Criminals often cash out by the second account in a chain, so the first account is where banks need to act. Two respondents explain which behaviour signals they would trust, and where the limits lie.

Money mule accounts are how stolen money moves. A victim’s payment lands in one account, passes through several more, and leaves as card spending, crypto or a transfer abroad. As a result, a bank that spots money mule accounts late usually finds an empty balance. Our piece on AI fraud models covers the tools. This roundup asks which signals come first.

We asked one question: how is your team spotting money mule accounts earlier, and which signals have proved most reliable? We wanted financial crime and fraud leads at banks, neobanks and payment firms, with anonymised examples over general principles. Two people answered in this round, and we used both. Neither works in fraud at a bank or payment firm, so we’ve checked their advice against what the regulator has found.

Fintechbits analysis

Why the first account matters most

The Financial Conduct Authority’s multi-firm review of mule activity, published on 23 September 2026, explains the urgency. Firms offboarded 238,396 suspected money mule accounts in 2025, up from 184,935 in 2023. In a study of 140 cases, criminals usually cashed out between the second and fifth account in a chain. Most often, they did it at the second. Therefore, a bank that waits to see a pattern across several money mule accounts will often be too late.

The volumes keep rising, too. Fraud prevention body Cifas recorded more than 22,000 cases under its new money mule category in 2025, according to Fraudscape 2026. Meanwhile, mule cases rose 69% in the first half of 2026 against a year earlier, AML Intelligence reported from Cifas data.

Rank behaviour above login flags

Lilach Bullock is an AI implementation consultant and fractional CMO who advises businesses rather than fraud teams.

“The most reliable early signal is behaviour that doesn’t fit the account’s stated business purpose. In order of reliability, I’d start with money arriving from several unrelated senders and leaving within hours to one new payee. After that come payouts in round amounts, then a balance that’s almost empty by the end of the day, then an account that’s only days old, where I’d set tighter thresholds. I’d weight all of those above device or login flags. A business owner I worked with had a payment to a new freelancer held with no explanation and nearly switched banks. One message about the payee would have cleared it.”

Lilach Bullock, AI Implementation Consultant and Fractional CMO, Lilach Bullock

Her focus on new accounts fits the FCA’s data. In 2025, 47.1% of offboarded money mule accounts closed within a year of opening, the regulator found. So tighter limits on young accounts can catch many money mule accounts early. Still, the FCA does not rank indicators, so putting behaviour above device flags is her view rather than settled practice.

Her anecdote also points to a real rule. Since October 2024, UK payment firms can hold a suspicious outbound payment for up to four business days. However, they must tell the customer why, as Grant Thornton explains. She is not a fraud practitioner, and we could not verify the client example.

Watch for bursts, device shifts and sudden jumps

Abhishek Pareek is founder and director of Coders.dev, a marketplace for outsourced software developers.

“Spotting money mule accounts early means moving beyond one-off identity checks to how an account behaves in real time. KYC confirms that a person exists, but it can’t tell you when their account has been rented out or taken over. The strongest signal is a sudden burst: a quiet account receives a large credit, then sends a flurry of transfers to unrelated people, often within the hour. That pattern strongly suggests someone else is now running the account.

Device and location shifts matter too. If an account that’s normally used on one phone in New York suddenly sends money from a desktop browser routed through a proxy or hosting provider, it may have changed hands. That’s especially telling when it happens alongside new payees or attempts to skip the bank’s cooling-off period for new payees.

Account age against activity is the other one to watch. Recruiters sometimes tell mules to make small, ordinary-looking payments for months to build a clean history. The warning sign is a sudden jump from small peer-to-peer payments to business-sized inflows that leave straight away. Any sharp break from the account’s own history should trigger a soft hold or a manual review before the money goes.”

Abhishek Pareek, Founder and Director, Coders.dev

The burst he describes is the classic pass-through pattern. FinCEN’s 2020 advisory on money mule schemes listed pass-through activity and atypical overseas transfers among its red flags. However, we found no source for a fixed sixty-minute window, so we’ve softened that line. A burst alone also does not prove an account has changed hands.

His point about new payees still matters, because a controller may add payees and move money in one session. We found the idea of mules building a clean history only in vendor material, so treat it as his view. Coders.dev builds software rather than running fraud controls. His answer reads as design advice for spotting money mule accounts, not a bank case study.

Where money mule accounts cash out

The FCA also looked at how money leaves. Card payments were the most common cash-out route, often as many low-value transactions. International and crypto cash-outs were fewer, yet typically larger. In addition, some money mule accounts were reused across different fraud types, which the FCA links to organised criminal networks. So a spike in card spending on a new account deserves as much attention as a large transfer abroad. Networks are building for this too, as our report on Visa A2A Protect and its mule-network tools shows.

What works against money mule accounts

The evidence points to a simple order of work. First, set tighter limits on new accounts, since many money mule accounts close within a year of opening. Next, watch for funds that arrive from several senders and leave quickly to new payees. Then treat device and location changes as supporting signals, especially when they coincide with new payees. Finally, when you hold a payment, tell the customer why. A short message keeps honest customers and gives the bank time to check the payee. Shared intelligence helps as well, because the FCA found linked accounts and repeat cash-out routes across firms.

What to watch next

Mule volumes are still climbing, so the next Cifas figures will show whether money mule accounts keep growing through 2026. Also watch whether the FCA turns its review into firmer expectations on early detection. The regulator already expects firms to look beyond the receiving account, including linked accounts and wider transaction context.

Above all, the evidence points to speed. Criminals often cash out by the second hop, so the first bank in the chain carries the most weight. Banks that act on money mule accounts at that point, and explain the hold to the customer, stop the most money.

FintechBits covers payments, banking and fintech developments for readers in the US and UK. This article is for information only and is not financial or legal advice. Views expressed are those of the FintechBits editorial team.