A mule herder is the organizer who recruits, directs, and pays money mules, then gathers up the laundered proceeds. The herder sits above the mules and below the ultimate criminal, running the operational layer that keeps dirty money moving.
What is a mule herder, in plain English?
A mule herder is the middle manager of a laundering operation. They find and onboard money mules, tell them what to do, pay them their cut, and collect the money after it has passed through the mule accounts. The herder does not usually own the underlying crime; they run the service of moving its proceeds, sitting between the mules below them and the fraudster or criminal group above.
Herders exist because mules are disposable but need coordinating. Individual mule accounts get flagged and frozen quickly, so an operation needs a steady supply of fresh recruits and someone to route money through them, keep the instructions flowing, and consolidate the takings. That coordination role is what the herder provides, often as a paid layer within a larger crime-as-a-service model.
For investigators, the herder is the pivot point. Catching a single mule barely dents the operation because another recruit replaces them within days. The herder is where the threads converge: the person funding many accounts, issuing the same instructions, and pulling the money together at the end.
How a herder runs an operation
- Recruit — Source mules. Fake jobs, social media, and messaging groups bring in a rolling supply of account holders.
- Direct — Issue instructions. The herder tells each mule when money will arrive and exactly where to send it on.
- Route — Push money through. Proceeds fan out across many mule accounts, then fan back in toward the herder's collection points.
- Consolidate — Gather and hand up. The herder pays the mules, keeps a margin, and passes the cleaned money up to the ultimate criminal.
Who is involved?
Who | Their role |
The herder | Recruits, directs, and pays mules, and consolidates the proceeds for delivery upward. |
The mules | Receive and forward money through their own accounts on the herder's instructions. |
The ultimate criminal | The fraudster or organized group whose proceeds the herder is hired to launder. |
The bank or FIU | Sees the many-to-one funding and instruction patterns that can expose the herder behind the mules. |
What it looks like in practice
In practice
A bank flags eight unrelated accounts, all showing fast in-and-out flows. On their own each looks like a lone mule. But when the team pulls funding and device data, the same recovery phone number appears on three of them, a single device fingerprint touched five, and small setup payments to all eight traced back to one account described as reimbursing expenses.
Following the outbound legs, the money from all eight converges on two collection accounts within a day. The person controlling those accounts, funding the setup, and sending the same instructions is the herder. Freezing the eight mules would have paused one cycle; identifying the herder is what threatens the whole operation.
Why it is hard for operators
Herders deliberately keep distance between themselves and the money. They rarely receive stolen funds directly; the mules absorb that exposure. What links a herder to the scheme is coordination, not custody: shared contact points, funding that flows into many mule accounts, reused devices and references, and the timing of instructions. None of that shows up if you only look at transactions.
Because of that, chasing individual mules is a treadmill, so investigations try to pivot from the mules upward. The productive move is to cluster the mule accounts, find the shared identifiers and the setup funding, and follow the consolidation points until they converge on a controller. That is slower than closing a single alert, but it is the only path that actually disrupts the network.
What to watch in the data
- Shared contact points. The same phone number, email, or address recurring across otherwise unrelated mule accounts.
- Setup funding. Small payments or instructions flowing from one source into many mule accounts before they activate.
- Reused devices and IPs. A single device or network fingerprint touching accounts that should have nothing in common.
- Convergent flows. Money fanning out across many mules and fanning back in toward a small set of collection accounts.
- Common references. Repeated payment narratives or beneficiary details that betray a single coordinating hand.
Quick questions
How is a herder different from a mule?
The mule moves money through their own account; the herder organizes many mules, directs them, and collects the proceeds. The herder sits one layer up and is the harder, higher-value target.
Does the herder touch the stolen money directly?
Often not until the consolidation stage. Herders keep distance by pushing funds through mule accounts first, which is why coordination signals, not direct custody, usually expose them.
Why is catching one mule not enough?
Mules are disposable and quickly replaced. Removing one barely affects the operation, whereas identifying the herder threatens the whole supply of accounts and the point where money is gathered.
What signals point to a herder rather than a mule?
Shared contact points, setup funding into many accounts, reused devices and references, and flows that converge on a few collection points. These are relationship signals across accounts, not features of a single transaction.
Where does the herder sit in the wider scheme?
Between the mules and the ultimate criminal. They run the operational laundering layer as a service, often within a crime-as-a-service ecosystem, and hand cleaned money upward for a margin.
How do teams reach the herder?
By clustering mule accounts on shared identifiers, tracing the setup funding backward and the outbound flows forward, and locating where everything consolidates. Consortium data helps when the network spans multiple institutions.