The interconnected world
of scams and mules
Inspired by real data from the LexisNexis® Cybercrime Report.
Learn more about effective scams and mules prevention strategies in the latest report.
Jenny lives outside of Sao Paulo, Brazil, where she’s recently retired. She thinks she’s been chatting online with Tommy, a writer from London, for months now. Sparks are flying, and they plan to meet up soon. But then Tommy has an emergency and says he needs money to help his brother with a medical crisis. Jenny transfers funds to Tommy’s account…or so she believes.
This is a classic romance scam, and it’s officially underway.
A mysterious third party, Riley, plays a crucial role in this fraud: He’s the person whose account actually receives Jenny’s funds. He’s a money mule, a support worker who helps criminals launder money through multiple accounts across the global financial system.
Some mules are willing accomplices, who open accounts specifically to enable and profit from financial crime. Others may not even know what they’re doing is illegal: For example, they might be college students recruited on social media with the promise of quick cash for easy work. As we reported in the Global State of Fraud and Identity Report, in the UK, 40% of money mules are under the age of 25, and one in five is younger than 21.
Other mules might be blackmailed or coerced into criminal activities. They could be lured from anywhere in the world that has digital capabilities. Criminals dupe them with a deceptive job offer, then hold them captive and force them to work in modern digital sweatshops where they commit fraud or suffer consequences. In a recent study of 7,000 mule transactions affecting a bank in Southeast Asia, we uncovered significant mule activity in populations clustered close to national borders – likely supported by a workforce of trafficked humans.
Three kinds of mule accounts emerge from AI-driven analysis of data from LexisNexis® Digital Identity Network® and beneficiary account intelligence from UK Banking Consortium members.
Why Mule Use is Growing
As the financial services industry offers new payment channels in response to consumer demand, including cryptocurrency and peer-to-peer transfers across borders, mule networks are leaping to take advantage. Combining these newer, potentially cross-border, methods of transferring funds with more traditional methods like bank accounts and credit cards helps to evade detection. In the UK, where scams first made headlines years ago, mule-related money movements seen in Digital Identity Network® are up 65% year-over-year.
How Money Mules Benefit Scammers
Mules hide the scammer's identity
Mules allow scammers to stay anonymous, distancing the scammer's crimes from law enforcement.
Mule accounts add legitimacy
Mules provide scammers with indirect access to legitimate accounts, helping circumvent identity verification and anti-money laundering processes.
Mule networks add resilience
Mules are replaceable and plentiful, providing scammers resilience in the face of law enforcement action and the ability to scale activities.
How Alternative Payment Methods
Benefit Scammers
Transfers are instant
Modern payment platforms, like peer-to-peer transfer and cryptocurrency platforms, are often less regulated than traditional banks, and payments can be processed in seconds rather than days.
Accounts are anonymous
The anonymous nature of cryptocurrency makes it harder for businesses and law enforcement to tie scammers to the money their mules are moving.
Payments are irrevocable
Some platforms won’t reverse a completed transaction; for others the process may take hours, making it easier for scammed money to slip away forever.
DIARY OF A BUSY MULE
Here’s how mules help scammers operate effectively, quickly and invisibly
Before the scam begins, the scammer recruits mules, so they can set up accounts, master quick-action protocols and be ready to move the instant the scam victim sends money.
Exploited mules may already have pre-established accounts with their own payment histories, ready for action. Complicit mules, ready to leverage their identities for cash, will open a variety of accounts at banks, cryptocurrency exchanges and other institutions. They’ll then make small and arbitrary debits and credits to establish payment histories and build trust.
With the mule network in place, the scammer confidently works his target. Under the scammer’s influence, the target transfers funds to a mule account and the mule network springs into action.
Mules may access their accounts dozens or hundreds of times a day, watching closely for deposits to come in. As soon as money arrives, the mule forwards or withdraws the funds, possibly dividing them into multiple payments.
The scammer, meanwhile, is still pressuring Jenny, the increasingly suspicious target, trying to get her to keep paying. Eventually, though, Jenny’s patience (or money) runs out. Betrayed and devastated, Jenny takes action to get the funds back, possibly reaching out to her bank or to law enforcement.
As authorities attempt to track down the stolen money, Riley quickly captures the last of it in his crypto exchange. He might then transfer the money to another mule, in a transfer chain that continues to proliferate, laundering the money across multiple accounts before the money eventually makes its way to the scammer.
With this victim squeezed dry, the mules quickly move on to the next scheme, closing their accounts behind them and leaving an ice-cold trail for law enforcement (likely understaffed) to follow.
Networks of mules powering scam activity are large and growing. In 2024, Europol conducted a sweep across 26 countries that identified 10,759 money mules and 474 recruiters.1 Less than a tenth of this group were arrested in the investigation.2 The US Department of Justice launched a similar investigation around the same time, identifying 3,000 mule accounts, but ultimately charging only 20 mules.3 Last year, the LexisNexis Risk Solutions UK Banking Consortium noted a 65% rise in money mule incidents over the previous year.
The true scope of muling is unknown, but evidence indicates it could be truly staggering. A recent report by the European Union Agency for Law Enforcement Cooperation suggests that between 2% and 5% of the global GDP is laundered every year.4 Eighty percent of fraud executives in the US and U.K. say more needs to be done to fight mule networks in their industries.5
Mule Networks Can Span the Globe
Mules operate across many thousands of disconnected accounts across the global financial system, so scammers can launder funds quickly and effectively while remaining insulated and invisible. Many mules are not even aware of the crimes they help perpetrate. By exploiting trust and legitimate accounts, they complicate the challenge of separating nefarious transactions from normal financial activity.
It takes a global, established risk-intelligence sharing network to draw out the subtle patterns of mule activity that can lead to actionable insights for businesses. The Digital Identity Network solution analyzes more than 100 billion transactions each year from thousands of organizations around the world to understand the hidden markers of fraud, scams and money muling.
How Mule Networks Are Detected And Disrupted
The Digital Identity Network performs deep analysis of contextual data at scale, including digital identities and beneficiaries, accounts and devices, account openings and login history, and hundreds of other elements across industries and around the world. Digital identity intelligence helps to draw out the faint signals of mules earlier than approaches that focus purely on money flows. Disrupting mule networks ultimately helps to protect more consumers from scams.
As the financial system continues to reward customers with more choice, convenience and reach in payment channels, bad actors will keep searching for ways to take advantage. One example is the Faster Payments Service in the UK, which launched in 2008 and now accounts for over 90% of APP fraud losses.6 Another example is generative AI: criminals are increasingly using the powerful new technology to improve the effectiveness of scam tactics and synthesis of identities for mule accounts.7
Mules are essential to scammers, facilitating money movement so their attacks on consumers can work at a truly terrifying scale. To combat this, businesses need to leverage cross-industry intelligence, link insights contextually across multiple datasets, and use AI-powered analytics to draw out suspicious patterns too complex for legacy detection approaches. With a sufficiently robust solution in place, security professionals can make these crimes less profitable, and even dismantle mule networks early, so they can protect their consumers against increasingly sophisticated scams and let them get back to enjoying their lives.
Get the LexisNexis® Cybercrime Report, and see how we help to detect and disrupt money mules.
Read the LexisNexis® Cybercrime Report Now
This document is for educational purposes only and does not guarantee the functionality or features of any LexisNexis Risk Solutions services identified. LexisNexis® Risk Solutions does not warrant that this document is complete or error-free. LexisNexis and the Knowledge Burst logo are registered trademarks of RELX Inc. Digital Identity Network is a registered trademark of ThreatMetrix, Inc. Other products and services may be trademarks or registered trademarks of their respective companies.
Copyright © 2025 LexisNexis Risk Solutions.
Built with Shorthand