Saddle Up: Tracking the Mule Herders

It is generally accepted that most scams have a cybercrime element, and money mules have become an essential component in the success of organised criminal gangs. While the use of witting or unwitting individuals to launder the proceeds of crimes is nothing new, technology has provided criminals with the opportunity to recruit mules quickly – across borders with relatively little effort.

Social media enables “herders” to attract mules who once hooked are migrated to secure messaging apps which utilise end to end encryption. Others are drawn into becoming mules through the promise of a job or maybe selected within the community because of vulnerability.

Europol, the European Union Agency for Law Enforcement Cooperation, has set out to tackle money mules through the European Money Mule Action (EMMA) initiative. While the world of money mules is quite complex, collaborative actions, such as EMMA, are a step in the right direction to help reduce the threat.

Combatting Money Mules

The task of identifying and combating money mules is a significant challenge for the regulated sector (accountants, financial service businesses, estate agents and solicitors) and law enforcement. Mules and herders typically operated in a decentralised manner, aided by technology. The size, scale, and structure of the networks they form can be hard to unmask.  

If they are investigated, it can often be difficult for prosecutors to demonstrate intent, and that the individual knew what they were doing was wrong. Or in the case of the vulnerable, that there is a public interest argument to support their prosecution. Whilst the scope for prosecution may be limited, money laundering is not necessarily without consequence.

Those identified as having acted as a money mule may find their account closed and other financial institutions reluctant to accept them as a customer.

Inflation and the allure of easy money allied to a lack of awareness about the consequences of money laundering can make a wide range of individuals susceptible to falling victim to money mule schemes. Increasingly the tactics employed by criminals to exploit the vulnerabilities of people who may be facing financial difficulties are being deployed to recruit a more diverse set of money mules.

This trend is likely to increase as financial institutions seek to manage Authorised Push Payment fraud, with herders forced to recruit mules who have a customer profile which lends itself to the task at hand. No longer will the account of a teen suffice when you want to launder the proceeds of a £200K business email compromise.

Launched in 2019, EMMA is a concerted effort to combat money laundering across Europe. EMMA sets out to:

1. Raise Awareness: EMMA aims to educate the public about the tactics used by cybercriminals to recruit money mules. EMMA awareness campaigns and educational materials seek to empower individuals to recognise and resist recruitment.

2. Enhance Cooperation: Europol facilitates collaboration among law enforcement agencies, financial institutions, and other stakeholders across Europe. By sharing information and intelligence, authorities can better track and dismantle money mule networks.

3. Provide Resources and Tools: EMMA equips law enforcement agencies with the necessary tools and resources to investigate and prosecute money mule cases effectively. This includes technology solutions, training programs, and best practices for combating this type of financial crime.

4. International Cooperation: Recognizing that money mule operations often span multiple jurisdictions, EMMA promotes international cooperation to tackle the global nature of this problem. Collaboration between European and international partners is essential to address the complexities of cybercrime.

Since its launch, the EMMA initiative has made significant strides in the fight against money mules. In June, October and November 2023, several operational phases identified 10,759 money mules and 474 recruiters, leading to the arrest of 1,013 individuals worldwide. The initiative involved collaboration across 27 countries and 2,822 banks and financial institutions. The 2023 iteration of EMMA intervened in 10,736 fraudulent transactions and prevented losses of over €32 million.

Some regulators are already starting to join the fight. The UK Financial Conduct Authority (FCA) recently undertook a multi-firm review entitled, Proceeds of fraud - Detecting and preventing money mules, which serves to demonstrate the growing expectations of regulators and government. Specifically, it states, “Based on our findings, we expect firms to take a proactive and proportionate approach to address the problem of money mule activity. This entails strengthening controls during onboarding, improving transaction monitoring to detect suspicious activity involving money mules, and optimising reporting mechanisms for swift action.”

The FCA also highlights the need for data sharing, increasingly this will likely involve financial institutions using consortium analytics to identify risk that might otherwise not be apparent. A good example of this is Transactie Monitoring Nederland which combines transaction data from various Dutch banks to identify potentially suspicious transactions.

The FCA also highlighted the need for technologies such as device profiling, geo-location, and behavioural biometrics to be utilised throughout the customer lifecycle enabling institutions to exclude mules and disrupt mule networks which utilise existing customer accounts.

Outside the UK, the Reserve Bank of India recently updated their Master Direction on KYC with a focus on account opening and transaction monitoring to minimise money mule operations. In Brazil, Resolution 6 aims to mandate information sharing across banks to tackle the rise in fraud, details which include the target account and the name of the account holder if the fraud involves the transfer or payment of funds.

Will Generative AI Make the Problem Worse?

Criminals have already used generative AI successfully in some prominent fraud attacks. While not used in any meaningful or scalable way yet, the promise is there for generative AI to fuel an increase in both the volume and effectiveness of financial scams.

So, the answer to the question is yes. Given the rapidly developing world of generative AI, it is only fair to assume that as financial scams rise, the threat posed by money mules will grow in tandem. All of which necessitates that banks and financial institutions make further strides to proactively identify these nefarious foot soldiers before they have a chance to arm.