Money mule detection for community banks & credit unions

This page is for a fraud manager, a BSA officer, or a new-accounts or digital-banking lead who suspects accounts at the institution are receiving scam or fraud proceeds and passing them on. Most controls watch money leaving. Money mules are the inbound side. ICBA's August 24, 2026 payments note ↗ says account opening can move faster at smaller banks, much fraud technology was built for outbound patterns, inbound activity deserves the same scrutiny, and FinCEN 314(b) sharing is one of the strongest tools already available.

Red flags from public authorities come first, then four lanes, then names mapped to BankToolkit listings. Informational only: not an endorsement, a rank, or a score. If a price or a detection rate is missing, we could not cite it. Account takeover and other payment rails are in the fraud prevention guide. Check images, positive pay, and kiting are in the check fraud detection guide. This page does not re-explain those.

Short answer: how do you spot a mule account?

Mule accounts often pass identity checks because they are opened with real IDs. You catch them by behavior after opening, and by what other institutions already saw. Common signs are several unrelated incoming payments, then a fast transfer out by P2P, wire, crypto exchange, or cashier’s check; activity that does not fit the stated job or income; a quiet account that suddenly gets busy; and, in digital banking, a new device, a remote-access tool, or odd hours. Recalls, FinCEN 314(b) sharing, and consortium flags are the other path. Most institutions combine BSA or FRAML monitoring with one onboarding or session signal. No single sign proves an account is a mule.

What a money mule is (witting, unwitting, complicit)

The CFPB ↗ says a money mule receives and moves money that came from fraud victims. Some know they are helping a crime. Others do not. The Justice Department’s Money Mule Initiative ↗ says the same: the person moves victim funds at someone else’s direction.

The FBI IC3 announcement of December 4, 2019 ↗ uses three groups. Unwitting or unknowing mules do not realize they are in a larger scheme. Recruitment is often a romance scam or a supposed job. They receive funds in a personal account and are told to keep a portion. Witting mules ignore warnings or stay willfully blind, including after bank staff have warned them, and may open more accounts. Many started as unwitting. Complicit mules know the role. They may open accounts at several institutions, advertise, or recruit others.

ICBA describes recruiting as a job posting, a relationship, or coercion. The label changes the response. Nacha’s Risk Management Advisory Group ↗ tells receiving institutions to sort an unwitting mule, an active mule, and an account takeover, and to talk with the customer when the flags support that. An unwitting mule may be a scam victim. This is not legal advice. Ask compliance or counsel before you change a closure or a hold. Account takeover is in the fraud prevention guide.

Red flags to train staff on

Paraphrases, grouped and attributed. In both FinCEN advisories below, no single red flag proves illicit activity. Use history, whether the activity fits what the customer described, and whether several flags arrive together. Do not train staff to profile by nationality.

At account opening

ICBA says weigh indicators federal authorities have flagged: occupation that does not match expected activity, an address shared with other recently opened accounts, and documents that look prepared by a third party. FinCEN Advisory FIN-2025-A003 ↗ (August 28, 2025) has a mule red-flag section. This page paraphrases behavior only: funds out of line with reported occupation or income and not explained by payroll or another legitimate source; unexplained wealth next to a stated low-income occupation; many unrelated deposits or transfers, then dispersal that does not match the activity the customer described. Read the advisory before you cite it in a SAR. Use its key term only when the activity is actually linked to that advisory.

First weeks

Two patterns here are vendor observations, not FinCEN. BioCatch’s 2026 mid-market report, as summarized by Credit Union Daily on October 29, 2026 ↗, says to watch small early transactions that test an account, then a rise in frequency and amount, and an account that stays quiet and then gets busy. Figures and limits are only in the vendor-data section below.

FinCEN Advisory FIN-2020-A003 ↗ (July 7, 2020) is older, and some examples are pandemic unemployment fraud. It is still FinCEN’s dedicated mule list. Flags that still read as general behavior: activity that no longer fits the account’s history, including a low balance that suddenly receives funds; a new account emptied soon after opening, sometimes with the holder keeping a portion; accounts at several banks that receive money from many people and move it at someone else’s direction; and a customer who declines source-of-funds questions. Do not treat the 2020 unemployment examples as a 2026 script.

Money movement

ICBA’s clearest in-use indicator is an incoming wire quickly followed by a transfer to a cryptocurrency exchange or a money services business. The 2025 FinCEN advisory, paraphrased without nationality framing, describes many unrelated inbound credits and then fast dispersal by P2P, wire, or cashier’s check. Nacha’s RMAG note, for ACH arriving at the receiving institution, adds a commercial SEC code (CCD or CIE) into a consumer account, especially a new or large-dollar one; a name on an already escalated credit that does not match the account; and dollar tolerances the institution sets itself. Anomaly and velocity checks are not proof by themselves. Nacha does not recommend name-matching every batch entry.

Digital session

Also vendor observation, from that same BioCatch report. Credit Union Daily’s summary says mule sessions often involve a new device, that remote-access tools showed up in the data, that overnight activity is a pattern to monitor, and that one case looked consistent with shared credentials or more than one operator. Those findings are about BioCatch customers. They are not a regulator checklist. The only figures this page repeats are in the next section.

What BioCatch’s 2026 report says (vendor data)

The Daily says the findings come from more than 250 U.S. credit unions and community banks that use BioCatch, comparing the second half of 2025 and the first half of 2026 with the matching period a year earlier. BioCatch’s October 21, 2026 press release ↗ describes the same direction of change and says more than 250 financial institutions that work with BioCatch contributed. Those two phrases for the sample are not identical. Both limit the set to BioCatch customers.

Three figures only:

• Sessions associated with mule activity increased 25 percent.
• The average value of those mule transfers increased 27 percent.
• 52 percent of mule sessions originated from new devices, in the Daily’s summary. The press release says “more than half” of mule sessions among BioCatch’s mid-market customers now originate from new devices. This page does not treat 52 percent as a sentence from the press release.

Other numbers in the Daily, the press release, and on BioCatch’s mule product page ↗ are left out on purpose, including case-study counts and detection claims.

Four lanes before you pick a vendor

“Mule detection” is four purchases that overlap. Practitioners call the overlap FRAML: fraud and BSA work in one file, often with two owners. The alert and the SAR often belong to different people. That is why names below sit on Fraud Prevention, on BSA / AML, or on both. Check-image listings (Alogent, Finovifi, Mitek, OrboGraph, Parascript) are not in these lanes. Use the check fraud guide for that purchase.

Onboarding and digital-session signals (behavior, device)

This lane looks for a mule at account opening and in the online or mobile session: a new device, automation, remote access, or behavior that does not match the person.

• BioCatch: application, device, network, and transaction signals, plus behavioral intelligence and BioCatch Link (product page ↗).
• ThreatMark: behavior at account creation and in later sessions. It says traditional monitoring often finds mules only after the money is gone (ThreatMark ↗).
• Sardine: device and behavior signals at onboarding and in transactions.
• Alloy: likely mule accounts at onboarding, then risky account changes, unusual money movement, and device or login anomalies (Alloy ↗). The older ongoing-monitoring URL redirects there.
• Feedzai: mule risk from onboarding through account monitoring and payments (Feedzai ↗).
• Featurespace: the application-fraud fact sheet ↗ lists mule accounts. The live application page ↗ did not name them when opened on October 30, 2026.
• DataVisor: device and behavioral signals inside the knowledge graph in the consortium lane, not a separate onboarding product we could quote.

Inbound and outbound payment monitoring

This lane scores credits as they arrive (ACH, wire, instant payments, P2P, check deposits) and the fast outbound that follows. Ask whether a credit can be held, and who releases it.

• Feedzai: incoming and outgoing payments (inbound article ↗).
• NICE Actimize: real-time scam and mule detection across the customer lifecycle, including account monitoring and triage (IFM Scams and Mule Defense ↗). The listing calls the suite enterprise: a scope check for a two-person desk.
• Abrigo is listed for check images. Its ACH page ↗ screens arriving ACH for mule activity, fan-out behavior, and unusual timing, and puts alerts into a case.
• Verafin: consortium payee risk across wire, ACH, instant payments, and check deposits (Verafin ↗).
• Featurespace: the payment-fraud page ↗ names money mules, with deposit fraud, authorized push payments, and account takeover.
• Hawk: incoming and outgoing funds, behavior that departs from expectations, and block, hold, or release (Hawk ↗). A 2022 news page ↗ describes a partnership with Aux, a credit union service organization, for U.S. credit unions. Counts on that page are not repeated here.

AML transaction monitoring and SAR workflow

This lane is the funnel or pass-through scenario, the case, and the SAR.

• Verafin funnel-account analysis ↗ alerts to mules who receive and withdraw illicit funds, and a SAR can be generated from the case. The page describes information sharing with the sending institution. It did not use the label “314(b)” on the copy we opened.
• Sardine transaction monitoring ↗: a prebuilt library for layering, pass-through activity, mule behavior, and funnel accounts.
• Unit21 fraud consortium ↗: mule accounts, and mule-network and layering detection across institutions. The listing is case management. Confirm the alert reaches the SAR.
• NICE Actimize and Alloy cover monitoring and triage in the lanes above. Hawk describes fraud and AML case management that connects scammer and mule accounts.

ComplyAdvantage is an AML screening and monitoring listing. No public mule product page was found. Ask whether mule scenarios are included. It is not in a mule lane.

Consortium, network data, and information sharing

This lane is what other institutions saw, plus link or graph analysis. Verafin and Unit21 for consortium data. ThreatMark FraudIntel ↗ for mule accounts and repeat scam beneficiaries across institutions. BioCatch Link, Feedzai graph analytics, and Sardine’s graph of accounts, devices, IPs, and counterparties (the product claim is the transaction-monitoring page, not only the learn article ↗). DataVisor uses a knowledge graph ↗ to connect accounts, devices, identities, and beneficiaries, including shared infrastructure. Hawk maps inflows and outflows on its scam page. No separate consortium product was found there.

Not software: FinCEN 314(b) ↗ is voluntary, with a safe harbor. The June 12, 2026 fact sheet ↗ says fraud indicators can be shared, and that a SAR itself may not be shared or revealed. Nacha’s ACH Contact Registry, in the RMAG note, is how you reach the other institution. Keep your contact current.

Mule detection names mapped to BankToolkit

Checked October 30, 2026 (America/Los_Angeles). A map, not a ranking. Verafin, NICE Actimize, Unit21, and Alloy keep BSA/AML and also carry a Fraud Prevention tag. Confirm every note in a demo. No detection rates, consortium sizes, or dollar figures.

Mule-detection names not on BankToolkit yet

Hawk and DataVisor were the two widely seen mule names without a row when this guide was briefed. Both are listed now, on Fraud Prevention: Hawk and DataVisor. If a name you are evaluating is still missing, use Submit / Claim. Submissions are reviewed before anything is published. This page does not invent a profile, a price, or a score for a name that is not listed.

What you can do before buying anything

Not legal advice. Ask compliance or counsel before you change a hold, a closure, or a SAR practice.

1. Register for 314(b) and use it on a recall or a suspicious credit. Sharing is voluntary. Fraud indicators can fall inside the safe harbor. You may not share the SAR or reveal that one exists. Follow the June 12, 2026 fact sheet.
2. Use the Nacha ACH Contact Registry and the RMAG screens: anomaly and velocity checks, a commercial SEC code into a consumer account, name comparison on items already escalated, and your own dollar tolerances.
3. Decide funds-availability and transfer limits on new accounts as policy. Nacha says limits on early availability might be appropriate for higher-dollar credits. What Regulation CC allows is for counsel. This page does not state it.
4. Teach new-accounts staff the opening flags above: occupation or income that does not fit, a repeated address, documents that look prepared by someone else.
5. Point members to the CFPB page linked above.
6. Write the SAR so the pattern is visible. ICBA’s advice: name the suspected mule, describe what came in and what went out, and cite the typology source you actually used. CMLN-2025-A003 is for activity linked to FIN-2025-A003, not a label for every mule.
7. Label the underlying scam the same way each time. The FedPayments Improvement ScamClassifier ↗ is a voluntary classification. It does not define mules, and it is not an endorsement of a product.

Demo checklist for a lean mule-detection team

Written for the desk you have, not a vendor’s question list.

1. Inbound rails in this proposal. ACH, wire, RTP or FedNow, P2P, check deposits. Which are later modules?
2. Holds. Can it hold a credit before the funds are available, and who releases it?
3. No history. What happens on a brand-new account?
4. Device and session. Included, or a separate SDK? Who installs it: you, or your digital-banking provider?
5. One case or two. Does the fraud alert reach the BSA case and the SAR?
6. Network data. Included or extra? What must you contribute, and what are you forbidden to send?
7. Unwitting customers. A contact script, or only closure?
8. Month-one volume at your size, and who clears it on a Tuesday.
9. Integrations that are live today, and who does the core and digital-banking work.
10. First-year cost in writing. BankToolkit does not publish a price.
11. Examiner file. Why the alert fired, what the desk did, and where the record lives.

What we still cannot cite

• Industry-wide U.S. mule volumes or losses at community banks and credit unions. The only recent figures here are BioCatch’s, about BioCatch customers, in the labeled section.
• Detection rates, false-positive rates, losses prevented, consortium sizes, and customer counts. We do not repeat them or compare them.
• Pricing. A ranking. A single best tool.
• Whether ComplyAdvantage includes mule-specific scenarios.
• The old Featurespace application URL (www2.featurespace.com) did not resolve on October 30, 2026. The current application-fraud web page did not name mule accounts. The fact sheet does. The payment-fraud page names money mules.
• Which core or digital-banking providers include mule detection in the contract you already have. Not checked. The fraud prevention guide covers the Jack Henry and Feedzai path for fraud generally.
• FFIEC BSA/AML manual text. The SAR section and Appendix S returned a bot challenge when opened on October 30, 2026, so this page does not quote them. This guide did not find an NCUA letter that is only about money mules.
• A per-core integration matrix.

Related on BankToolkit

• Fraud prevention software, including new-account and device signals and FRAML.
• Check fraud detection.
• Fraud Prevention and BSA / AML Compliance.
• BioCatch, ThreatMark, Sardine, Feedzai, Featurespace, Abrigo, Hawk, DataVisor, Verafin, NICE Actimize, Unit21, Alloy, ComplyAdvantage.
• Submit or claim a listing, BankToolkit Weekly, all guides.

Quick answers

How do community banks and credit unions spot money mule accounts?

Mule accounts often pass identity checks because they are opened with real IDs, so institutions catch them mostly by behavior after opening. Common signs are several unrelated incoming payments followed quickly by transfers out by P2P, wire, crypto exchange, or cashier’s check; activity that does not fit the customer’s stated job or income; a quiet account that suddenly gets busy; and, in digital banking, new devices, remote-access tools, or activity at odd hours. Banks also learn about mules from other institutions through FinCEN’s 314(b) information sharing, payment recalls, and consortium data. No single sign proves an account is a mule.

Which fraud tools flag money mule accounts?

Tools fall into four lanes: behavior and device signals at account opening and in online sessions, monitoring of incoming and outgoing payments, AML transaction monitoring with SAR case management, and consortium or network data from other institutions. On BankToolkit as of October 30, 2026, BioCatch, ThreatMark, Sardine, Feedzai, Featurespace, Abrigo, Hawk, and DataVisor are listed under Fraud Prevention. Verafin, NICE Actimize, Unit21, and Alloy are listed under BSA/AML and also carry a Fraud Prevention tag. Each of those names publicly describes some form of mule detection, with the limits in the table above. ComplyAdvantage is listed under BSA/AML for screening and monitoring. This guide did not find a mule-specific product page for it.

Why don’t normal fraud controls catch money mules?

Many community-bank controls were built to stop money leaving: teller conversations, outbound wire checks, and limits. A mule account is on the receiving side. Its owner is often a real person, sometimes an unwitting scam victim, who passes KYC, and the stolen money arrives from customers of other institutions. ICBA ↗ recommends giving incoming activity the same scrutiny as outgoing, checking account-opening details against warning signs federal authorities have flagged, and using 314(b) sharing.