negligent handling of criminal proceeds is also covered.

The practical consequences arrive sooner than any verdict. The bank blocks the account and terminates the relationship, the block is recorded, and opening a new account elsewhere becomes difficult because the reason follows the person. Civil claims from the victims come on top, and a court has repeatedly held an account holder liable for a loss they helped make possible. A customer asking the bank whether it is "allowed" has usually already received the money.

A money mule is a person who receives criminal proceeds into their own bank account and forwards them, usually for a share of the amount or in the belief that they are doing legitimate work. The account is used to break the trail between the fraud victim's payment and the criminal, and the mule may be unwitting, willfully blind or fully complicit.

A dormant or new account that suddenly receives unusual credits, funds forwarded almost immediately after arrival, amounts that do not match the stated income, round-figure transfers, many senders into one account, logins from distant locations within a short period, and frequent changes of email, phone number and address. A customer unable to explain the source of the funds is the strongest single signal.

In Germany the account gets blocked and the banking relationship terminated, and the account holder can face criminal liability for money laundering or for aiding fraud, depending on what they knew. Victims can also sue for their loss. No fee offered for the service compensates for that, and the offer itself identifies the request as a fraud.