Money Mule Accounts: Signs in Bank Records

Signs of a Money Mule Account

A suspected mule account receives money from unrelated people or businesses and sends much of it onwards soon afterwards. Look for a combination of signals across the supplied records:

• Credits from people with no apparent connection to the account holder.
• Onward transfers within minutes or hours of those credits.
• Repeated cash withdrawals at different ATMs after incoming payments.
• A balance that repeatedly falls back to almost zero.
• A previously quiet account suddenly handling sums far above its usual activity.

Compare the account with its own history. A student’s account that previously held wages and ordinary living expenses needs explanation when it begins receiving many strangers’ payments. A business account collecting customer payments has a different baseline. Inspect invoices and the account holder’s explanation before treating ordinary turnover as mule activity.

AUSTRAC’s money mule guide says a single indicator does not establish mule use. The AFP and AUSTRAC recruitment warning describes people who believe they are performing legitimate work. Deliberate participation and deception can produce similar transaction patterns.

How Mule Networks Move Money

Mule networks place account holders between the fraud victim and the people controlling the stolen money. Recruiters use fake job advertisements and social media contact. Romance contact can also produce requests to receive money and forward it on a supposed partner’s behalf.

A fake payment-processing job gives the account holder a reason for receiving strangers’ payments. The recruiter supplies transfer instructions and promises a fee. Each additional account separates the organiser from the original victim, and a mule may know only their own recruiter.

The AFP’s joint recruitment warning describes fake advertisements and profiles, with money forwarded after a commission is deducted. Preserve the advertisement as well as the later instructions. Its description of the supposed work can explain why the account holder accepted the payments.

Common exits include crypto exchanges, overseas transfers and cash. AUSTRAC’s banking findings describe scam funds sent offshore through exchanges, remitters and cash. An exchange payment identifies a service to investigate, while a cash withdrawal leaves a different evidence trail.

Funds from an investment scam or a diverted invoice in business email compromise can arrive in the same mule account. Wider money laundering red flags help examine the network beyond that first account.

Reading Mule Activity in a Transaction Ledger

Sort the ledger by account, transaction day and available transaction time to expose credits followed by matching exits. Keep the original description and source reference beside each entry. A daily total can hide several separate pass-through payments.

This fictional Australian-dollar extract starts with a zero balance. All entries occur on the same transaction day, and every onward payment has a preceding credit.

Both onward transfers follow their credits after 14 minutes. The account retains $200 from the first credit and $300 from the second. Each retained difference is 5% of the corresponding credit. The later withdrawals remove the accumulated $500.

Those differences are consistent with a fee, but the messages must establish whether the account holder was promised that fee. Bank charges or unrelated spending can also create a difference. Record the calculation separately from the inference about its purpose.

If a statement shows only a day, preserve its displayed order without inventing transaction times. Obtain detailed bank records when precise sequencing affects the analysis. Where funds mix, distinguish an observed onward payment from an allocation inferred from timing and amount.

FinTrace saves investigators and forensic accountants hours of statement conversion and review by consolidating supplied PDFs into a searchable Excel ledger. Its report flags suspicious transfers and cash patterns, with direct references to the source PDF filename and page. You can focus on the movement of money with the supporting evidence already at hand.

Legal Exposure for the Account Holder

An account holder can face proceeds-of-crime offences even when the prosecution cannot prove they knew the money was stolen. The relevant law and fault element depend on the conduct and jurisdiction. Being deceived by a recruiter does not automatically answer a recklessness or negligence allegation.

The Commonwealth Criminal Code, Division 400 includes belief-based, reckless and negligent dealing offences in sections 400.3 to 400.8. Maximum penalties vary with value and fault. For the $100,000 threshold in section 400.4, imprisonment maxima are 20 years for belief-based dealing, 10 for recklessness and four for negligence.

Section 400.9 separately covers dealing with property reasonably suspected to be proceeds of indictable crime. Below $100,000, its imprisonment maximum is two years. These are statutory maxima, not predictions of a sentence. A charge requires analysis of all applicable elements and defences.

State offences also apply:

• In NSW, Crimes Act 1900 section 193B has maxima of 20 years for knowing dealing with concealment intent, 15 for knowing dealing and 10 for reckless dealing.
• In Victoria, Crimes Act 1958 section 194 covers knowing, reckless and negligent dealing. Section 195 has a two-year maximum for dealing where reasonable grounds exist to suspect criminal proceeds.
• In Queensland, Criminal Proceeds Confiscation Act 2002 section 250 has imprisonment maxima of 20 years for knowing laundering and 10 for reckless laundering. Its knowing test includes what the person ought reasonably to know.

Banks can restrict or close accounts used for suspicious activity. AFCA explains account closure complaints and the bank’s contractual rights. Victims can also bring civil recovery claims against a recipient. The claim and any defence depend on the receipt, subsequent dealings and the account holder’s knowledge.

If your client realises their account was used as a money mule, act promptly:

1. Stop further transfers and withdrawals. Do not send money back on the recruiter’s instructions.
2. Contact the bank’s fraud team through a verified bank channel. Identify the suspicious credits and request instructions for securing the account.
3. Report online criminal activity through ReportCyber, or contact the police for the relevant conduct. Keep the report reference.
4. Preserve every recruiter message, advertisement and payment instruction, including usernames and account details. Retain original statements and transaction receipts.
5. Obtain legal advice on criminal exposure and any recovery demand. Give the lawyer the full chronology, including what the recruiter said before each transfer.

Cyber.gov.au’s bank-account recovery guidance directs people to their bank and ReportCyber. Reporting does not replace advice about the account holder’s own exposure.

Tracing Through a Mule to Recover Funds

Each onward transfer gives investigators the next recipient account or payment service to approach for an urgent freeze or recall request. Capture the destination bank, account identifier and payment reference alongside the amount and transaction time. A statement description alone may require the bank’s fuller payment record.

Notify the sending bank promptly and provide the suspected mule-account details. Ask it to contact the receiving institution through its fraud process. AFCA’s receiving-bank guidance discusses freezing mule accounts after a scam report. A request can preserve funds that remain, while a recall depends on the payment and receiving institution’s response.

Where money has already left, follow each exit separately. A transfer to another bank requires that account’s records. A crypto-exchange payment requires information connecting the bank receipt with the exchange account and subsequent withdrawal. Cash exits call for ATM records and other evidence identifying who withdrew the money.

Prepare a transaction schedule that separates confirmed movements from inferred matches. Give each recipient institution the relevant payment details, source record and police report reference. The next urgent step follows the last evidenced destination, even when the first mule account now holds nothing.