Money Mule

An individual who transfers or receives funds on behalf of another party, often using personal bank accounts or cash. They typically follow instructions to deposit, withdraw, or remit sums across various financial channels, sometimes in exchange for compensation.

[
Code
AT0076
]
[
Name
Money Mule
]
[
Version
1.0
]
[
Category
Criminal & Illicit Networks
]
[
Created
2025-03-12
]
[
Modified
2025-04-02
]

Related Techniques

T0016.004
|
|

Money mules facilitate ATM structuring by:

  • Physically depositing sub-threshold amounts of illicit cash into ATMs, following instructions from criminal organizers.
  • Using multiple ATMs or staggering deposits to avoid detection.

By relying on individuals who appear customer-like to the bank, criminals circumvent more thorough in-person monitoring, increasing challenges for financial institutions in identifying aggregated suspicious activity across different accounts or deposit points.

Money mules transfer or receive funds on behalf of illicit operators, facilitating the layering of victim payments. They may be fully aware or unwittingly recruited under false pretenses. By swiftly moving the money through multiple accounts, often across borders, they complicate financial institutions' ability to detect or trace the fraudulent proceeds, obscuring the link between the source and beneficiary.

Provides bank, e-wallet, or crypto accounts that the automation controls; each mule account becomes a temporary hop in the scripted chain.

Money mules act as third-party depositors, physically placing cash into various accounts on behalf of illicit operators. They often structure repeated deposits below regulatory thresholds across multiple branches in quick succession.

This tactic fragments the deposit pattern, making it more difficult for financial institutions to detect the aggregated flow of illicit funds.

Money mules, whether acting knowingly or unknowingly, conduct deposits, chip purchases, and redemptions on behalf of criminals. By splitting transactions below reporting thresholds and distributing them across multiple patrons or accounts, they obscure the ultimate source of funds and complicate financial institutions' due diligence.

Money mules conduct structured deposits or withdrawals involving proceeds from illicit commodity trade.

  • Multiple participants (smurfing) deposit funds in small increments across different accounts or institutions.
  • This fragmentation obscures the link to the underlying criminal source for financial institutions.
T0011.002
|
|

Money mules deposit or withdraw illicit cash via crypto ATMs with minimal identification.

  • They receive physical currency from criminal sources and convert it to cryptocurrency, adding layers between the original illicit proceeds and later transactions.
  • By making frequent or structured deposits across multiple machines, they obscure transaction patterns, hindering financial institutions' ability to detect suspicious flows.

Sometimes recruited to open accounts/wallets, receive cryptojacked funds, and help break the audit trail by consolidating or cashing out assets on behalf of cybercriminals.

T0013.006
|
|

Individuals act as straw buyers or mules by receiving illicit funds to purchase high-demand items abroad on behalf of daigou coordinators. This arrangement distances the launderers from direct scrutiny, making it harder for financial institutions to trace the illicit source of funds.

Perpetrators clone the voices of money mule account holders to pass call-based identity checks, initiating unauthorized transactions under the false pretense of legitimate ownership. This tactic circumvents typical red flags associated with money mule activity by leveraging realistic-sounding verification calls.

T0086.001
|
|

Money mules act as third-party payers by:

  • Submitting premium payments on behalf of the criminal policyholder, masking the true source of funds.
  • Operating knowingly or unwittingly, thereby inserting additional layering steps into the payment chain.
  • Concealing the genuine relationship between the funds’ origin and the policyholder, complicating financial institution monitoring.

They receive or transfer relief funds on behalf of others, often using personal accounts to layer and move illicit proceeds. By conducting multiple smaller transactions or forwarding sums to additional accounts, they hinder financial institutions' ability to detect the ultimate beneficiaries.

Individuals are recruited under the guise of legitimate work who:

  • Receive illicit funds into their personal accounts on behalf of the fake employer.
  • Transfer or withdraw these funds at the instruction of criminals, often unaware of the illegal nature of the activity.
  • Exploit lower transaction monitoring thresholds associated with personal accounts, making detection by financial institutions more challenging.

They frequently face legal or financial repercussions, despite believing they are merely performing legitimate remote tasks.

Money mules, either unwittingly or knowingly, use stolen personal data or forged documents to open new accounts or perform transactions. They:

  • Provide their personal banking credentials (or newly created accounts) for criminal funds.
  • Make rapid deposits and transfers under false identities, reducing the chance of detection by financial institutions.

Criminals enlist third-party payers with no explicit link to the policyholder to funnel illicit funds into the financial product. These money mules may or may not realize they are part of a laundering chain. Financial institutions are misled by observing multiple unrelated sources funding the same policy or account.

Money mules facilitate funnel accounts by:

  • Depositing illicit cash into personal or business accounts under criminal instruction, often below threshold reporting limits.
  • Subsequently transferring or withdrawing funds in other regions, breaking the transaction chain between deposits and ultimate beneficiaries.

They may act knowingly or unknowingly, enabling criminals to layer and move funds.

They act as smurfs by:

  • Depositing modest sums of cash into various personal or provided accounts across different branches or institutions.
  • Following specific instructions to keep each deposit under suspicion thresholds, unwittingly or knowingly aiding in layering illicit proceeds.

This role is critical in distributing transactions so they appear unrelated.

Mules receive illicit relief proceeds in personal or nominee accounts on behalf of others. They:

  • Transfer, withdraw, or distribute funds at the direction of the primary fraud perpetrators.
  • Add extra layers between the source of funds and potential investigators, complicating financial institution monitoring.

Money mules facilitate immediate cash conversion by:

  • Conducting repetitive withdrawals at ATMs or teller windows in amounts kept just under reporting thresholds.
  • Adding layers between the primary criminal and the withdrawn cash, either knowingly or unknowingly, making it more difficult for financial institutions to identify illicit transaction patterns.

Unwitting money mules facilitate intermediary-facilitated transfers by:

  • Allowing criminals to use personal accounts for routing illicit proceeds, often without full awareness of wrongdoing.
  • Adding transaction steps that appear legitimate and distancing the primary criminal actor from suspicious flows.

This extra layer makes it harder for financial institutions to detect the illicit source and ultimate beneficiary of the funds.

T0144.015
|
|

Money mules, knowingly or unknowingly, assist lottery scammers by:

  • Receiving and forwarding victim payments labeled as 'lottery fees' or 'taxes' in personal accounts.
  • Quickly transferring or withdrawing funds across various jurisdictions, obscuring the money trail.

Their involvement dilutes transactional transparency for financial institutions, making it difficult to identify the fraudulent nature of incoming and outgoing funds.

Money mules unwittingly or knowingly participate in micro-structuring by:

  • Opening or using personal accounts to place frequent small deposits or withdrawals on behalf of criminals.
  • Following instructions to move funds across different financial channels, obscuring the link to predicate offenses.

Their involvement frustrates financial institutions' efforts to aggregate or detect unusual patterns in real time.

Money mules are unwitting or complicit individuals who funnel illicit proceeds through personal or business accounts. They:

  • Receive instructions to deposit, transfer, or withdraw funds under their own credentials, hiding the true beneficiaries.
  • May include family members or close associates who are co-opted—knowingly or not—into facilitating illegal transfers.
  • Conduct frequent, structured, or rapid transactions that fragment the financial trail, making it harder for financial institutions to detect suspicious patterns.

Money mules are individuals—knowingly or unknowingly—who receive and move illicit funds through personal or newly opened accounts. Their actions facilitate placement and layering by:

  • Providing rapid access to legitimate financial channels, reducing initial scrutiny from financial institutions.
  • Allowing criminals to deposit illicit proceeds into multiple personal accounts, complicating transactional analysis and source-of-funds monitoring.
  • Accepting instructions to disburse funds onward or withdraw cash, further obscuring the criminal origin of the assets.

Phishing victims unwittingly transfer illicit funds through their personal accounts. They typically:

  • Receive deposits of stolen or fraudulent funds under the false premise of employment or urgent service requests.
  • Forward these funds to other accounts at the criminals' instruction, believing they are performing legitimate financial tasks.

This exploitation complicates financial institutions' customer due diligence and transaction monitoring, as the mule's account appears to belong to a legitimate customer, obscuring the true criminal beneficiaries.

Money mules enable layering by:

  • Opening accounts at regulated exchanges—whether knowingly or under false pretenses—on behalf of illicit operators.
  • Receiving and forwarding funds to external accounts, complicating the transaction trail.
  • Providing personal or business account credentials that shield the true origin and beneficiary of the funds from financial institution scrutiny.

Money mules receive a series of low-value transfers under false or multiple sender identities and:

  • Collect the cash proceeds soon after the transfers arrive, leaving minimal paper trails.
  • May act knowingly or unknowingly, facilitating the final link in the laundering chain by disconnecting the funds from their criminal origin.

This role prevents financial institutions from pinpointing the true beneficiaries or correlating multiple suspicious transfers when the withdrawals appear as isolated, small remittances.

Money mules are individuals who, either unwittingly or knowingly, allow their accounts to be used for laundering proceeds under the guise of romance:

  • Victims fall prey to emotional manipulation and transfer illicit funds to other accounts, obscuring the true criminal source.
  • Their involvement creates additional layers that challenge financial institutions' ability to detect and block suspicious transactions.
T0016.005
|
|

Money mules, commonly referred to as ‘smurfs,’ are individuals who knowingly or unknowingly deposit or transfer small amounts for illicit operators:

  • Opening or using accounts to process repeated low-value transactions under reporting thresholds.
  • Fragmenting larger sums to evade alarms, obscuring the overall volume of illicit funds involved.

Money mules are individuals, often unwittingly recruited through social media offers of quick earnings, who receive illicit funds into their personal accounts and then transfer or withdraw these funds on behalf of others. This repeated movement of funds complicates financial institutions' efforts to trace the true source and intended beneficiaries.

Money mules, knowingly or unknowingly, assist in structuring by:

  • Accepting or depositing small sums on behalf of illicit operators.
  • Withdrawing or transferring these amounts across multiple accounts or locations in rapid succession.

Financial institutions struggle to detect these repeated, low-value transfers when they appear isolated, making it more challenging to identify the total volume of illicit funds.

Money mules directly receive or transfer illicit funds on behalf of criminals:

  • They often act as unwitting participants, depositing or withdrawing funds through personal accounts.
  • This masks the origin and flow of proceeds, complicating financial institution monitoring and beneficial owner checks.

Money mules receive or transfer fraudulent unemployment benefits on behalf of third parties through:

  • Multiple personal accounts that quickly disperse incoming disbursements, obscuring the original source.
  • Voluntary or unaware participation, adding extra layers of complexity for financial institutions monitoring suspicious activity.

They knowingly or unknowingly facilitate wire transfers from personal or third-party accounts by:

  • Receiving funds on behalf of others and quickly forwarding them to additional accounts.
  • Keeping balances low between transfers to prevent obvious red flags.
  • Executing repeated cross-institution transfers as part of a layering process.