Article

Money mules a stubborn problem for ATM operators

Money mules are the "last mile" to launder funds gained from illegal activity — and ATMs are often their first stop.

July 28, 2015

by Hagai Schaffer, VP Marketing and Product Management — Cyber Fraud and Risk Management, Bottomline Technologies

In the last six months alone, there have been two alerts by U.S. agencies describing money mule schemes that have resulted in losses of billions of dollars. Last January, the FBI issued a warning about the Business E-mail Compromise, which is responsible for over $200 million in losses over the last two years. U.S. Law Enforcement Agencies released an alert last month for a Latvian money mule network that, in addition to causing losses for financial institutions, is being held responsible for stealing more than $2 million dollars from U.S. citizens.

Money mules are the "last mile" to launder funds gained in illegal activity. Banks are eager to catch money mules not only to prevent money laundering, but also to uncover additional illegal activity conducted by the fraudsters. In the case of the Latvian ring, this includes check forgery, reshipping fraud, card re-encoding and re-embossing, tax refund fraud, wire fraud and online auto auction scams.

Money mule scenario

Based on information from the FBI, there are three typical BEC scenarios used for money laundering: a C-level executive's email is hacked and a request is sent to an employee to transfer funds; an employee's account is tampered with directly to make a fraudulent request; or a trusted supplier places a fake request for a company to pay an invoice to a fraudster's account. In each case the requests are carefully phrased and constructed with the expected amounts in order to avoid detection.

With the Latvian money mule network, a foreigner using a fake driver's license opens a bank account — typically within one week of entering the country. Once the account is opened, the mule brings referrals and opens other DBA or LLC business accounts related to vehicles or large equipment. The day after a wire transfer has been made, the mule makes several transfers, often at different bank branches, but always under the $10,000 per day limit in order to prevent detection from an anti-money laundering system.

Money mule scams

In many cases, individuals are unwittingly recruited to do money laundering for fraudsters. Often, mules lured with promises of high salaries working from home receive fraudulent transactions, then immediately wire them to the fraudster's account — typically in another country — minus a healthy "commission."

Mules are recruited in a number of ways, including the use of fictitious online companies that appear legitimate or spam email advertisements offering employment opportunities as a "Private Financial Receiver," "Money Transfer Agent," "Shipping Manager," or "Cash Flow Manager."

Money is moved into the mule's bank account in various ways: as cash deposits at ATMs, each lower than $10,000 to avoid being flagged by anti-money laundering controls; as transfers from other accounts in the same bank, potentially with the help of an insider; or as funds wired from other banks. Once funds are in the account, the money mule receives instructions on ways to deplete the account without raising suspicion.

Even for money mules who are not aware that a crime is being committed, there are consequences. Their bank accounts are frozen during investigations, and their reputation can be damaged.

Money mule detection

Better knowledge of how money mule schemes are executed has somewhat increased the likelihood of detection. Banks are doing a better job of identifying and shutting down mule accounts. But often it is too late and the damage is done. Large-scale mule herders still have plenty of active mules to process transactions, so the risk is still there — and it's growing.

The key is to be proactive by monitoring all customer activity across wire, online, mobile, ATM, teller and phone channels. Creating a holistic view of all transactions, analyzing the relationship of this data and correlating with employee activities in real time can be the best strategy for preventing money mule schemes.

Hagai Schaffer is vice president of marketing and product managing for cyber fraud and risk management for Portsmouth, New Hampshire-based Bottomline Technologies (www.bottomline.com), a leading provider of cloud-based payment, invoice, and digital banking solutions. In January, Bottomline acquired Israel-based Intellinx, provider of a wide range of anti-fraud, forensics, compliance and enterprise case management solutions on a single platform.