When a scammer convinces someone to send money, the theft takes seconds. What happens next takes a little longer, and that is where fintechs have their best chance to act. The money almost never stays in the account it was sent to. It is passed on, split up and passed on again, through accounts opened or rented for exactly that purpose, until it can be withdrawn or spent somewhere far from the victim.
Those accounts are called money mules. Some are opened with stolen or borrowed identities. Some belong to real people who were paid a small fee to "receive a transfer for a friend". Either way, every fintech that holds customer balances is, sooner or later, holding some of them.
How the money moves
The shape is usually the same. The first account receives the full amount and forwards it quickly, before the victim or their bank can raise a dispute. The money is then split across several more accounts, often in similar amounts chosen to stay under transfer limits or reporting thresholds. At the end of the chain it is withdrawn in cash, spent, or moved somewhere harder to trace.
Speed is the point. Every hop makes recovery harder, and once the money has left the network of institutions that talk to each other, it is usually gone.
The signals that give mules away
A single transfer from a mule account rarely looks suspicious on its own. The giveaways are in the pattern around it:
- A young account. Many mule accounts are days or weeks old. Their first activity is often a small "test" transfer to a beneficiary they have never paid before, to check the route works.
- Money in, money straight out. A normal customer leaves part of a credit in their balance and spends it over time. A mule forwards almost all of it, within minutes.
- Several small transfers to the same place. Instead of one large payment, the account sends three or four smaller ones to the same destination in a short window.
- Many transfers with very few distinct amounts. A week of transfers that are almost all the same size is unusual for a person and normal for someone moving money on instructions.
- Money that comes back. Funds sent from one account to another and then returned make a transaction history look busy and legitimate. Real customers rarely do it.
Why mules are hard to catch
Mule activity sits between institutions. The victim is at one bank or fintech, the first mule at another, the next hops somewhere else again. Each institution sees one or two steps of the chain and a story that, from its side, looks almost ordinary.
Two things follow. First, you have to judge each account on its own behaviour over time, not on one transaction. Second, you have to do it fast: a check that runs overnight finds the mule after the money has already gone.
Mistakes we see
- Scoring transfers one at a time. Each transfer is small and unremarkable. The pattern only appears when you look at the account across hours and days.
- Only watching large amounts. Mule networks split money precisely so that no single transfer is large. A rule that only fires above a big threshold misses the whole chain.
- Treating every new account the same. A new account paying a utility bill and a new account sending small amounts to strangers are very different. Account age matters most combined with who is being paid.
- Freezing first and asking later. Many accounts that look like mules belong to real people who were deceived. Send them to review with clear reasons, so an analyst can decide quickly and fairly.
A checklist for your team
- You know the age of every account at the moment it sends money.
- You can tell whether a beneficiary has been paid by this account before.
- Your checks look at the last hour, day and week of an account, not just the current transfer.
- Small transfers are watched as closely as large ones.
- A suspected mule goes to review with reasons, not straight to a permanent freeze.
- Confirmed mule cases are recorded against the transactions, so your models can learn from them.
Where ArcheaOne fits
Mule networks rely on speed, and on each institution seeing only part of the picture. ArcheaOne was built for exactly this: a real-time fraud detection platform designed for how money actually moves in Africa, through instant transfers, mobile money and brand-new accounts.
- Suspicious account behaviour flagged while there is still time to stop the money.
- One clear alert per pattern, with reasons, instead of a flood of noise.
- Suspected mules sent for review, so customers who were deceived are treated fairly.
Want to see it on your own transfers? Request access to ArcheaOne.