The Economics of Mule Herding: Break the Receive Side and the Business Model Follows

Mule herding is not an incidental feature of fraud; it is the logistics industry that makes fraud pay. Every authorised push payment scam, every account takeover and every invoice redirection ends the same way: the money must land somewhere, rest briefly, and move on before anyone asks questions. The people who supply that landing capacity at scale, the mule herders, run a priced, managed and surprisingly fragile supply chain.

TrustSphere's house view is blunt: the industry has spent a decade over-investing in send-side controls and under-investing in the receive side, and the economics of mule herding explain why that allocation is wrong. A sending bank can only ever block one payment at a time. A receiving bank that identifies a mule account kills a reusable criminal asset, and with it every future payment that account would have laundered. Detection on the receive side destroys criminal capacity; detection on the send side merely delays criminal revenue.

That view now has regulatory and financial force behind it. The UK's reimbursement regime makes sending and receiving firms split the cost of reimbursing APP scam victims 50:50, and the FCA's multi-firm review of money mule controls found that some firms focus on outbound transaction monitoring and do not have adequate inbound monitoring systems at all. A receiving institution that still treats inbound funds as someone else's problem is carrying half the liability with a fraction of the control.

A supply chain with a price list

Mule herders operate like any logistics business: they recruit capacity, grade it, price it and retire it. Recruitment runs through social media job adverts, gaming channels, student networks and, at the harder end, coercion. Europol's EMMA 8 action identified 8,755 money mules and 222 mule recruiters in a single three-month operational phase, with 2,469 arrests worldwide, which gives a sense of the scale of the recruitment machine behind it.

Pricing follows quality. A genuine account with age, salary credits and a clean history commands a premium because it survives longer under monitoring; a freshly opened account sold on by its owner is near-disposable stock. The herder's margin is the spread between what an account costs to acquire and the value of funds it can pass before it is detected and closed. Every day a receiving bank fails to spot a mule account, it is subsidising that margin.

Burn is built into the model. Herders assume accounts will be identified eventually, so they rotate funds across layers of accounts, keep dwell times short and hold reserve capacity. The FCA review describes the classic tell: multiple customers operating from a single device because the account has been sold to a herder who now controls it.

The lifecycle of a mule account, walked through

Consider the typology TrustSphere maps most often in receiving-bank engagements. Stage one is acquisition: a 19 year old student responds to a social media advert offering easy money for receiving and forwarding payments. He hands over credentials, or opens a new account at a digital bank under the herder's direction, often using his own genuine identity documents, which is why onboarding checks alone rarely catch it.

Stage two is seasoning. The account sits quietly for weeks, perhaps receiving small legitimate-looking credits, while the herder tests login access from new devices and adds payees. Nothing here trips an outbound rule because nothing meaningful leaves the account. Inbound and non-monetary signals, new device, new payee velocity, dormancy followed by probing logins, are the only visible evidence.

Stage three is activation. A scam payment of 8,000 pounds from a victim at another bank lands in the account. Within hours it is split into three or four onward payments, part to further mule accounts, part converted to cryptocurrency or withdrawn in cash. The FCA names exactly this pattern, high value credits into new or dormant accounts followed by rapid similar-value debits, as the behaviour firms are missing.

Stage four is burn and replace. The account is reported by the sending bank, frozen, and the student inherits a fraud marker and a closed account while the herder moves to the next name on the list. The herder's cost of that burn is low; the system's cost, in victim losses, investigation time and a young person's financial exclusion, is not. UK Finance reported 450.7 million pounds of APP losses across almost 186,000 cases in 2024, and effectively all of it transited accounts like this one.

What inbound monitoring obligations now mean for receiving banks

The regulatory direction is unambiguous. The PSR's reimbursement rules cover Faster Payments and CHAPS and split reimbursement costs equally between sending and receiving firms, with most victims repaid within five business days. The receive side is no longer reputationally exposed but financially exposed, claim by claim.

The FCA's review goes further than cost allocation. It criticises firms that rely on onboarding checks and outbound rules, highlights failures to respond swiftly to notifications from sending institutions, and notes that late reporting to the National Fraud Database delays warnings to every other firm the mule will approach next. It also cites more than 39,000 accounts linked to mule activity reported to the National Fraud Database in a single year. Supervisors are now asking receiving banks a precise question: show us how you detect an account that receives fraud, not just one that sends it.

What TrustSphere's engagement data shows

TrustSphere's own engagement data, drawn from receiving-side detection reviews conducted over the past eighteen months, supports the economic argument. In our benchmarking, institutions running dedicated inbound models, combining credit-side velocity, dormancy breaks, device sharing and payee network signals, identified mule accounts a median of nine days earlier than institutions relying on outbound rules alone. Nine days is most of a mule account's productive life.

The same engagements show the receive side is cheaper per detection, not just faster. Because one confirmed mule account typically links to several inbound fraud payments and multiple counterpart accounts, our clients' cost per disrupted fraud on inbound-led models ran at roughly a third of the equivalent send-side figure. On the TrustSphere RiskTech Index, whose current vendor mean is 6.06, receive-side and network analytics remain the weakest capability cluster we score across the vendor market, which tells you where the tooling gap sits.

Stakeholder implications

For tier 1 banks, the 50:50 split converts every fintech and small PSP they receive from, and send to, into a counterparty credit question. Expect large banks to use repatriation response times and mule reporting speed as de facto due diligence metrics on the institutions around them.

For challengers and fintechs, the uncomfortable truth is that herders price their onboarding friction. A fast, remote account opening journey is a product feature and a procurement criterion for criminals simultaneously. The answer is not slower onboarding but seasoning-phase surveillance: the weeks between account opening and activation are where the detection advantage lies.

For payment service providers and acquirers, inbound monitoring is now a scheme-level survival issue. Firms that cannot respond promptly to notifications from sending institutions will find themselves absorbing reimbursement costs and, eventually, supervisory attention under the FCA's stated willingness to use enforcement where controls are inadequate.

For regulators and supervisors, the open problem is measurement. Publishing receive-side performance data changes behaviour faster than rules do, because no bank wants to top a league table of fraud-receiving institutions.

For consumers, and especially for the young people who make up much of the mule population, earlier receive-side detection is genuinely protective. An account frozen in the seasoning phase is a student warned off; an account burned after activation is a criminal record in the making.

Where the economics actually break

The mule herder's business survives on two subsidies: cheap account acquisition and slow receive-side detection. Banks cannot do much about the first, which is a social media and law enforcement problem. They can do a great deal about the second, and the 50:50 liability split means they are now paid to.

TrustSphere's conclusion is that receive-side detection should be resourced as a profit-protecting control, not a compliance afterthought. Shorten the average life of a mule account by half and you have not inconvenienced the herder; you have doubled his unit costs and broken his price list.

Suggested Next Steps

• Stand up a dedicated inbound detection capability covering credit-side velocity, dormancy breaks, device sharing and payee network links, and measure its hit rate separately from outbound rules.

• Benchmark your average time from first fraudulent credit to account restriction, and set a reduction target for 2027 that the executive risk committee owns.

• Test your operational response to notifications from sending institutions against the five business day reimbursement clock, including out-of-hours performance.

• Review National Fraud Database reporting timeliness and close the gap between internal mule confirmation and external reporting to protect the wider network.

Sources: Financial Conduct Authority, Payment Systems Regulator, UK Finance, Europol, Cifas, Home Office Economic Crime Plan 2, TrustSphere Risk Index, April 2026.

Companion vendor assessment: today's TrustSphere Risk Index post assesses Veridas against this problem. Read it at www.trustsphere.ai

TrustSphere helps financial institutions design and deploy intelligent fraud and financial crime detection solutions. Visit www.trustsphere.ai