What is Drop account?

What is a drop account?

A drop account is an account whose only job is to catch dirty money. It is not used for salary, rent, or groceries. It exists so that fraudulent transfers, scam payments, or laundered funds have somewhere to land before they are pushed onward through the system. In the trade, the account is the drop and the person controlling it is often called a money mule.

Two things create a drop account. It can be opened fresh with stolen or synthetic identity details, so it looks like a brand new customer, or it can be an existing account that gets taken over, either through account takeover or by paying a real person for their login and card. Either way, the controller is not the person whose name is on the account, or the name on the account was never real to begin with.

For a fraud or AML team, the drop account sits at the placement and layering stage. It is the first hop where stolen value enters an account you can see, and the speed at which money leaves is usually the whole point.

How a drop account gets used

Most drops follow the same short lifecycle, from setup to burn:

Set upOpen or take over the account A herder opens the account with a stolen or synthetic identity, or buys access to a real person's existing account.
PrimeKeep it quiet and warm The account stays dormant or runs a few small normal transactions so it looks aged and legitimate before the real use.
ReceiveCatch the fraudulent funds Scam payments, unauthorized transfers, or proceeds from other mules land in the account, often in bursts.
DrainMove it and abandon Funds are wired out, split to other accounts, spent, or pulled as cash within hours, then the account is left to be closed.

Who is involved?

Who	Their role
The herder	Runs the operation, recruits or buys accounts, and decides where the money goes next. Rarely touches the account directly.
The mule or holder	The person whose name and login control the account. Sometimes a knowing accomplice, sometimes a recruited victim or a fully stolen identity.
The upstream victim	The scam target, breached customer, or defrauded business whose money actually funds the drop.
The receiving bank	Holds the drop account and sees the inbound funds and rapid outflow first. Often the only party positioned to freeze the money in time.

What it looks like in practice

A checking account opened online three weeks ago has done almost nothing: one small deposit, a couple of trivial card purchases. Then, on a Tuesday afternoon, it receives a 9,400 dollar transfer described as an invoice payment from a business that has never sent it money before.

Within twenty minutes, the funds are split into two outbound transfers and a same-day cash withdrawal at an ATM in another state from where the account was opened. The next morning a business calls its own bank to report it was tricked into paying a fake vendor. By then the drop account is empty and the login is being accessed from a new device.

Why it matters for operators

Drop accounts are where fraud becomes irreversible. Once money leaves the drop, recovery odds fall sharply, so the window to act is measured in minutes, not days. A single herder can run dozens of drops at once, which means one confirmed drop is usually a thread into a larger network rather than an isolated bad account.

They also blur the line between fraud and AML. The account may be funded by a scam, an account takeover, or a business email compromise, but the moment it starts receiving and forwarding proceeds it becomes a laundering node too. Catching it early stops the loss and gives you the map of the accounts on either side.

What to watch in the data

Dormant then sudden. A quiet or newly opened account that abruptly receives a large or unusual inbound payment is a classic drop signature.
Fast pass-through. Money in and money out within hours, with little of it staying, means the account is a conduit, not a home.
Mismatched profile. Inbound and outbound amounts that do not fit the customer's stated income, age, or opening story deserve a second look.
Shared fingerprints. The same device, IP, phone number, or beneficiary appearing across several unrelated accounts points to one herder behind many drops.
Structuring on exit. Funds split into several smaller transfers or cash withdrawals just under reporting thresholds suggest a deliberate drain.

Quick questions

Is a drop account the same as a mule account?

They overlap heavily. A mule account is any account used to move illicit funds on behalf of someone else, and a drop account is the specific mule account set up to receive the money first. Every drop is a mule account, but not every mule account is the initial drop.

Does the account holder always know what is happening?

No. Some holders knowingly rent out their account for a fee, but many are recruited through fake job offers or romance scams and believe they are handling legitimate payments. Others never existed at all, because the account was opened with a stolen or synthetic identity.

Why does the money leave so quickly?

Speed is the defense. The faster funds are moved out and broken up, the smaller the chance a bank freezes them or a victim's payment gets reversed. A drop that holds money is a drop that gets caught.

How is a drop account different from a funnel account?

A funnel account gathers many small deposits from different places and sends them out as fewer large transfers. A drop account is more narrowly the receiving endpoint for a specific fraud, though the same account can play both roles in a laundering chain.

What surfaces a drop account first?

Usually the money movement, not a complaint. A dormant account taking a large inbound payment and immediately forwarding it is visible in transaction monitoring before the upstream victim even realizes they were defrauded.

What should a team do when it finds one?

Freeze or hold the outbound movement if the funds are still there, preserve the device and beneficiary details, file a suspicious activity report, and pivot outward to the accounts feeding and receiving from the drop to map the network.