The thin line between mules and fraud

Many international cybercrimes I study, including Business Email Compromise (BEC) scams, require a mechanism to transfer illicit gains to the country of origin of the attacker who committed the fraud, which is usually in a different country. This phenomenon is growing exponentially over time, changing the identification logics in a targeted manner. One of the simplest and most efficient ways to do this is to use standard money mules.

Money mules as we know are "Basic individuals who transfer funds from victims to other actors, often those involved in the perpetration of the fraud".

After receiving illegally acquired money, the mules transfer it to others electronically or through a courier. They can be paid for services with a small portion of the money transferred, or they can be part of a larger network. The money is usually transferred from the account of the first mule to that of another mule, with the funds eventually going back to a criminal organization, typically in another country. If money mules are proven to be complicit in the predicate crime, they can be charged with violating a jurisdiction's money laundering statutes.

Money mules are sometimes recruited online for what they think is legitimate work, unaware that the money they transfer is the product of fraud. Other times, scammers may appeal to victims' emotional state by posing as caring and romantic individuals who need money. The Better Business Bureau reported that cases of money mules through this type of romance fraud resulted in nearly $1 billion in losses in the United States and Canada over three years.

Since the U.S. Department of Justice, the FBI, the U.S. Postal Inspection Service, and other federal law enforcement agencies launched an annual Money Mule initiative in 2018 The public has become increasingly aware of this fraudulent scheme. The 2021 initiative resulted in over 4,000 people receiving warning letters and recovering nearly $4 million in fraud proceeds. Over 4,000 actions were taken against individuals during the 2023 initiative.

While increased public awareness of money mules can help prevent this type of fraud, those investigating such crimes still feel dissatisfied with the current situation. With the help of some presidents of the regional chapters of the International Association of Financial Crimes Investigators (IAFCI), the authors sent an online survey to its members. Twenty-three law enforcement investigators and 18 from U.S. financial institutions described the prevailing mule techniques, which may have been trained by their accomplices, and the limited investigative tools available to prosecute culprits or fully recover monetary losses.

This article will summarize four common issues raised by these researchers and then propose recommendations for improving the current system.

Problems

Letters of formal notice and interviews

To prove money laundering, a prosecutor must establish that the defendant knew that the funds involved in a transaction represented the proceeds of an illegal activity. However, suppose an investigator is unable to prove the elements of money laundering. In such a case, the alternative is to serve a warning letter on a suspect, essentially informing him that the continuation of the activity constitutes knowledge and is, therefore, subject to prosecution.

Despite warning letters being effective, their use is limited, with more than 60% of investigators indicating that they do not use this method to alert mules. The investigators who sent warning letters to the mules were unsure of their effectiveness, as only a quarter of them viewed the letters as a deterrent. However, as several investigators have noted, documenting interactions with mules is valuable regardless of the actual effectiveness of the warning in deterring future crimes. Investigators pointed out that the mules had no excuse after being warned of the legal consequences, giving law enforcement more legal options to counter criminal activity.

Ninety percent of the investigators interviewed the mules to ascertain the criminal nature of their activity and stop the flow of money. Among investigators working in law enforcement, nearly 30 percent saw the mules' activity cease, while 16 percent of their counterparts in financial institutions reported the same result. However, one-fifth of researchers at financial institutions observed the continuation of mule activity after interviews.

As one of them explained:

Most are very well instructed by the scammer and provide deceptive answers regarding the source of the funds and where they are going. For example, instead of saying, "This wire is for my fiancée's medical bills," they'll say, "This is to pay a contractor who is doing home improvement projects for me."

Another investigator complained that the mules refused to believe they had been scammed, even when told by a uniformed law enforcement officer. The investigator attributed this disbelief to the fact that "criminals have much more time to spend with mules online or on the phone than bankers, so they can be more easily convinced by criminals who have created some credibility with mules."

Expansion methods

Payment methods

Investigators from the sample described various payment methods, ranging from gift cards, cash sent in magazines, and other items harmless to cryptocurrency. Nearly half of the investigators cited romance scams as the most frequently observed tactic, followed by fraud related to job offers, the IRS, grandparents, the lottery, and others.

"While increased public awareness of money mules can help prevent this type of fraud, those investigating such crimes still feel dissatisfied with the current situation."

As for how the money was moved, the investigators identified a variety of methods, including wire transfer (37%); overseas transfers (30%); and P2P (person-to-person) options (17%), such as Zelle and Cash App, as well as cash (24%) and checks (20%). While relatively few investigators (15%) have observed the use of cryptocurrencies by mules, they have raised concerns about the growing reliance on cryptocurrencies and said they need to be better equipped to investigate crimes using this form of funds.

Cryptocurrency

The use of mules to launder funds via cryptocurrency presents new challenges for both investigators and money launderers. Cryptocurrency transactions involve many service providers and transactional fees, and more transactions between mules mean significantly reduced illegal profits.

A simple and popular approach to maximize illegal profits using cryptocurrency is through Bitcoin ATMs. Mules can deposit cash into a local Bitcoin ATM and designate it for any BTC (Bitcoin) address made up of letters and numbers that identify the intended wallet. The wallet can be located anywhere in the world and be cashed in on a foreign exchange. This method is reasonably simple for mules, and Bitcoin ATMs are plentiful in the United States and Canada. Additionally, exposure to transactional fees is minimized, although many Bitcoin ATM providers charge high fees.

Another way mules can launder funds with cryptocurrency is through gift cards. While some Know Your Customer (KYC)-compliant crypto exchanges convert gift card balances into crypto, several non-KYC-compliant websites allow the exchange with little to no identity verification.10 In addition, the providers of privacy-based wallets associated with these websites can guarantee money mules complete anonymity.

To achieve total anonymity, mules can use non-KYC-compliant exchanges to convert Bitcoin to and from other privacy-based coins, such as Monero. A full list of such exchanges is available on KYCnot.me, a website dedicated to listing P2P, centralized, and decentralized exchanges that are not KYC compliant. Monero is currently in liquidation, surely what we are telling has significantly influenced this choice

The use of cryptocurrencies by money mules is likely to grow further as popular P2P applications allow the purchase of popular cryptocurrencies on their platforms, along with the transfer of cryptocurrency to third-party wallets outside their respective networks.? This capability, coupled with any method of crypto laundering, can be complicated for law enforcement to investigate. Agencies need to invest in blockchain analysis tools and form consistent information-sharing systems to identify and seize suspicious cryptocurrency addresses.

Information sharing

Financial institution investigators have indicated that a list of compromised accounts is shared among selected banks or professional organizations. For example, IAFCI members in industry groups can share details about criminal incidents at their place of work and ask for information about those involved.

This immediate dissemination and sharing of vital information could effectively identify compromised accounts and deter people from moving money. However, this information sharing is limited to select groups of investigators in certain regions, while money mules operations require interstate and international collaboration. Cooperation between financial institutions and local, state, and federal law enforcement agencies is critical to completing investigations and mitigating the impact of money mule schemes.

"The use of mules to launder funds via cryptocurrency presents new challenges for both investigators and money launderers."

Elderly victims

Investigators noted that scammers targeted older person with alarming frequency. While this assessment may only be anecdotal in money mule cases, the FBI reported that victims over the age of 60 have a greater monetary loss than any other age group. And they are also at greater risk of being financially exploited due to declining physical health, psychological well-being, and cognitive functioning. The most frequently mentioned tactic is to lure victims into believing that they are needed or loved by the scammer.

Case Study

A researcher discovered a local post-secondary education institution that predominantly enrolled foreign "students," some suspected of mulatto activities. The investigator found that several people attending the institution came from a country commonly associated with a complex international network of money mules.

Many of them found jobs as ride-sharing app drivers and security guards, despite being supposedly well-educated in their home country, holding degrees in fields such as information technology and nursing. Each alleged student opened accounts with several banks and credit unions at the same time and received funds from confirmed BEC frauds. These funds were transferred through various parties via P2P apps across the United States.

The investigator leveraged his investigative contacts at several financial institutions nationwide and generated several search warrants for the documents. He discovered that the stolen funds transferred through the network of mules were being used to buy bulk food orders from a distributor in Africa and bulk orders of various products in China via large bank transfers. The funds were also used to purchase vehicles at auctions with cashier's checks. The vehicles were transported to major U.S. ports and shipped overseas to a foreign jurisdiction. As a result, several suspected money mules were served with warning letters.

This case highlights the increasing complexity of multi-jurisdictional investigations into money mules. Information sharing between financial institutions and law enforcement authorities is essential to combat these criminal networks. Adequate information sharing allows investigators to generate more efficient and targeted search warrants, especially at smaller banks and credit unions in different jurisdictions. Additionally, by establishing a reciprocity system for search warrant taming, state and local law enforcement investigators can expand their reach in money mule investigations more efficiently.

Desired tools for investigators

Investigators shared their perspectives on various tools that could help improve their money mule investigation skills. Although training in computer forensics, learning best practices for talking to mules, and public awareness training can reduce the incidence of crime, having a dedicated money mule database accessible to investigators in various industries and jurisdictions is the most desired tool for improving the current state of mule investigations. The information that investigators would like to have available in such a database includes the names, addresses, and accounts of suspected or known mules; images of culprits and mules; dates of interviews and letters of formal notice sent; and the contact information of the investigating parties.

"Investigators shared their perspectives on various tools that could help improve their money mule investigation capabilities."

Conclusion

The relatively minimal proceeds recovered from the annual money mule initiatives of federal agencies "illustrate the urgent need to tackle this ever-expanding sector of financial crime," as noted by one investigator involved in cross-border investigations. A sample of experienced money mule investigators interviewed "highlighted the growing geographical scope of money laundering schemes," emphasizing that the impact of interviews and warning letters "often fails to deter persistent offenders, especially those deeply embedded in well-organized criminal networks."

Criminals’ ability to detect and manipulate unsuspecting individuals, particularly vulnerable elders, to move money across jurisdictions "using a combination of social engineering tactics and sophisticated technological tools" complicates money mule investigations in today’s evolving digital landscape. "The complexity of these schemes necessitates multi-level and multi-jurisdictional collaboration," according to one financial crime researcher. He adds that "data-sharing partnerships between law enforcement and financial institutions could greatly enhance investigative capabilities" by providing real-time intelligence and fostering a more coordinated response to money laundering operations. This would help develop "more effective, evidence-based practices and public policies," better suited to the current technological climate.