Money Mule or Victim?
The transaction may be obvious. The person behind it may not be.
Money enters an account from several unrelated victims.
It moves again quickly.
New beneficiaries appear.
Cash is withdrawn.
The customer keeps some of the money.
From a transaction monitoring perspective, the pattern may look highly consistent with money mule activity.
But an investigation cannot end there.
The movement of criminal funds can establish what happened through an account. It does not automatically establish what the customer knew, why they participated, when suspicion arose, whether another person controlled their behaviour, or whether they were themselves being exploited.
That distinction is the subject of this Case File.
What is a money mule?
A money mule is generally understood as a person recruited to move criminal proceeds on behalf of somebody else.
The movement does not need to involve a simple bank transfer.
A person may receive criminal funds into their own account and transfer them onwards.
They may withdraw cash and hand it to another person.
They may buy or sell cryptocurrency.
They may open additional accounts.
They may also give another person access to an account so the criminal can move funds directly.
The National Crime Agency describes money muling as moving criminal money for other people, sometimes in return for payment. [1]
The FCA similarly defines a money mule as someone recruited by criminals to move illegally obtained funds and recognises that the individual may be involved knowingly or unknowingly. [2]
The Home Office uses a similarly broad formulation.
Money muling involves moving proceeds of crime through financial accounts on behalf of criminals, sometimes in exchange for payment or another benefit. [3]
That definition describes the financial mechanism.
It does not resolve the harder investigative question.
What did the person understand about the mechanism they were participating in?
Why criminals use money mules
Criminal proceeds create an immediate problem for criminals.
The money has to leave the victim.
It has to move somewhere that does not directly identify the organiser.
It may then need to be divided, transferred again, converted into another asset, withdrawn as cash or sent outside the original institution.
Money mule accounts provide infrastructure for that movement.
A mule can create distance between the original offence and the person ultimately controlling the proceeds.
Networks of accounts can also make the payment trail more difficult to interpret because funds move through customers who may initially appear unrelated to one another.
The account holder therefore occupies a critical position between the victim and the wider criminal network.
But that does not mean every person occupying that position entered it in the same way.
How does someone become involved?
There is no single money mule recruitment model.
Some people understand exactly what they are being asked to do.
Some understand that the activity is suspicious but decide that the payment or other benefit is worth the risk.
Others believe they have accepted legitimate employment.
Some believe they are helping a friend, partner, relative, employer or person they trust.
Others may initially cooperate voluntarily before manipulation, threats, debt or coercive control make leaving substantially more difficult.
Some customers may never participate at all because their account has instead been compromised or controlled without meaningful consent.
Recent Home Office research illustrates how varied these pathways can be.
Participants described false employment opportunities, personal relationships, social media recruitment, financial pressure and increasingly sophisticated attempts to manufacture legitimacy.
The research found that many reported money muling experiences followed a request from someone the individual knew online or offline.
Trust could also be manufactured through professional looking recruitment processes and apparently legitimate businesses. [3]
This matters because an investigator cannot safely assume that behaviour which looks obviously suspicious to a financial crime professional was necessarily understood in the same way by the customer at the time.
Knowing participation
At one end of the spectrum is deliberate participation.
The person understands that they are helping move illicit funds and chooses to participate.
They might receive a commission.
They might allow repeated use of their account.
They might recruit additional participants.
They might deliberately conceal transactions or provide false explanations when challenged.
In those circumstances the financial activity and surrounding behavioural evidence may support knowing involvement.
But knowing involvement should be evidenced rather than inferred merely because criminal money passed through the account.
Deceived participation
A second pathway begins with a legitimate looking explanation.
The customer may believe they have accepted employment, are processing commercial payments, assisting another person, receiving investment proceeds or carrying out some other lawful activity.
False job opportunities are particularly important.
Home Office research describes participants encountering apparently structured recruitment processes, job advertisements, interviews, formal documentation, company websites and other signals designed to create legitimacy. [3]
A customer can therefore personally authenticate transactions while still being deceived about their true purpose.
Customer control of the payment does not automatically establish customer knowledge of the crime.
Emerging suspicion
The distinction becomes harder when the customer's understanding changes during the activity.
A person may enter an arrangement believing it is legitimate.
Then inconsistencies appear.
Payments arrive from unexpected people.
The supposed employer asks for immediate onward transfers.
Explanations stop making sense.
The customer begins questioning instructions.
At that point, the investigation may need to identify not simply whether the individual was originally deceived, but whether there was a later point at which suspicion developed and participation nevertheless continued.
This is why a single label applied to the entire relationship can be misleading.
Knowledge can change over time.
So can culpability.
Exploitation and coercion
The position can change again.
A person who attempts to disengage may encounter manipulation, intimidation or threats.
Home Office research describes circumstances where criminals used guilt, control, personal information, threats of violence and broader exploitative relationships to maintain involvement.
It also identified circumstances where money muling intersected with coercive control. [3]
This creates one of the hardest questions in mule investigations.
A customer can perform a transaction themselves and still be acting within an exploitative relationship.
Their activity may appear voluntary when viewed solely through payment records.
The surrounding evidence may tell a very different story.
Home Office financial exploitation guidance therefore recognises that activity can appear consensual where exploitation nevertheless exists. [4]
The Home Office's Fraud Strategy 2026 to 2029 separately identifies this kind of exploitative money laundering as carrying serious consequences for vulnerable people, including children, and sets out safeguarding measures alongside its enforcement priorities. [5]
The victim and perpetrator problem
Money mule investigations resist simple classifications because victimisation and offending behaviour can coexist.
An individual might initially be deceived.
They may later become suspicious.
They may continue because money is attractive.
They may subsequently attempt to leave.
The recruiter may then use threats or coercion to force continued participation.
A single person can therefore occupy a changing position during the lifecycle of the activity.
That does not mean every person involved in money muling should be treated as a victim.
It means classification must follow the evidence.
Account activity is not customer intent
This Case File uses an important analytical distinction.
Account level
What happened through the account?
Did suspected criminal proceeds enter?
Where did they originate?
How quickly were they moved?
Who received them?
Which device executed the transaction?
Were new beneficiaries added?
Was cash withdrawn?
Customer level
Who actually controlled those actions?
What explanation was given?
What did the customer understand?
When did that understanding change?
Was financial benefit received?
Were warning signs ignored?
Was another person exercising influence or control?
Was there deception?
Was there coercion?
Was the account compromised?
These are different questions.
The first establishes activity.
The second investigates involvement.
A further distinction matters
An account can perform a mule like function even when its owner is not meaningfully participating.
If credentials are stolen and criminals operate the account without the customer's knowledge, suspicious funds can still pass through that account.
But the investigative conclusion should not therefore automatically be:
The customer is a money mule.
The stronger conclusion is:
The account was used within the movement of suspected criminal proceeds, but customer participation has not been established.
This preserves the distinction between observed activity and attributed conduct.
The investigative principle
Throughout this Case File, apply one rule:
Do not allow the transaction pattern to answer a question that the evidence about the customer has not yet answered.
Fast movement of money may support suspicion.
Multiple unrelated senders may support suspicion.
New beneficiaries may support suspicion.
A retained payment may support suspicion.
Customer controlled transactions may support participation.
None of those facts individually proves why the customer acted.
Your task is therefore not simply to detect money mule activity.
Your task is to determine the most defensible explanation for the customer's involvement while recognising what remains unknown.
You will receive evidence progressively.
Some information will strengthen your initial theory.
Some will weaken it.
Some evidence will appear highly suspicious but prove weak in determining intent.
Other evidence may initially look peripheral but materially change how the customer's behaviour should be interpreted.
You are expected to revise your position when the evidence changes.
This is a synthetic investigation constructed for professional education. Customer R is fictional. The transactions, communications, counterparties and investigative findings have been created specifically for this Case File. The behavioural and regulatory issues are informed by published UK evidence, but no individual research participant, fraud victim or Financial Ombudsman complainant has been recreated.
The alert looks straightforward. The investigation will not be.
Sources and methodology
Scope: Customer R, the recruiter and every case-specific fact, message, payment and date in this Case File are fictional, built for investigative-reasoning practice. This is not a real investigation and does not describe a real customer, real correspondence or a real bank's findings.
Method: the money mule definitions, recruitment and exploitation research, and regulatory evidential standards referenced throughout this Case File were checked directly against the primary sources listed below. The synthetic case narrative itself, and FinCrimeRadar's own analysis of it, are never attributed to any of these sources. This Case File's interactive elements were built to a WCAG 2.2 AA accessibility baseline. [9]
- National Crime Agency, "Money Mules".
- Financial Conduct Authority, "Proceeds of fraud: detecting and preventing money mules", 19 October 2023, updated 3 December 2025.
- Home Office, "Lived experiences of money muling", 16 July 2026.
- Home Office, "Money laundering linked financial exploitation: guidance for frontline professionals", 1 March 2024.
- Home Office, "Fraud Strategy 2026 to 2029", 9 March 2026, updated 30 April 2026.
- Financial Conduct Authority, "Firms' use of the National Fraud Database and money mule account detection tools", 23 January 2025, updated 3 December 2025.
- Cifas, "National Fraud Database Principles".
- Financial Ombudsman Service, "Fraud markers". Practical complaint handling guidance and case reasoning, not legislation or binding precedent.
- World Wide Web Consortium, "Web Content Accessibility Guidelines (WCAG) 2.2", 12 December 2024.
Last reviewed: 11 September 2026.