Money mules: mule activity and cashing out findings

Money mule activity is a form of money laundering in which a person transfers or receives criminal funds on behalf of others. We want to improve understanding of the threat and help firms strengthen their financial crime controls.

Our findings are based on:

• Our survey of financial services firms on suspected money mule activity.
• Our analysis of how fraud proceeds move through the financial system.

FCA-regulated firms have identified and closed an increasing number of suspected mule accounts over the last 3 years. Over 230,000 suspected mules were offboarded in 2025, up from around 185,000 in 2023.

Some accounts had been used multiple times and across different fraud types, suggesting an established criminal infrastructure rather than isolated or opportunistic misuse.

We also looked at cashing out, where the criminals take the money back out of the mule system, for example, by cash withdrawals or making various purchases.

Whilst victim funds sometimes moved through long chains of mule accounts, our analysis found that cashing out activity was mainly concentrated between the second and fifth mule accounts, with the highest concentration at the second mule account. This shows the importance of identifying and disrupting the activity as early as possible.

Our findings reinforce the importance of information-sharing. There are opportunities for firms to share more information about suspected mules, including through the voluntary information-sharing provisions of the Economic Crime and Corporate Transparency Act 2023[2].

This multi-firm review will be of interest to:

• banks, building societies, payments institutions (PIs) and e-money institutions (EMIs)
• money laundering reporting officers (MLROs)
• nominated officers
• professionals working in financial crime, compliance and fraud

Firms should consider our findings in the context of their own business models, customer bases and exposure to money mule risk, and the evolving nature of the threat.

Firms should use these findings to inform their own assessment of the money mule risks they face. They should review their controls for detecting, preventing and disrupting money mule activity, and strengthen them where necessary.

A money mule is a person who transfers or receives criminal funds on behalf of others. They help criminals move and disguise the proceeds of fraud and other financial crime across the payments ecosystem.

Fighting financial crime is one of our strategic priorities[3]. Tackling the threat of money mules is also a system priority[4] as part of the UK’s response to economic crime.

Our work aligns with the Home Office’s Fraud Strategy 2026-29[5], which recognises the role that money mule networks play in facilitating fraud and financial crime.

This work follows our earlier publications on detecting and preventing money mules[6], and firms' use of the National Fraud Database (NFD) and money mule detection tools[7].

We wanted to understand more about money mule networks and are sharing our findings so that firms can consider where they can improve their defences. Previously, there was no reliable estimate of the total number of money mules affecting FCA-regulated firms. To address this, we surveyed 35 retail banks, building societies, challenger banks, PIs, and EMIs.

To build on the survey data and add an operational understanding of how money mules facilitate the movement and cashing out of fraud proceeds, we established a public/private cell in 2025, a working group with 22 regulated firms.

The cell looked at 140 cases, covering 7 types of fraud. It traced the highest-value payments through a series of accounts until the funds could no longer be followed. The cell members then pooled intelligence on where the funds went next and how criminals cashed them out. This enabled us to analyse how funds moved through mule account chains and where cash out activity occurred.

In this publication, 'challenger banks' are treated separately from retail banks and are defined as banks operating outside the traditional high-street, retail banking model.

1. Offboarding increased between 2023 and 2025, but is now slowing

Reported offboarding, where firms closed suspected money mule accounts, rose over the 3-year period to 238,396 in 2025, but slowed in the final year. This is up from 184,935 in 2023 and 233,269 in 2024.

The accounts were registered to personal customers, businesses, charities, non-profit organisations and other legal entities. Most of them were held with retail banks and building societies, but the biggest increase over the period was among EMIs.

Increases in reported offboarding of mules by EMIs, PIs and challenger banks doesn’t necessarily mean mules are making up a higher proportion of their business as it may reflect broader customer growth alongside improvements in identifying and acting on suspected mule activity.

The National Fraud Database (NFD)[8] is maintained by the fraud prevention service Cifas and records fraud and money mule cases in the UK. To file a money mule case, Cifas members must have reasonable grounds to believe that fraud or financial crime has been committed or attempted, supported by clear, relevant and rigorous evidence.

This differs from the threshold for a firm closing an account because of suspected money mule activity. Because of this difference, we do not expect the number of NFD filings to match the number of suspected mule accounts.

Filings were concentrated among retail banks and building societies. PIs and EMIs reported fewer filings, although their filing numbers increased from 2023 levels.

The activity must also meet the relevant Cifas category criteria. In 2023 and 2024, it recorded money mule cases under the broader 'Misuse of Facility' category. However, in 2025 it introduced a dedicated 'funds received for money muling' category. Together with revised filing criteria and guidance, this means data for 2025 is not directly comparable with 2023 and 2024.

It’s important for firms to use the NFD effectively to identify and disrupt mule activity, alongside tools that trace fraud proceeds across the payment network.

2. Nearly half of suspected mule accounts were closed within a year

PIs and EMIs closed a higher proportion of accounts within the 6 months of the account being opened. Challenger banks reported a high proportion within the first year.

Accounts that had been open for more than 3 years made up a greater share of closures at retail banks and building societies than at PIs and EMIs.

The data shows how old the closed accounts were, not when the suspected money mule activity occurred.

Therefore, we cannot see whether longer-tenure accounts had always been used for mule activity, or whether it happened after a period of legitimate use.

3. The suspected mule profile is changing

There were some changes to the type and organisations involved in mule activity, which varied across the type of firm they used.

Personal accounts represented around 92% of account closures for suspected money mule activity between 2023 and 2025. Account closures were highest among customers aged 26 to 39, while the sharpest increase was among customers aged 40 to 49. Customers aged 21 and under also represented a significant proportion of closures.

Suspected mule account closures were more concentrated among younger customers at challenger banks, while retail banks reported a more even distribution across age groups.

Business account closures were higher in 2025 than in 2023, but lower than in 2024. Challenger banks accounted for around half of reported business account closures in 2025. Cases involving charities, non-profits and other legal entities increased over the period, although volumes remained low overall.

Where firms recorded gender, around two-thirds of suspected mules were men. This proportion remained broadly stable over the 3-year period. The data has limitations because some firms did not collect data and some customers did not disclose it.

1. Fraud proceeds were usually cashed out after moving through 2 to 5 mule accounts

Criminals moved fraudulent funds through multiple accounts, usually cashing out between the second and fifth account. By this stage, funds had been broken into smaller, less conspicuous payments, making them harder to detect and trace.

2. Retail banks saw the higher volumes, while non-retail firms saw higher-value transactions

Retail banks accounted for most transactions passing through mule accounts, whereas other firms experience lower volumes but higher-value transactions. This suggests different criminal behaviours, cash-out strategies and risk concentrations.

3. Card payments were the most common cash-out method

Card payments were used to make lots of low-value transactions, or higher-value payments to local businesses and retailers.

As card payments can resemble legitimate consumer spending, they’re a versatile route for dispersing and monetising fraud proceeds. This makes mule activity harder for firms to detect and trace.

4. International and crypto cash-out methods were typically higher in value

Mule activity was not confined to UK payment flows. Recurring destinations included South Asia, West Africa and the Middle East. Higher-value cash-outs and repeated destination patterns may indicate more organised mule activity.

Crypto cash-outs were lower in volume but larger in value, suggest more selective use as a deliberate laundering route.

5. Repeat mule accounts suggest organised criminal infrastructure

Some accounts had been used multiple times for mule activity before firms shut them down, and there were accounts across multiple scam and fraud types. This suggests an established criminal infrastructure rather than isolated or opportunistic misuse.

Timely intelligence-sharing between firms can help identify linked accounts, recurring cash-out routes and laundering methods, so they can detect and disrupt mule activity earlier.

Firms should make sure they understand how criminals move funds between accounts. This applies within their own institution, and externally through information-sharing arrangements. This should inform the way they identify and respond to suspected money mule activity.

Different firms are exposed to different patterns of mule activity. Their controls should be proportionate to the particular risks they face.

Firms should regularly review their controls and respond to emerging mule patterns and cash-out behaviours. They should use data and intelligence appropriately when they assess suspected mule activity and decide how to respond.

Firms should consider indicators beyond the initial receiving account, including linked accounts within the institution, payment characteristics, the broader transaction context, and customer.

Where appropriate, firms should use the information-sharing provisions available under the Economic Crime and Corporate Transparency Act 2023[10] to help prevent, detect or investigate economic crime.  
 

We are working with the National Economic Crime Centre (NECC)[11] to issue an alert to relevant firms providing further details of the cell’s findings.

We will continue to monitor firms’ approaches through supervisory work to ensure they are responding to evolving money mule threats.
 

We surveyed 35 regulated firms on suspected money mule activity, covering reported offboarding, filings to the National Fraud Database (NFD) maintained by the fraud prevention service Cifas, account tenure, customer type, age and gender across 2023 to 2025.

What we found

Money mules offboarded

Reported offboarding for suspected money mule activity increased by 28.9% between 2023 and 2025, from 184,935 in 2023 to 238,396 in 2025. Across the full period, firms offboarded 656,600 customers.

Retail banks and building societies accounted for 56.1% of suspected mule accounts offboarded in 2025, although this was 10.9% lower than in 2024.

Challenger banks accounted for 33% of customers offboarded in 2025, while e-money institutions (EMIs) recorded the largest year-on-year increase, with offboarding volumes rising by 164.6% compared with 2024.

Cifas filings to the National Fraud Database (NFD) for misuse of facility

Cifas introduced a dedicated money mule filing category in January 2025, and year-on-year movements in filings should be interpreted in light of that. Prior to this, money mule cases were recorded under the broader ‘misuse of facility’ category, limiting direct comparison with previous years.

Across the period, reporting firms submitted 113,655 filings to the NFD. The proportion of offboarded customers filed to the NFD fell by 2.1% from 17.4% in 2024 to 15.3% in 2025, a decrease of 12.2% in relative terms.  

In 2025, retail banks and building societies submitted 23,397 filings to the NFD, accounting for 64.1% of all filings.

Challenger banks submitted 12,785 filings, broadly in line with 2023 but below 2024 levels.

Payments institutions (PIs) and EMIs submitted 215 and 105 filings respectively in 2025, compared with no reported filings in 2023.

Account tenure

The account tenure figures are higher than the total number of customers offboarded, as some offboarded customers held multiple accounts with surveyed firms.  

In 2025, 114,984 accounts were offboarded within the first year of opening, representing 47.1% of the account tenure figures. This comprised 55,353 accounts offboarded within 3 months of opening, 28,739 between 3 and 6 months, and 30,892 between 6 and 12 months.  

Offboarding patterns varied by firm type.

EMIs and PIs tended to offboard accounts relatively soon after opening, with 74.1% and 56.9% of customer accounts offboarded within 6 months respectively.

Whereas retail banks and building societies more often offboarded longer-standing accounts, with 45.4% of customer accounts offboarded after more than 2 years.

Challenger banks showed a more mixed pattern across account tenures.

Customer type

Personal customers represented 93.2% of offboarded customers in 2025, a 30.5% increase from 2023. Business account offboarding was 10% higher than in 2023, although 20.8% lower than in 2024.

In 2025, challenger banks accounted for 50.1% of offboarded business accounts. Charities, NPOs and other legal entities accounts’ offboarding volumes increased by 386.7% compared with 2023 and 97.3% compared with 2024. Although this represents a substantial percentage increase, the volumes remained very small overall.

Age

Customers aged 18 to 39 accounted for 71.9% of suspected money mules offboarded in 2025. Within this, customers aged 26 to 39 represented the largest age group, accounting for 39.2% of the return, followed by those aged 18 to 25 at 32.8%.

Customers aged 40 to 59 offboarded for suspected muling increased by 61.3% compared with 2023 and by 31.3% compared with 2024. This was primarily driven by customers aged 40 to 49, where offboarding increased by 79.8% compared with 2023 and by 44.7% compared with 2024.

Under-18s accounted for 3.7% of suspected money mules offboarded in 2025. Within this group, under-16 offboarding fell from 1,754 in 2024 to 1,343 in 2025, a decrease of 23.4%, although volumes remained 13.5% above 2023 levels.

Gender

Where gender was known, male customers consistently account for around two thirds of offboardings, compared with around one third for female customers.

The number of male customers offboarded increased by 30.1% between 2023 and 2024. It then fell by 7.8% in 2025, but remained 20% above the 2023 level.

The proportion recorded as unknown, not collected, or preferred not to say increased from 24.1% in 2024 to 30.1% in 2025. This limits the conclusions that can be drawn about changes in the gender profile.