Disrupting Money Mule Activity Amid Rising P2P Fraud Losses

Rising inbound P2P fraud losses highlight the role Payment Ops teams play in recognizing and responding to money mule activity.

Keeping payments moving quickly and accurately becomes more complicated when criminals use customer accounts to receive and forward scam proceeds.

The cumulative change in average inbound P2P gross fraud losses rose 188.4% between Q1 2025 and Q1 2026, according to Auriemma Roundtables Fraud Benchmark data. That increase puts pressure on payment ops leaders to recognize suspicious receiving patterns, share relevant transaction history with fraud teams and coordinate action before more funds move through affected accounts.

Money mule activity offers one possible explanation for the sharp increase. A single mule account can receive payments from multiple scam victims, allowing fraud proceeds to accumulate across repeated transactions. If those payments appear routine when reviewed individually, the account may continue receiving funds while earlier payments are transferred or withdrawn. Delays in recognizing the pattern can give criminals more time to use the same account and compound the losses.

That sustained increase puts greater attention on receiving accounts and the opportunities to recognize suspicious activity before funds move onward. For payment ops teams, connecting incoming payments with subsequent transfers and withdrawals can help reveal accounts being used to collect and pass along illicit funds.

“If a mule account stays active, criminals can keep directing new victims to it,” says Howard Fish, Director of Auriemma’s Money Movement & Payment Operations Roundtable. “What looks like a series of unrelated incoming payments may be one account collecting the proceeds of several scams. By the time those connections become clear, the losses may have grown substantially.”

How Mule Activity Can Hide in Legitimate Accounts

A money mule moves illegally obtained funds for another person. These intermediaries help separate criminals from the source of the proceeds, making the trail harder to follow. Some money mules participate knowingly. Others believe they are performing a legitimate job or helping someone with whom they have a personal relationship.

The FBI notes that mules may use established accounts or open new ones in their real names, which creates a challenge for institutions relying heavily on identity and authentication controls. A customer can pass those checks and still use the account to receive and forward illicit funds. An account’s purpose and behavior can also change long after onboarding.

“A mule account can belong to a real person with a legitimate banking history,” says Troy Huth, Senior Director of Auriemma’s . “The warning sign may be a change in how the account is used, especially when incoming funds start moving quickly to other recipients.”

Consider an account that receives several P2P payments from new senders, then quickly sends most of the money out by wire. Viewed separately, those transactions may appear routine. Together, they could suggest the account is collecting and forwarding funds for someone else, particularly if that behavior is unusual for the customer.

Payment ops teams can help reconstruct that sequence when researching a payment or supporting a fraud investigation. Bringing together the incoming payments, outgoing transfers and their timing helps fraud teams assess whether the activity warrants further investigation. This becomes especially useful when different systems hold different pieces of the transaction history.

“A payment can look ordinary until you see the transactions around it,” says Fish. “Payment ops can help show where the funds came from and where they went, giving fraud teams a clearer picture of the account’s activity.”

Acting Before More Money Moves

Payment ops teams can strengthen their response to suspected mule activity by following key best practices, including:

• Define what happens after an alert. Establish which pending transactions require review, who reviews them and how urgent concerns are escalated.
• Clarify decision authority. Identify who can authorize account restrictions and who is responsible for putting them into effect.
• Check controls across payment channels. Confirm that approved restrictions cover the intended channels, including any routes through which funds could continue moving.
• Review delays and missed actions. Examine activity after an alert to identify late instructions, unclear ownership or incomplete restrictions that allowed additional funds to move.

Compare Controls with Peers

Executing on these best practices means deciding what teams and functions review suspicious activity, what information is needed, and who can ultimately authorize action. These are the practical questions leaders work through with peers in Auriemma Roundtables’ Money Movement & Payment Operations Roundtable, enabling them to compare approaches and identify gaps in their own processes.

To learn more about joining the Money Movement & Payment Operations Roundtable, contact Warren Murphy at wmurphy@roundtables.us