The Royal United Services Institute (RUSI) has published new research by Kathryn Westmore and Allison Owen examining the central role of money mules in authorised push payment (APP) fraud.
The report highlights how criminals exploit weaknesses across the payments system to move stolen funds at speed, often through accounts held with newer financial institutions.
Sadly, fraud is now the UK’s most common crime, accounting for more than 40% of all crime and costing the economy in excess of £200 billion each year. Understanding how mule networks operate is therefore essential for both policymakers and regulated firms seeking to combat financial crime.
In this blog, we summarise the key insights firms should know about the report, plus what to do next.
Context to the Report
APP fraud is one of the fastest-growing financial crime threats. It involves victims being deceived into authorising payments to fraudsters, who then typically rely on mule accounts to receive and send funds on.
Money mules may be complicit criminals, or individuals persuaded or coerced into allowing their accounts to be used. No matter the intent of the individual, their participation is what enables the rapid movement of illicit funds, undermining the integrity of the UK’s financial system.
The Role of Money Mules in APP Fraud
The RUSI report makes it clear that money mule accounts are central to how APP fraud works. As soon as stolen money lands in a mule account, it is usually moved on very quickly (sometimes in as little as 15 minutes) before being withdrawn or sent elsewhere.
Criminals often recruit mules through social media, fake job offers, or personal networks. Young people are increasingly being targeted, lured by the promise of quick and easy money, without realising the serious criminal consequences of getting involved.
Key Findings from the Report
Let’s take a look at some of the most important insights for firms from the report.
Disproportionate Impact on Newer Financial Institutions
Digital banks, payment service providers, and Banking-as-a-Service (BaaS) platforms are disproportionately affected. These firms receive a higher share of mule-related transactions compared with established banks. Strikingly, the report notes that one unnamed firm accounted for 20% of all onward transfers observed in the dataset, underscoring the need for more robust controls in parts of the sector.
How Funds Move
- 57% of onward transfers occur via Faster Payments, showing the ubiquity and speed of this channel.
- Criminals also make use of debit card transactions and cash withdrawals to disperse funds quickly.
- The short duration funds remain in mule accounts highlights the importance of real-time monitoring and intervention, preventing criminals from taking action before the displacement happens.
Fragmented Oversight and Displacement Risk
The UK’s payments system is highly fragmented, with a mix of banks, fintechs, e-money firms, and infrastructure providers. This complexity makes it harder to trace stolen funds across different institutions.
The report also warns of ‘displacement risk’: as controls tighten in one area, criminals adapt by shifting to alternative products, platforms, or jurisdictions.
Challenges and Recommendations
The RUSI authors set out several priorities to strengthen the fight against mule activity and APP fraud:
- Building consistent standards and expectations across all payment firms to tackle fragmentation.
- Data sharing, ensuring smaller firms, fintechs, and crypto providers are part of information-sharing initiatives.
- Encouraging closer collaboration with law enforcement, combining intelligence and operational capabilities to disrupt mule networks.
- Investment in real-time monitoring, as, given the short time frames involved, prevention must happen before funds are irretrievably moved.
Implications for Regulated Firms
For payment institutions, e-money firms, and BaaS providers, the report is a clear signal to reassess fraud prevention frameworks.
Practical steps include:
- Reviewing onboarding processes to identify and block potential mule accounts.
- Strengthening transaction monitoring, particularly around high-velocity transfers and suspicious account behaviour.
- Joining industry-led data-sharing partnerships to improve detection across the ecosystem.
- Exploring real-time detection and interdiction solutions.
The Last Word
Fraud represents a systemic challenge to the UK economy, and money mules remain at the heart of the problem. Tackling APP fraud does, however, require a coordinated response across the public and private sectors, and it is firms who will play an active role in detection and prevention.
API Compliance can assist with fraud risk assessments, transaction monitoring enhancements, and the development of targeted compliance strategies.
If you would like to discuss how to strengthen your approach to money mule risks, please get in touch using the contact form below.
