Little donkey … oh no, it’s a money mule!

I just went to a really interesting meeting where the head of
fraud for one of the major banks presented their approach to money mules.

Pic from eCybercrime

A money mule is a bit like a
drugs mule, someone who is carrying out illicit activities on behalf of others.

His definition is that a money
or cashout mule is one where an account is “used to receive fraudulent funds
form a third party victim.  The individual involved may or may not be
complicit in the crime:

• Complicit individuals are fully aware of their
  involvement in the process, e.g. they open the account with the intention to defraud;
  whilst

• Non-complicit individuals are unaware of their involvement,
  e.g. victims of phishing attacks, account takeover, job advert scams (duped)
  etc"

Another definition, just
to add spice to the mix, comes from the Payments Council:

A "money
mule", or "money transfer agent" as it is sometimes called, is
someone recruited by fraudsters needing to launder the funds obtained as a
result of phishing and Trojan scams. As most fraudsters behind these scams are
located overseas and it is not possible to make cross-border transfers from
most online bank accounts in the UK, a "money mule" is required to
launder the money. After being recruited by the fraudsters, money mules receive
funds into their accounts and they then withdraw the money and send it overseas
using a wire transfer service, minus a certain commission payment.

Mules are often overseas and are serious linchpins in the
process of crime.  For example, the FBI released
this poster in 2010 of the most wanted money mules in America:

Note the ages of these folks.  Average age? 
22?  23?

That’s the typical person involved in the process.

The crime falls into those who are committing first party
fraud and beneficiary fraud.

The fraudsters’ modus operandi
for first party fraud is to open an account with a view to secure an advance
loan or overdraft, or commit a scam such as authorised loan abuse with no intention
of repaying the debt.

The accounts opened often
involve the impersonation of a real person, the creation of a completely false
ID, utilisation of someone else’s account with or without their permission or
using a legitimate ID. 

Meanwhile, the typical profile
of a first party fraudster mule is:

• Male aged 26-32
• Less than 36 months since account opened with
  the bank
• No salary mandate linked to the account
• Usually living in London, Manchester, Birmingham

Beneficiary fraud differs in
that the accounts are used to process the proceeds of a fraud or scam against
other financial institutions.  Beneficiary accounts are opened with the
sole intention of being used fraudulently, although sometimes they are opened
with good intention and later sold on to others to use for fraudulent purposes.

The typical profile of a beneficiary
fraudster mule is:

• Male aged under 25
• Less than 6 months or more than 36 months since
  the account was opened with the bank
• More likely to have a salary mandate linked to
  the account
• Usually living in London, Manchester, Birmingham

According to the bank fraud
president:

• 43% of frauds are committed within six months of
  account opening compared with 20% after over 36 months.
• 28% are committed by under 20 years old
• 70% are by people who are not UK nationality
• 80% have no regular salary

Many are from large fraud
rings with linked beneficiaries across multiple accounts and banks

This is why the bank closes
around 2,500 accounts or more every year, especially where they can see a link
to a confirmed beneficiary account.

The issue is that closing these accounts causes outrage.  For example, the BBC Money Box program has
covered two cases in recent times:

• Concern over closure of ethnic minority accounts, 27
  September 2013
• Fraud alert closes account of six-month-old baby girl, 19
  November 2011

 

Which raises the question: how
can you avoid fraudsters whilst still delivering a fantastic customer experience?

I have an answer to that one, but need to scoot right now.

More later.