Money Mule Account Detection Case Study

Business Problem

Money mules have become a key enabler for a lot of 3rd party fraud and other scams which impact customers and banks across the industry. Cybercriminals, motivated by large financial gain and armed with credentials stolen from numerous data breaches, are becoming adept at taking over genuine online banking accounts. However, once the fraudster infiltrates an account using stolen credentials, or deploys social engineering tactics against a genuine customer, the money must be moved to an account which the fraudster has control over and in which the ill-gotten gains can be laundered.

Defined as someone whose bank account is used to launder the proceeds of crime through the financial system, mules are engaged or recruited, either knowingly or unknowingly, for the purposes of laundering money. Hard to track, money is moved rapidly through large networks of seemingly unconnected mule accounts held at multiple financial institutions.

This large financial institution was faced with the challenge of how to identify money mule activity within their online banking environment, requiring a solution which would not only detect such activity, but also help stop funds from being moved and ultimately returned to the victims of the crime.

Establishing Trusted Behavior with LexID® Digital

Since LexisNexis Risk Solutions was first implemented, the bank has been able to identify 50% more mule accounts and has returned $965,000 of fraudulent funds to the victims of the money mules. Driving this success is the LexisNexis® Digital Identity Network®, which was able to reveal anomalous behavior indicative of money mules by analyzing attributes such as location, device and behavior anomalies.

The LexisNexis Digital Identity Network® uses anonymized global shared intelligence to better distinguish between customers and fraudsters, underpinned by crowdsourced intelligence from millions of daily consumer interactions including logins, payments, and new account applications across thousands of global businesses.

The bank was able to clearly see the spider web of linked accounts generated by mule activity. It could therefore connect known mule devices with new accounts at login, with email alerts, enabling it to quickly block these new mule accounts. Device and IP intelligence was leveraged to link devices and identify additional mules and networks, with the bank, in one instance, uncovering a fraud ring involving 140 mule accounts. The bank was also able to aid in the arrest of a fraudster recruiting mules, with intelligence from LexisNexis Risk Solutions able to pinpoint the location of the mule account activity.

The bank also deployed a mule model that targets unknown mules based on behavior patterns. This allowed it to analyze behavior and patterns at a granular level, and more accurately differentiate between new mules and legitimate behavior change. Allowing for changes in trusted user behavior, the mule model also helped to reduce friction for legitimate customers.