Mule Account Detection for Banks: What the Receiving Side Can See

If you are researching mule account detection for banks, you are probably asking a plain question: what can our bank see about the accounts that scam money lands in, and what should we do with it? A money mule is a person whose account is used to receive and pass on funds for someone else, sometimes knowingly and sometimes not. Detection starts with what the receiving bank can see, and that is different from what the sending bank can see.

What the Receiving Side Can See

The sending bank sees its customer and the payment in front of it. The receiving bank sees the account on the other end: what comes in, how that compares to the account's history, and where the money goes next. That is why many approaches look for an unusually large credit into a quiet account, or for money that leaves again soon after it lands.

Why Mule Account Detection for Banks Is Getting Attention

Since October 2024, the UK has required the receiving bank to cover half of eligible authorized push payment (APP) scam reimbursements. An independent evaluation for the UK payments regulator estimated that APP scam losses over Faster Payments fell about 21% afterward, roughly £73 million a year. Firms reported stronger controls on both the sending and receiving sides.

The evaluation did not isolate the receiving-side controls, so treat it as a signal, not proof of which control worked. The UK Financial Conduct Authority's review of mule-detection tools adds detail on what firms used, including a tool that traces the proceeds of fraud across Faster Payments and checks against a national fraud database. It also found gaps, such as slower action on alerts about accounts further down the chain.

What a U.S. Bank Can Use Today

A U.S. bank is not starting from zero. Nacha now requires every receiving financial institution to have a risk-based process for incoming ACH credits. On FedNow, the negative list lets a participant reject payments to or from listed accounts, and the network intelligence API, launched April 28 for early adopters, gives receiver account-level data observed over FedNow. FinCEN's June 12 guidance confirms that a financial institution may share information about suspected fraud with other eligible financial institutions under section 314(b).

There are limits. Each of these covers part of the picture. I'm not aware of a U.S. counterpart to the UK's mandatory reimbursement rules that splits losses between sending and receiving banks, and holding or returning incoming funds has to be assessed against your own legal authority, the rules of the rail and your customer protections.

Questions to Settle First

• When we spot an account that may be receiving scam money, what can we still do, and for how long?

• Do fraud, AML and payments look at that account the same way, at the same time?

• Do we find suspect accounts ourselves, or do we hear about them from other banks?

• When we hold funds or restrict an account, who investigates the concern, talks to the customer and corrects mistakes?

  
  

This is the practical version. The larger question is how a bank connects what it knows about receiving accounts to decisions made elsewhere in the payment. I take that on in this week's issue of The Instant Edge, “Whose Account Did the Scam Money Land In?”, which I write every Wednesday for senior leaders at banks and credit unions.