Mule networks
Accounts held by real people and used by somebody else. The holder is often a victim, which changes what the right outcome is as well as what the pattern means.
A money mule is a person whose account is used to move somebody else’s funds. Onchain that usually means a verified customer receiving funds from strangers and forwarding them on, keeping little or nothing.
A network is a set of them operating together, so the pattern is rarely visible in one account. It is visible in what several accounts have in common.
Why it is treated as a concern
Mule accounts are how proceeds reach the regulated system wearing somebody else’s identity. Verification worked, in the sense that the person is who they said. It did not establish whose money is moving, and that gap is the whole typology.
What it looks like
Signature patterns
- Receive and forward, quickly
Funds leave within hours of arriving, at close to the full amount. The account holds a balance only in transit.
- Many senders, few recipients
Funds arrive from unrelated addresses and leave to one or two.
- Activity that does not match the person
Volumes inconsistent with the declared occupation, income or purpose on file.
- A dormant account waking up
Verified a long time ago, little or no use, then sudden throughput.
- Shared details across accounts
A device, an address, a phone number or a funding source in common between customers who say they do not know each other.
Four of the five indicators are visible in this one account. The fifth, details shared with customers who say they are strangers, is not: it only appears across accounts, which is why a network is invisible to records that cannot be searched that way.
Four indicators show in one account. The fifth only shows across several.
Where to look
| Look at | For |
|---|---|
| Time between in and out | Hours rather than days, repeatedly. |
| The proportion retained | A consistent small cut, or nothing at all. |
| The customer record | Occupation, declared purpose and age of the account against the volume moving. |
| Other customers | Shared devices, funding sources or destinations. One account rarely shows the pattern. |
| Onboarding date against first activity | A long gap followed by immediate throughput. |
The fifth row is the one that distinguishes a network from an individual, and it is the one a single-case view cannot answer. If your records cannot be searched across customers, the pattern is effectively invisible.
What else produces this shape
Common false positives
- Family remittance
Receiving from several relatives and forwarding to one recipient abroad is the same shape and is ordinary.
- A collection account
Someone collecting for a group, a club or a shared purchase receives from many and pays one.
- A small business taking payments
Many customers in, suppliers out, little retained. The declared purpose settles it.
- Shared infrastructure
Customers in one household or one workplace can share a device or a network legitimately.
What this changes
Where the pattern fits, the useful question is not whether the customer is dishonest. It is whose funds are moving and who directed the movement. The answer to the second is often not the account holder, and the record should say which of the two you established.
Related
What a typology is
A typology is a named pattern of financial crime, written down precisely enough that two people looking at the same case reach the same view about whether it fits.
Why one customer has many addresses
A customer with one wallet routinely holds hundreds of addresses. A wallet declaration names the ones they told you about, on the day they told you.
When to escalate
Suspicion on reasonable grounds is judged objectively, so the question is not how certain you feel. It is what a reasonable person in your position would conclude from the same record.
Last checked against the product on .