Mule accounts pass KYC. That is the whole problem.
A money mule account is opened with a real name, a real document and a real face. Every check the onboarding flow was designed to run comes back clean, because nothing about the identity is false. The fraud is not in the identity. It is in the relationship between accounts, and that is a layer most onboarding stacks never look at.
This article covers what mule account detection requires, why the two controls banks rely on most cannot see the pattern, and where biometric identification changes the picture. It closes with the Mexican market, where a recent regulatory change makes this concrete.
Deepfakes are becoming more sophisticated, increasing the risk of fraud and identity manipulation in digital environments. Download our 10-step guide to learn how to detect threats early and protect your organization with proven best practices.
What a mule account is, and the three types that matter for detection
A mule account receives funds from illicit activity and moves them onward, breaking the trail between the crime and the cash. Fraud proceeds, scam payments and laundered money all pass through them.
The scale is not marginal. In the ninth edition of the European Money Mule Action, run in 2023, law enforcement agencies coordinated by Europol identified 10,759 money mules and 474 recruiters in a single operational cycle, leading to 1,013 arrests. A total of 2,822 banks and financial institutions took part alongside them. Those are the ones that were found.
Mule accounts come from three routes, and they are not equally hard to detect.
Recruited mules are real people who agree to lend their identity, usually for a small payment. Europol’s awareness materials point to newcomers to a country and people in financial difficulty as frequent targets, often approached through fake job advertisements online. The account is genuinely theirs.
Coerced or unwitting mules are people whose identity is used without informed consent, often through fake job offers or romance scams. Europol describes recruitment through advertised roles such as money transfer agent, through online advertising and through messaging apps. The paperwork is legitimate and the person is present at onboarding.
Synthetic identities combine real data points with fabricated ones to create a person who does not exist but who passes document checks. These are the hardest to catch, and they are the ones that scale, because the same fabricated profile can be reproduced with variations rather than built from nothing each time.
What links all three is volume. Mule networks do not open one account. They open dozens or hundreds, often at the same institution, often within weeks. That repetition is the detectable signal.
Why transaction monitoring detects mule accounts late
Transaction monitoring is designed to flag anomalous movement of funds. It works, and it is required. But it is a lagging control by construction.
The account has to exist, be funded and move money before a rule fires. By the time an alert reaches an analyst, the funds have often already been forwarded, which is why recovering them is difficult once the chain is in motion.
Mule operators also tune their behaviour to stay under thresholds. Amounts sit below reporting limits, transfers are spread across accounts, and dormancy periods are inserted before the account is used. A network of forty accounts each moving modest sums is far less visible to a rules engine than one account moving the same total.
Transaction monitoring is the right control for the money. It is the wrong control for the account farm.
Why 1:1 verification cannot detect mule account networks
Most identity verification at onboarding is 1:1. The system compares the selfie to the document photo and answers a single question: is this person the person on this document?
That is a useful question. It stops document fraud and impersonation. It also cannot detect mule networks, and the reason is structural rather than a matter of accuracy.
A 1:1 check evaluates one application in isolation. It has no memory of the other applications. If the same person opens six accounts using six genuine identities they have been paid to lend, each check returns a correct positive result. If a synthetic identity operator uses the same face across twelve fabricated profiles, every single check passes, because in each case the selfie really does match the document in front of it.
The system is answering the question it was asked. The question is incomplete.
How 1:N biometric identification changes mule account detection
The missing question is different: have we seen this face before, under a different name?
Answering it requires 1:N identification, where a new biometric sample is searched against the entire enrolled population rather than compared to one document. This is what an ABIS, an Automated Biometric Identification System, is built to do.
At onboarding, the effect is immediate. The applicant’s biometric is searched against existing customers and against prior applications. If the same person appears under a second identity, the system surfaces it before the account is opened rather than after the money has moved.
This is deduplication, and it changes what each of the three mule types looks like. It is worth being precise about which ones, because deduplication does not reach all of them equally.
Synthetic identity fraud detection
This is where 1:N is strongest. Fabricated profiles have to reuse something. Generating a single convincing face is no longer expensive, but keeping a face, a document and a data trail consistent across dozens of profiles and over time is a different problem, and reuse across profiles is exactly what 1:N search detects.
Account farms and repeat enrolment
Where the same individual enrols under more than one identity, which is the defining pattern of an account farm, deduplication surfaces it on the second attempt rather than on the fortieth. This holds whether the identities are synthetic, borrowed or stolen.
Recruited and coerced mules: what deduplication does not reach
If a recruited mule opens one account in their own name, using their own genuine document, nothing at onboarding will flag it. The person is real, the document is real, the face matches, and the enrolment is legitimate at the moment it happens. Deduplication does not change that, and a vendor claiming otherwise is overstating what the control does.
What does apply is a different placement of the same technology. Biometric step-up at the point of transaction requires the account holder to be physically present when funds move, which breaks the arrangement where one person opens an account and another operates it remotely. It does not detect the recruitment. It removes the utility of the account.
Cross channel reuse
The same person appearing in a branch, in an app and through a partner channel under different identifiers is invisible to any control that treats those channels separately. A shared biometric gallery makes it a single query, provided the institution has the legal basis and the governance to hold and search one.
A note on scope. Europol’s operations reach mule networks by pooling intelligence across institutions and borders. Not every jurisdiction allows that, and some deliberately prohibit it. Where sharing is restricted, deduplication works within one institution’s own enrolled population: narrower reach, but available in real time at the point of enrolment rather than after the fact.
Get a tailored demo of our contactless biometric platform and see how it fits your specific use case.
Implementing biometric deduplication in onboarding
Adding 1:N to an onboarding flow raises engineering and governance questions worth planning for.
Capture quality determines search quality. A 1:N search across a large gallery is far more sensitive to sample quality than a 1:1 comparison. Poor lighting, motion blur and low resolution produce missed matches. Capture has to be controlled at the point of collection, on the device, rather than corrected later.
Liveness has to sit underneath it. A 1:N search on a sample that was injected or presented from a screen produces a confident answer about the wrong thing. Presentation attack detection, tested under ISO/IEC 30107-3, and injection attack detection are prerequisites rather than optional additions. Where a vendor cites evaluation results, ask which conditions the evaluation was run under.
On-device processing helps on three fronts. Keeping the capture and the initial processing on the phone reduces the volume of biometric data in transit, keeps latency low enough for the check to happen inside the onboarding flow, and lets the process complete where connectivity is unreliable. For institutions operating across rural areas or in markets with uneven network coverage, this is a coverage requirement rather than an optimisation.
Governance has to be defined before deployment. Retention periods, consent language, the declared purpose of the database, the legal basis for searching against an existing population, and the human review path for a match all need to be settled with legal and privacy teams up front. This is not paperwork that follows the build. In several jurisdictions biometric data is classified as sensitive personal data, and searching an enrolled population for fraud prevention is a different purpose from authenticating a customer. Different purpose, different legal basis, different disclosure. A match is an investigative signal, not a verdict, and the process around it should reflect that.
Multimodal raises the ceiling. Face alone is workable. Face combined with fingerprint gives a materially stronger deduplication result, particularly at national scale, and it provides a fallback when one modality is unusable.
Mule account detection under Mexico's new CNBV biometric rules
Mexico offers a concrete example of this shift, because the regulatory framework moved first.
On 1 July 2026 the Comisión Nacional Bancaria y de Valores published in the Diario Oficial de la Federación a resolution amending the general provisions applicable to credit institutions, in respect of identity verification in in-person banking transactions. Until then, those provisions recognised only fingerprint as a biometric verification method for those transactions. The resolution adds facial biometrics, requires verification against the records of the electoral institute, the foreign affairs ministry, or another Mexican tax or federal authority providing a comparable service, with a minimum match of 90 percent, and replaces the technical annex governing biometric capture. It entered into force on 2 July 2026, and institutions were given a maximum of 90 business days to adapt.
The resolution also allows institutions to build their own biometric databases of customers, subject to dedicated infrastructure, encryption and access controls. Institutions must notify the supervisor when they begin or cease using such a database. Selling, transferring, sharing or exchanging those databases between institutions or with third parties is prohibited, and queries run against each institution’s own database only. For now the database is limited to fingerprint and facial data, until the Commission issues technical specifications for other biometric types.
The immediate reading is compliance. Institutions need facial capture in in-person flows that previously relied on documents, fingerprint and manual review.
The second reading is architectural, and it needs one qualification stated clearly. The resolution frames these databases around authentication of clients. It does not mandate, and does not by itself authorise, 1:N search for fraud prevention or the reuse of a credential for other purposes. Those are different purposes, and under Mexican data protection law biometric data is sensitive personal data, so an additional purpose requires its own legal basis, its own disclosure in the privacy notice and its own express consent. Compliance with the resolution does not carry those purposes with it.
What the resolution does leave behind is a consistent biometric record of the customer base, held by the institution itself, built to a defined technical standard. That record is the precondition for deduplication. Whether it becomes one is a separate decision, taken deliberately and documented with legal counsel before the first enrolment rather than after.
An institution that treats the requirement as a checkbox will deploy facial capture, satisfy the supervisor, and still be unable to answer whether the same person holds accounts under three names. An institution that scopes the purpose properly at the design stage keeps that answer available to it.
The deadline is the same for both. The optionality afterwards is not.
Where to start with mule account detection
Mule account detection is a sequencing problem more than a technology problem. Transaction monitoring will keep doing what it does well. What sits in front of it determines how much reaches it.
Three questions to put to your team:
- If the same person opened accounts under three different identities today, at what point would we find out?
- Do we have a biometric record consistent enough across channels to search against, and a declared purpose that covers searching it?
- Is our capture step strong enough that a 1:N result would be trustworthy?
If the answer to the first question is “when the money moves”, the gap is at onboarding, and it is an identity layer question.
Talk to our team about evaluating a digital identity platform, and about where ABIS fits in your onboarding architecture.
Get a tailored demo of our contactless biometric platform and see how it fits your specific use case.
References
Europol, Paper trail ends in jail time for 1,013 money mules, European Money Mule Action (EMMA 9) results, 2023. https://www.europol.europa.eu/media-press/newsroom/news/paper-trail-ends-in-jail-time-for-1-013-money-mules
European Banking Federation, Paper trail ends in jail time for 1,013 money mules. https://www.ebf.eu/ebf-media-centre/paper-trail-ends-in-jail-time-for-1-013-money-mules-2-822-banks-and-financial-institutions-join-forces-with-law-enforcement-agencies-in-global-effort-against-money-laundering/
Comisión Nacional Bancaria y de Valores, Resolución que modifica las Disposiciones de carácter general aplicables a las instituciones de crédito, Diario Oficial de la Federación, 1 July 2026. https://dof.gob.mx/nota_detalle.php?codigo=5792307&fecha=01%2F07%2F2026
Basham, Ringe y Correa, Resolution amending the General provisions applicable to credit institutions, July 2026. https://basham.com.mx/en/resolution-amending-the-general-provisions-applicable-to-credit-institutions/
Infobae, Los bancos mexicanos ya pueden identificar con el rostro, 8 July 2026. https://www.infobae.com/mexico/2026/07/08/los-bancos-mexicanos-ya-pueden-identificar-con-el-rostro-para-quien/
ISO/IEC 30107-3:2023, Information technology. Biometric presentation attack detection. Part 3: Testing and reporting. https://www.iso.org/standard/79520.html
