Following the Fraud: What New UK Research Reveals About Money Mule Networks

Why Money Mules Are a National Security Threat

The stark role that money mules play in undermining the UK digital economy has been highlighted in research by the Royal United Services Industry (RUSI), using data from Lloyds bank. They draw on previous comments they made about fraud (which makes up 40%+ of UK reported crime) being a ‘national security threat.’

This research is one of the first times a forensic lens has been applied to where money goes when it leaves a mule account. Until now, the focus has been identifying mule accounts via the money going into them — something which the UK PSR regulations last year forced most UK banks to concentrate on.

How Money Moves: Faster Payments, Cards, and Cash

This study looked at two months’ worth of data in 2024 analyzing the outflows of money from identified mules. The outcome of this is revealing:

• £7.2M was moved from mule accounts
• Mostly sent by Faster Payments — 57%
• Next most common was debit cards — 20%
• Then cash via ATM or Branches — 10%

There isn’t much surprise that Faster Payments was the preferred choice, but this figure is probably down compared to 2023 as this is when UK banks started to focus on money mule detection.

The Oversized Role of Digital Banks and Payment Providers

However, when we look at the faster payments there was a concentration of funds going to newer digital banks or payment platforms (who might not have invested as much in mule detection):

• 38% to three payment providers/digital banks (i.e., not a traditional financial institution)
• 20% actually went to a single provider

It is known that some payment companies have been providing virtual IBANs and it is probable that they were abused in some of these cases. It shows their controls are not as mature as established banks.

Cards as a Cashout

Looking at the debit cards more trends can be seen:

• High value large amounts to a particular retailer (Typical buying goods that command a high resale value – such as technology items or watches)
• Smaller value but higher volume payments to Money transfer, foreign exchange or crypto exchanges
• A lot of mundane spending on food, drink, taxis — average payment £107

From a card and 3DS perspective it highlights how increased data sharing between channels in banks is needed; being able to take insights from digital banking into risk scoring for card use (and vice versa) is going to grow over time.

Mule Account Ages

Looking at the age of the mules’ accounts gives insights into how well an established bank is detecting mules:

• 20% of mules were older than five years
• The majority are older than one year

This differs to other banks where Outseer has been co-creating our mule detection; with them newer accounts being used more — the ‘Complicit’ mules from the FBI definition. At Lloyds it appears more ‘Witting’ mules where accounts go from good to bad, either due to people needing money or selling on accounts without appreciating the consequences.

The Speed of Cashouts

The last metric of interest is the speed of money movement:

• Often money left the mule account in less than 15 mins
• Over half of funds moved within an hour
• Less than 15% let in mule account after 24 hours

It shows how Faster Payments equals Faster Fraud! The operational capabilities behind the money mule network should not be underestimated, these are organized criminal networks and they know how exploit financial systems.

Unanswered Questions

One thing that wasn’t referenced to was Open Banking — it is known to be used in some scams to pull money into mule accounts, but there seems to be no usage of it to move money onwards from them. For scams it is being used as there is less awareness of it and not mentioned much in customer education.

Another unanswered question is what happens to the cash — does that go back into other accounts, or is it used in a similar way to debit cards to transfer money overseas via money transfer companies? Or it is being deposited into crypto ATMs — it is common in the USA for scam victims to directly deposit into them. The only way to get more intel on this tracking and arresting a mule as he has the cash.

The Wider Money Laundering Issue

One thing is for certain — this stolen money is being concentrated elsewhere as part of a money laundering process (the final integration stage). Whether this is happening within the UK or overseas is unknown.

Also, Mules are not just used for APP scam cashouts — they are needed for all forms of financial crime as they are actually low-level money laundering. As RUSI says we need to better understand the end-to-end flow of money in mules — not just spotting the mule account.

Final Thoughts

As the UK took the lead on mule detection, this shows how financial institutions must now go beyond that and collaborate on outflow analysis. The next phase of fraud defense will be defined by cross-bank intelligence and real-time data sharing. Outseer continues to lead with our mule detection development that looks at both inward and outward payments.