A mule network is a coordinated set of mule accounts used to split and move dirty money fast across many banks, built so no single bank sees enough of the flow to act. The design turns each institution's partial view into a blind spot the network exploits.
What is a mule network, in plain English?
A mule network is many mule accounts working together as one machine. Instead of pushing stolen money through a single account, an operation spreads it across dozens or hundreds of accounts at different banks, moves it in small fast hops, and recombines it downstream. The scattering is the point: it makes the money hard to trace and, crucially, ensures that no one institution sees more than a fragment of the whole.
The network is engineered around single-bank blind spots. Each bank only sees the legs of the flow that touch its own accounts, which on their own can look like ordinary payments. The parts that would reveal the scheme, the shared devices, the common funding, the synchronized timing, and the final consolidation, sit across institutional boundaries where no single monitoring system is looking.
These networks are the plumbing behind large-scale fraud. Proceeds from scams, account takeover, and business email compromise flow into them, get layered through the fan-out, and emerge somewhere the origin is obscured. Because the network spans banks, seeing it clearly usually depends on shared industry data and link analysis rather than any one institution's view.
How money fans out and back in
- Enter — Money lands. Stolen funds arrive at one or a few entry accounts within the network.
- Fan out — Split and scatter. The money is divided into small amounts and pushed across many mule accounts at different banks.
- Hop — Move fast. Funds bounce quickly between accounts, adding layers and distance from the original source.
- Fan in — Recombine and exit. The fragments converge on funnel or collection accounts and leave the system as cash or crypto.
Who is involved?
Who | Their role |
The herder | Recruits and coordinates the accounts and controls the fan-out and fan-in. |
The mule accounts | Hold and relay small slices of the flow across many different banks. |
The funnel accounts | Recombine the scattered fragments into usable sums near the exit. |
Banks and industry data | Each bank sees a fragment; shared data and consortium signals reveal the whole. |
What it looks like in practice
In practice
A scam victim's payment lands at one bank and is gone within minutes, split into eleven smaller transfers to accounts at six different institutions. At each receiving bank, the incoming payment looks like a modest, unremarkable transfer, and nothing on its own trips a threshold.
Only when a shared-data check runs do the pieces connect: the same device touched accounts at three banks, several were opened in the same week, and all the outbound legs converge on two accounts that cash out through a crypto exchange the next morning. No single institution could have seen that shape from its own books alone.
Why it is hard for operators
The whole design attacks the fragmentation of visibility across the banking system. Each institution monitors its own accounts, and a mule network is built so that the slice touching any one of them looks benign. The signals that would give it away, common identifiers and synchronized timing, are precisely the ones that live between banks, outside any single monitoring boundary.
That is why shared industry data and cross-account link analysis are central here. Consortium signals let a bank see whether a counterparty or device is already tied to mule behavior elsewhere, and network analysis turns a scattered set of small payments into a visible fan-out and fan-in. Working these cases well means treating the network, not the individual account, as the unit of investigation.
What to watch in the data
- Fan-out and fan-in. Money splitting rapidly to many accounts and later reconverging on a few destinations.
- Shared identifiers. Common devices, IPs, addresses, or funding sources across accounts that appear unrelated.
- Synchronized timing. Bursts of coordinated activity across accounts, suggesting a single controlling hand.
- Cross-bank hops. Fast movement across several institutions that keeps any one bank's view partial.
- Consortium hits. Counterparties or devices already linked to mule activity in shared industry data.
Quick questions
How is a mule network different from a single mule account?
A single account is one relay; a network is many accounts coordinated to move money together across banks. The network's power comes from spreading the flow so no one institution sees enough to act.
Why spread money across so many banks?
To exploit single-bank blind spots. Each bank only sees the legs that touch its own accounts, and those fragments look ordinary. Scattering the flow keeps the revealing patterns outside any single monitoring view.
What are fan-out and fan-in?
Fan-out is splitting one inbound sum into many small transfers across accounts; fan-in is recombining those fragments at a few collection points. Together they are the signature shape of a mule network.
Why is shared data so important here?
Because the connective signals live between institutions. Consortium and shared industry data let a bank see whether a device, account, or counterparty is already tied to mule activity elsewhere, closing the blind spot a single view leaves open.
Who controls a mule network?
A herder or a criminal group coordinates the accounts, sets the routing, and manages the consolidation. The network is the operational layer that launders proceeds for the crime above it.
What is the right unit of investigation?
The network, not the individual account. Clustering accounts by shared identifiers and mapping the fan-out and fan-in produces a far stronger case and a real chance to disrupt the operation.