Mule accounts are one of the harder fraud problems for fintechs, digital banks, payments platforms, and on-demand or marketplace apps to catch, because the accounts themselves aren’t fake.
A real person opens them, completes onboarding, and passes identity and device checks cleanly; the fraud only starts later, once control shifts to someone else. For any platform that verifies once at signup and trusts that verification indefinitely, a mule account is built to slip through undetected, whether it’s funding fraud under a clean identity or resuming activity that’s already been banned under a different account.
The scale of the problem backs this up. BioCatch's 2025 Digital Banking Fraud Trends report found that money mule cases in the U.S. rose 168% in the first half of 2025, alongside a threefold increase in bots used for account-opening fraud. The same report found confirmed money laundering cases at U.S. financial institutions more than doubled over that period compared to a year earlier.
KYC and device checks aren't wrong to trust a clean signup; they're just not designed to keep watching after it. We’ll cover what a mule account actually is, why identity checks stop working the moment control changes hands, and how precise location closes that gap without replacing the checks you already run.
What is a mule account?
A mule account is one where the person who legally created it isn’t the person actually using it. It sometimes starts with a simple offer: hey, if you create this account for me, I’ll give you $40. I know the account will get created, but I’m paying someone else to do it in their name, so the KYC looks good and the card details look valid. I fund it, often through a prepaid card, and then it just waits, until it gets transitioned to me, the actual bad actor.
A mule account typically moves through the same basic stages:
- Recruitment: a real person is offered payment, or tricked into thinking it’s legitimate work, in exchange for opening an account
- Clean setup: the recruited person completes onboarding themselves, so identity and card checks pass without issue
- Funding: the account gets loaded, often through a prepaid card, to make it look active and legitimate
- Handover: control quietly transfers to the bad actor, sometimes right away, sometimes after the account has sat dormant to look established
- Exploitation: the account gets used for fraud, promo abuse, or ban evasion, while still appearing tied to a real, verified identity
This shows up at scale too. I’ve seen phishing scams that use fake paid KYC surveys to collect real credentials under the pretense of legitimate work. Those same accounts get logged into later, whenever and however the bad actor wants.
A mule account passes every check at signup because a real person completes it. The fraud only starts once control changes hands. Once that handoff happens, the account gets used one of two ways: to move fraudulent funds under someone else’s clean identity, or to sneakily resume activity that’s already been banned under a different account. (We walked through this and other fraud patterns live in our recent session, how precise location uncovers fraud signals traditional signals miss.)
Why doesn’t KYC catch a mule account handover?
Identity and device checks are built to answer one question well: is this a real person, right now, at signup?
They’re not built to keep asking that question every time the account gets used again down the line. That’s the gap a mule account is designed to slip through, whether it’s used to fund fraud fresh or to pick up where a banned account left off, and it’s not a failure of any one tool; it’s just not what those checks were built to catch. The same structural gap shows up with IP-based signals: an IP address can confirm a network connection looks clean without confirming anything about who’s actually behind the device generating it.
Identity verification tells you an account started clean, but it can’t tell you it’s stayed that way. That’s not a reason to replace identity or device checks, but it is a reason to add a signal that keeps working after they’ve done their job.
How do you detect a mule account after it’s been handed off?
Once a mule account transitions, the person logging in now isn’t the person who set it up. A few things tend to shift at once:
- Device: a new or unfamiliar device suddenly logging into an established account
- Network signals: IP, connection type, or other network attributes that don’t match the account’s history
- Behavior: a change in how the account is used, timing, activity patterns, or actions that don’t fit what came before
- Location: the account’s activity is now coming from somewhere it’s never been
Individually, one shift like that might look explainable. The same pattern at scale is where it gets clear: if a bunch of mule accounts, all recruited through the same scheme, suddenly start logging in from one physical location, that’s precise location cutting through.
Location keeps checking after onboarding, closing the gap after identity checks stop.
How does precise location expose ban evasion?
Ban evasion is what happens after enforcement has already worked once. A fraudulent account gets caught and banned, but instead of stopping, the same person just picks up with a different account and keeps going. On paper, the new account looks unrelated, different identity, different login, nothing to connect it back to the one that was already shut down.
A pattern I look for: accounts and devices that are linked, and their locations are the same, but one account’s banned and the other one starts right after the ban gets applied. That gives you insight into whether someone’s evading it.
Individually, two accounts sharing a device and location might look unremarkable. Timed right after a ban, that’s precise location cutting through an attempt to quietly pick up where a banned account left off.
What other fraud types rely on mule accounts?
Mule accounts aren’t just a promo abuse problem or an account takeover problem. They’re a technique underneath both, and the same location signals apply across all three: verifying accounts are where they claim to be, surfacing hotspots and connections across accounts, and catching unexpected changes in behavior.
Whether the goal is claiming a signup bonus repeatedly, running a coordinated fraud ring, or evading a ban, it’s the same underlying move: separating who a system trusts from who’s actually acting on the account’s behalf. The same pattern shows up in financial services too, where coordinated fraud rings can pass every individual check while still exposing institutions to real AML risk.
You don’t need to rip out your identity or KYC checks to catch this. Adding precise location as a layer on top gives those checks something they were never built to provide on their own: a way to keep asking, after the fact, whether the account is still being used by the person it was verified for. See precise location in action by booking a demo with our team.
