Forty friends, one cash-out
Mule accounts don't look like fraud one transaction at a time. They only reveal themselves as a shape — fan-in, then fan-out. You have to see the graph.
What we're seeing
Every scam needs a way to get the money out. That's the mule: an account — sometimes a witting accomplice, often a duped 'money transfer job' victim — that collects funds from many sources and forwards them on toward cash-out.
Individually, each inbound payment is small and unremarkable. The fraud isn't in any single transfer; it's in the shape of the whole — money fanning in from unrelated senders, then fanning out fast toward an off-ramp.
Why your current stack misses it
- Transaction-level monitoring scores payments one at a time. A $180 P2P payment is invisible. Forty of them, from forty unrelated people into one young account, is a siren — but only if you look at relationships, not rows.
- Mule activity hides under reporting thresholds by design, so amount-based rules sail right past it.
The signal pattern
- Fan-in: many inbound payments from senders with no plausible connection to the holder.
- Fan-out: rapid forwarding of the aggregated balance toward another account, wallet, or crypto on-ramp.
- Pass-through behavior — money rarely rests; the account is a conduit, not a destination.
- Account and counterparties linked by device or payee graphs across the network.
What you'd do Monday morning
- Move beyond per-transaction scoring to graph-based monitoring of how accounts connect.
- Watch newly active accounts that suddenly receive fan-in from many unrelated senders.
- Treat fast inbound-to-outbound pass-through, especially toward off-ramps, as its own risk signal.
Spot the Fraud
Read the case. Make the call. See how you score against The PreCogs.
A young account lights up with inbound P2P payments, then moves the balance out. No single transfer trips a threshold. Clear it, or hold it?