Money Mule Accounts: What Europol, FinCEN and UK Authorities Publish, and What Identity Checks Cannot See

For information; not legal advice.

A money mule account can look, at the moment of opening, like any other account. The holder can be a real person. The document can be genuine. The face on the selfie can match the face on the card, and the person can be present when the camera runs. An identity check that is working exactly as designed will pass such an account, and the account may later carry the proceeds of other people's crimes.

This article starts with definitions and typologies, as the public bodies that study money muling publish them, and only then asks what an identity check can contribute. It draws on Europol and its European Money Mule Action, on the United States Financial Crimes Enforcement Network, on the United Kingdom's national risk assessment of money laundering, and on a United Kingdom fraud-sharing body. It also notes one publication page of the Financial Action Task Force, without drawing on the report behind it. It states no detection rate for any control and makes no claim that a verification product finds mules.

It follows the article on authorised push payment fraud, where the receiving account is the place the money goes, and it complements the article on forged identity document classes, which covers the case where the document is not genuine. Here the document can be genuine, and Europol also reports organised mules using fake documentation, so both cases occur.

What the sources mean by a mule

Europol

Europol describes money muling as a type of money laundering. A money mule, in its words, is a person who receives money from a third party in their bank account and transfers it to another account, or takes it out in cash and gives it to someone else, obtaining a commission for it. It adds that even if mules are not directly involved in the crimes that generate the money, such as cybercrime, payment and online fraud, drug offences or human trafficking, they are accomplices, as they launder the proceeds. In its report on the ninth European Money Mule Action, the people who organise mules are called recruiters, or herders.

FinCEN

The Financial Crimes Enforcement Network of the United States quotes the Federal Bureau of Investigation to define a money mule as a person who transfers illegally acquired money on behalf of or at the direction of another. Its advisory of 7 July 2020 distinguishes three kinds of mule.

The advisory describes recruiters using good-Samaritan, romance and work-from-home schemes. In a work-from-home scheme, a recruiter under a false charity or company label offers what looks like a legitimate job, and the target is told to move funds through accounts or to set up a new account in the target's own name for the "business". The target earns a percentage of the funds moved. The advisory was written about schemes that exploited the COVID-19 pandemic, and this article cites it for its definitions and typology and not for its pandemic context.

The United Kingdom national risk assessment

The 2025 National Risk Assessment of Money Laundering and Terrorist Financing, published in July 2025 by HM Treasury and the Home Office, defines money muling as when an individual wittingly or unwittingly, under the guise of a job or through exploitation or coercion, moves criminal funds in exchange for payment or benefits or in response to threats. It says this typically involves moving money to one or more bank accounts and then withdrawing cash or cashing out through other means, such as debit card payments, crypto or international payments. Its definition therefore adds a category the FinCEN scale does not name: the person who is pushed into it.

The Financial Action Task Force

The Financial Action Task Force published, on 9 November 2023, a report called "Illicit Financial Flows from Cyber-enabled Fraud", prepared with the Egmont Group and INTERPOL. This article read only the publication page, which says the report analyses how the cyber-enabled fraud landscape has evolved and its links to other crimes, and sets out risk indicators and controls for public and private entities. The full report could not be opened, because the FATF site served a bot-detection page in place of the document. This article therefore uses no typology, indicator or figure from the report, and a reader who wants the FATF view of mules should read the report itself.

What the public bodies say about how mules are recruited

Recruitment channels and targets

Europol's public awareness page lists the ways it sees mules recruited. They include seemingly legitimate job offers, such as for "money transfer agents", on online job forums, by email, on social media or in pop-up advertisements; direct messages on instant messaging apps or by email; and approaches in person. It names the most targeted groups as newcomers to a country, often targeted soon after arrival, and unemployed people, students and those in economic hardship, and says that people under 35 are the most likely targets and that criminal groups have begun recruiting younger people, from 12 to 21 years old. The page lists warning signs of a fake job offer: an overseas company seeking local agents, duties that involve transferring money or goods, no stated duties or experience requirements, interactions entirely online, and promises of significant earnings for little effort. It says that these features do not necessarily indicate a mule solicitation, but are commonly used.

The UK assessment adds a social and economic observation: difficult circumstances may make people more susceptible to targeting, particularly through social media, which makes recruitment easier. Cifas, a United Kingdom fraud-sharing body, adds, in its 2026 press release, that recruitment lures include job scams, business opportunities and overpaying sellers for items on online marketplaces.

Trends reported by investigators

Europol's report on the ninth edition of the European Money Mule Action lists developments that investigators described.

• One Member State found migrants from Ukraine being increasingly targeted as unwitting accomplices, with criminals coercing them into opening bank accounts.
• Criminals posing as bank officials target elderly people and persuade them to open new accounts, often visiting in person to obtain copies of identity documents and signatures.
• Criminals target younger people and provide them with online means of payment such as gift cards, activated in a tokenisation process, to buy goods that the mules hand over for resale.
• Criminals use artificial intelligence to create fake identities, making it possible to bypass know-your-customer security features during online account creation.

The last point concerns the fourth kind of account in the taxonomy below. The UK assessment says something similar and measured: that the current use of artificial intelligence for money laundering is not fully understood and not currently believed to be widespread, but that engagement between the private sector and law enforcement suggests its use for synthetic bank account creation, fraud and impersonation, phishing and the onboarding of money mules.

What the European Money Mule Action reports

Europol reports that law enforcement agencies from 26 countries, with Europol, Eurojust, INTERPOL and private industry partners, took part in operational phases in June, October and November 2023, the ninth edition of the action. The results it lists are these.

These are the results of one operation in one year, as Europol reports them, and not a measure of how common muling is or of how well any control works. The report does not say how losses were counted, and a reader should not compare the figures with those of another year or another source without checking the definitions. The report names the European Banking Federation as the first industry partner, with coordination of the participating banks, and says the effort also involved online money transfer services, cryptocurrency exchanges, online travel providers and know-your-customer companies.

Europol's awareness page carries a headline that more than 90% of the money mule transactions identified through the European Money Mule Actions are linked to cybercrime, naming phishing, malware, online auction fraud, e-commerce fraud, business email compromise, romance scams and holiday fraud as sources of the money. The page does not explain how the share was calculated, so it should be read as a description of what the operations have found and not as a statistic about all muling.

Europol also states a point that matters for identity checks. It says the majority of investigations involve cross-border cases, either with money moving from one country to another or with organised mules travelling globally to open bank accounts, often using fake documentation to deceive know-your-customer procedures.

The scale in the United Kingdom

The UK assessment gives several figures, and each has its own definition.

• Cifas estimated that 37,000 bank accounts in 2023 had behaviour associated with muling.
• A review by the Financial Conduct Authority found that 194,084 money mules were offboarded by 25 firms between January 2022 and September 2023, and that only 37% of them were reported to the National Fraud Database.
• The Cifas figures suggest that people under 30 account for 64% of intelligence indicative of money muling.
• Business accounts now account for 1 in 5 cases reported to Cifas.
• Muling is often high volume, involving daily transactions of moderate value.

Cifas's 2026 press release adds that over 22,000 cases were recorded by its members after a new money mule filing category was introduced, covering personal and business bank accounts and also credit cards, prepaid cards and money transfer accounts. The statistics article covers that filing category in the context of the full National Fraud Database. The point to take from the list is that three figures from three bodies, with different bases (an estimate of accounts, a count of people offboarded by a sample of firms, and a count of filed cases), cannot be added or compared.

A taxonomy by how the account was obtained

The following table is this article's synthesis of the sources above, not a classification published by any of them. It organises muling by how the account came into use, because the answer decides what an identity check at opening can see.

The fourth row is the only one where the central question of an identity check, whether the person and the document are what they claim to be, leads to the answer. The first three describe a genuine person, and the fifth describes a genuine account at the time of opening.

A worked case: from application to handover

The case is hypothetical and invented for this article. It follows the work-from-home pattern that the FinCEN advisory describes, and it shows which step in the chain an identity check at opening can inform. It uses no figure, and it is not a claim about how often such cases occur.

1. The approach. A person in difficult circumstances answers a job advertisement for a "payments assistant". The role is to receive transfers and forward them, keeping a share. The person is not told, and does not ask, where the money comes from.
2. The opening. The recruiter tells the person to open an account in their own name at a firm that offers fully remote onboarding. The person uploads a genuine passport, takes a selfie, and passes the liveness step. Every identity question the check asks has a true answer: the document is genuine, the face matches, a live person is present.
3. What the firm records. The firm holds a verified identity, a session record, and the evidence of the checks. At this point nothing in the record separates this customer from any other new customer. The check measured identity, and the identity is real.
4. The handover. A few weeks later the recruiter asks for the login, or for a new device to be registered, so that the "company" can manage the account directly. If the person agrees, the account is now operated by someone else, while it still carries the verified name.
5. The flow. Incoming transfers arrive from several senders and leave within a short time to accounts at other firms. The pattern does not fit the profile of a newly employed person.
6. The signals. The signals available to the firm are behavioural: the pass-through, the new device, the change of contact details, and any link to other accounts. An identity check at opening cannot supply them, because it ran weeks earlier.
7. The trigger point. If the firm repeats a check when a new device is registered, the check can ask whether the person at the screen is still the person who opened the account. In this case the answer would be no, and that is evidence of a handover, though not of the person's intent.
8. The after. When the firm closes the account, it has a decision to make about the person: unwitting, witting or complicit are different positions in the FinCEN scale, and the record of what the person was told matters for how the person is treated and for what is reported.

The case has three lessons. The identity check at opening passed correctly and could not have done otherwise. The step that carried information was the repeated check at a trigger point, together with the account's behaviour. And the outcome for the person depends on facts that no identity check collects.

What identity checks cannot see

The genuine person who is willing

An identity check at account opening answers questions about identity: whether the document is genuine, whether it has been altered, whether the face matches the portrait, and whether a live person is present. It does not answer questions about intent, such as whether this person will hand the login to someone else next week, whether they were hired through a fake job advertisement yesterday, or whether someone is standing behind them telling them what to do. A willing or deceived mule can therefore pass every step with a genuine document and a genuine face. This does not show that the check failed. It shows that the check measured identity and the problem is not an identity problem.

A liveness step establishes that a real person is in front of the camera at that moment. It does not establish that the person will remain the user of the account. No source used in this article reports a method that detects a person's willingness to act as a mule from a document or face check, and this article does not claim one exists.

The handover after opening

Muling often consists of a handover that happens after the check: a login passed to a handler, a card given to someone else, or an account sold. An identity check at opening cannot see these events. A check repeated at moments when an account changes character, such as a new device, a changed contact detail or a reactivation after a quiet period, can show whether the person using the account still matches the person who opened it. That is a way to test the handover, not the willingness, and its value depends on how the firm chooses its trigger points and what it does with the answer.

The limit of one firm's view

The UK assessment gives a warning about sharing. Its figure that only 37% of the mules offboarded by 25 firms were reported to the National Fraud Database means that a firm that closes an account and does not report it leaves other firms without the information. The assessment notes that the Economic Crime and Corporate Transparency Act introduced information sharing provisions which allow firms to share customer information voluntarily when there are financial crime concerns, giving a network view of the risk. Identity data that is verified and structured can make such sharing easier, but the sharing itself, and its legal basis, are matters for the firms and their counsel.

What an identity check can contribute

The sources support three modest contributions, and each has a limit.

1. Raising the cost of false identities. Europol says that organised mules open accounts using fake documentation to deceive know-your-customer procedures, and the UK assessment mentions artificial intelligence used for synthetic accounts. A document check and a face check are the means by which a firm tests whether an identity is real. The limit is that they do not address the first three rows of the taxonomy.
2. Linking accounts. Where a firm lawfully keeps verified identity data, it can look for the same document or the same person behind more than one account. The limit is that this works within one firm's records and under data protection rules.
3. Supporting later action. When a firm later needs to report, freeze or close an account, reliable records of who opened it and how they were verified support the report. The limit is that evidence of identity is not evidence of purpose.

Behind all three is the observation that the receiving firm has a reason to care. In the United Kingdom, the PSR's reimbursement requirement splits the cost of reimbursement 50:50 between sending and receiving firms. Whether that changes a firm's approach to opening accounts is a matter for the firm, and this article does not claim a measured effect.

Questions for a firm or a vendor

1. Which row of the taxonomy does this control address?
2. What does the check do about an account that is handed over after it has been opened?
3. Does the firm repeat verification at trigger points, and who chooses them?
4. What does the firm do when it closes a suspected mule account: who is told, and where is the record kept?
5. How does the firm learn that an account opened with a verified identity has received the proceeds of a scam?
6. Does the vendor or the firm claim a rate of detection, and if so, on what test set, with which definition of a mule, and measured by whom?
7. What does the firm do for the person who turns out to be unwitting or coerced?

For the person approached

Europol's guidance for people who are offered easy money is short and applies to anyone. It advises never giving a bank account or personal details to anyone you do not know and trust, ignoring any job offer that involves moving money through your own account, and reporting such adverts to the platform. If you suspect you are caught up in a scheme, it advises stopping the transfers immediately, telling the bank or payment provider, and reporting to the national police. It adds that illegal money will come and go through the account, but that responsibility will stay with the account holder.

Where this sits in a verification flow

Identity verification in a flow establishes who is behind an account at a moment in time: it checks the document, compares the face and tests that a live person is present. That evidence is useful when an identity is false and of limited use when it is genuine and the person has agreed to something wrong. A firm that wants to address muling will need the identity step and the controls that watch what the account does, share what is learned, and test the handover. To discuss where a verification step fits in your onboarding and your re-verification points, read the identity verification product page or contact the team.

Sources

All sources were fetched on 28 October 2026, except the National Risk Assessment, fetched on 27 October 2026.

• Money Muling, European Union Agency for Law Enforcement Cooperation (Europol), public awareness and prevention guides.
• Paper trail ends in jail time for 1 013 money mules, Europol news, on the ninth European Money Mule Action.
• Illicit Financial Flows from Cyber-enabled Fraud, Financial Action Task Force, publication page, 9 November 2023.
• FIN-2020-A003, Advisory on Imposter Scams and Money Mule Schemes Related to Coronavirus Disease 2019, Financial Crimes Enforcement Network, 7 July 2020.
• National Risk Assessment of Money Laundering and Terrorist Financing 2025, HM Treasury and Home Office, July 2025.
• Fraudscape 2026: Fraud cases hit record highs as criminals adapt and scale, Cifas press release.
• APP scams, Payment Systems Regulator.
• Create a KYC session, NeuroVision documentation.