Why closing money mule accounts is not enough

Dr Nicola Harding, Financial Crime Lab

On 23 September 2026, the Financial Conduct Authority published the findings of its multi-firm review of money mule activity. The headline figure travelled quickly: the 35 firms surveyed by the FCA offboarded 238,396 suspected money mules in 2025, up from 184,935 in 2023 and 233,269 in 2024, with 656,600 customers offboarded across the three years (FCA, 2026a). It is tempting to read that number as evidence that the system is working. In this piece I want to argue that it tells us far more about institutional activity than about criminal disruption, and that the most important findings in the review sit quietly beneath the headline.

An activity measure, not an outcome measure

The FCA is careful on this point, and it is worth being equally careful. The regulator notes that rising closures among e-money institutions, payment institutions and challenger banks may reflect customer growth alongside improved detection, rather than mules forming a larger share of those firms' business (FCA, 2026a). It also reports that offboarding rose across the period but slowed in the final year. A count of closed accounts is therefore a measure of what firms did. It is not, on its own, a measure of what criminals were prevented from doing.

This distinction matters because the review itself contains evidence that closure frequently arrives after the harm. Some accounts had been used multiple times, and across different fraud types, before firms shut them down, which the FCA interprets as "an established criminal infrastructure rather than isolated or opportunistic misuse" (FCA, 2026a). An account that is closed after its third use has been disrupted, but only after it has done its work three times.

Reading the mule as a scene, not an actor

Criminology offers a useful way to see why. Cornish's (1994) procedural analysis of offending proposed that crimes can be understood as scripts, ordered sequences of scenes and actions, and that mapping the full sequence reveals a wider range of intervention points than a focus on the offender alone (Cornish, 1994). Viewed through this lens, the money mule is less a person than a scene in the laundering script: the point at which victim funds are received, divided and dispersed.

The FCA's public/private cell, a working group of 22 firms that traced the highest-value payments in 140 cases across seven fraud types, gives us an unusually clear picture of that scene (FCA, 2026a). Funds were usually cashed out between the second and fifth mule account, with the highest concentration at the second. By that stage, payments had been broken into smaller, less conspicuous amounts. Card payments were the most common cash-out method, often through many low-value transactions or larger payments to local retailers that resemble ordinary consumer spending.

For prevention, this is the most consequential finding in the review. It locates a pinch point in the script. If the second account is where funds are most likely to leave the system, then detection that concentrates on the first receiving account, or on closing accounts once a pattern has matured, is aimed at the wrong scene. The FCA's own expectation that firms look "beyond the initial receiving account", to linked accounts, payment characteristics and wider transaction context, is in effect a call for script-level rather than account-level thinking (FCA, 2026a). Closing an account removes a prop from the scene. It does not rewrite the script, and a network with recruiters in place can replace the prop.

Who becomes a mule, and why the profile is shifting

Public messaging about money mules has long centred on young people, and with reason. Leukfeldt and Jansen's (2015) analysis of Dutch cybercriminal networks found that potential mules, often young, were recruited through existing social ties at schools, sports clubs and on street corners (Leukfeldt and Jansen, 2015). More recent work by Bekkers and colleagues shows how that recruitment has moved onto social media, where Instagram accounts advertise quick money in exchange for bank details (Bekkers and Leukfeldt, 2023). In a survey of more than 3,000 Dutch 16 to 25 year olds, almost ten per cent had been approached by recruiters, awareness of the consequences was low, and some respondents considered it normal to be approached or acceptable for others to use their accounts (Bekkers et al., 2023).

The FCA data complicate the youth-centred picture without overturning it. Customers aged 18 to 39 still accounted for 71.9% of suspected mules offboarded in 2025. Yet the sharpest growth was among customers aged 40 to 49, where offboarding rose by 79.8% compared with 2023 and by 44.7% compared with 2024 (FCA, 2026a; FCA, 2026b). The review does not explain this shift, and it would be premature to claim that it does. It does, however, raise a research question that prevention policy cannot afford to ignore: what is happening in the lives of people in mid-life that makes them recruitable?

My own work offers one way into that question. In our study of the liminality of fraud, my colleagues and I argued that fraudsters seek out liminal spaces, transitional moments in which people are more open to persuasion, and that within those spaces individuals can be transformed into victims or potential "co-offenders" (Harding et al., 2025). Job loss, debt, separation and the search for flexible work are all transitions of this kind. Recruitment that presents muling as remote work, a payment processing role or a favour for a contact is designed to meet people in exactly those moments. Whether the rise among 40 to 49 year olds reflects such transitions is an empirical question, but it is the right question to ask.

Sykes and Matza's (1957) techniques of neutralisation help explain how people cross the line once approached. Their framework describes how individuals who broadly accept conventional norms can suspend them through justifications such as denial of responsibility or denial of injury (Sykes and Matza, 1957). Recruitment scripts that frame the activity as legal, low risk or victimless supply those justifications ready-made, which is consistent with the low risk awareness found among young people in the Dutch survey (Bekkers et al., 2023).

The sanction that happens without a court

Offboarding is often discussed as a control. For the individual it is also a sanction. A marker on the Cifas National Fraud Database can remain for up to six years and can restrict access to credit and, in practice, to banking, housing and some forms of employment (Which?, 2026; Shelter, 2026). These consequences can follow without any court proceedings (BBC News, 2026). In one 2022 final decision, an ombudsman at the Financial Ombudsman Service set out that a marker should not be registered against someone who was unwitting, and that a firm must have sufficient evidence of deliberate complicity (Financial Ombudsman Service, 2022).

The FCA's data show the gap between these two thresholds. Firms close accounts on suspicion, while filing to the National Fraud Database requires a higher evidential standard, and the regulator explicitly does not expect the two figures to match (FCA, 2026a). The proportion of offboarded customers filed to the database fell from 17.4% in 2024 to 15.3% in 2025. The FCA cautions that this is not a like-for-like comparison: in January 2025 Cifas introduced a dedicated money mule filing category, with revised criteria and guidance, in place of the broader 'misuse of facility' category used in earlier years (FCA, 2026a). Part of the fall may therefore be an artefact of recording rather than a change in behaviour. Beyond that, the figure can be read in two ways: as appropriate restraint in labelling people who may have been exploited, or as a loss of shared intelligence about those who were complicit. The review cannot tell us which, and that uncertainty is itself a finding. A system that cannot distinguish the exploited from the complicit will either over-punish the first group or under-disrupt the second.

What prevention would look like

If account closure is an activity measure, what should replace it as the measure of success? The review points towards several answers. The first is time: how early in the script, and how close to the second account, firms intervene. The second is reuse: how many times an account is used before it is closed, and whether that number is falling. The third is intelligence: whether firms are using the voluntary information-sharing provisions of the Economic Crime and Corporate Transparency Act 2023 to identify linked accounts and recurring cash-out routes across institutions, which the FCA identifies as an opportunity not yet fully taken (FCA, 2026a).

The fourth answer lies outside the financial sector altogether. Recruitment is the first scene in the mule script, and it increasingly takes place on social media platforms rather than in bank branches (Bekkers and Leukfeldt, 2023). Situational crime prevention at the recruitment stage, including the removal of recruitment advertising and friction for accounts that promote "easy money" offers, would intervene before any account is opened. This is where the conversation about money mules meets the conversation about platform responsibility, which I will return to later in this series.

The FCA has done the field a service by publishing operational data of this quality. The task now is to read it as criminologists would: not as a tally of accounts closed, but as a map of a criminal process with identifiable scenes, actors and pinch points. Closing the account is not closing the case. The case is closed when the script stops working.

References

Bekkers, L. M. J. and Leukfeldt, E. R. (2023) 'Recruiting money mules on Instagram: A qualitative examination of the online involvement mechanisms of cybercrime', Deviant Behavior, 44(4), pp. 603-619. Available at: https://doi.org/10.1080/01639625.2022.2073298

Bekkers, L., Van Houten, Y., Spithoven, R. and Leukfeldt, E. R. (2023) 'Money mules and cybercrime involvement mechanisms: Exploring the experiences and perceptions of young people in the Netherlands', Deviant Behavior, 44(9), pp. 1368-1385. Available at: https://doi.org/10.1080/01639625.2023.2196365

BBC News (2026) 'Easy money? No, this scam can wreck your credit, and your life'. Available at: https://www.bbc.co.uk/news/articles/cpwnd2v1zrvo

Cornish, D. B. (1994) 'The procedural analysis of offending and its relevance for situational prevention', in Clarke, R. V. (ed.) Crime Prevention Studies, Volume 3. Monsey, NY: Criminal Justice Press, pp. 151-196. Available at: https://popcenter.asu.edu/sites/g/files/litvpz3631/files/library/CrimePrevention/Volume_03/06_cornish.pdf

Financial Conduct Authority (2026a) Money mules: mule activity and cashing out findings. Multi-firm review, 23 September. Available at: https://www.fca.org.uk/publications/multi-firm-reviews/money-mules-activity-cashing-out-findings

Financial Conduct Authority (2026b) Firms crack down on money mules but need to do more. Press release, 23 September. Available at: https://www.fca.org.uk/news/press-releases/firms-crack-down-money-mules-need-do-more

Financial Ombudsman Service (2022) Final decision, reference DRN-3535484. Available at: https://www.financial-ombudsman.org.uk/decision/DRN-3535484.pdf

Harding, N., Cooper, E., Sales, T., McDonald, A. and Kingston, S. (2025) 'The liminality of fraud: Reimagining fraud theory to inform financial crime prevention', British Journal of Criminology, 65(3), pp. 618-638. Available at: https://doi.org/10.1093/bjc/azae069

Leukfeldt, R. and Jansen, J. (2015) 'Cyber criminal networks and money mules: An analysis of low-tech and high-tech fraud attacks in the Netherlands', International Journal of Cyber Criminology, 9(2), pp. 173-184. Available at: https://www.cybercrimejournal.com/pdf/Leukfeldt&Jansen2015vol9issue2.pdf

Shelter (2026) Basic bank account applications. Shelter Legal England. Available at: https://england.shelter.org.uk/professional_resources/legal/debt/banking_and_financial_services/basic_bank_account_applications

Sykes, G. M. and Matza, D. (1957) 'Techniques of neutralization: A theory of delinquency', American Sociological Review, 22(6), pp. 664-670. Available at: https://doi.org/10.2307/2089195

Which? (2026) 5 signs your loved one is a money mule. Available at: https://www.which.co.uk/news/article/5-signs-your-loved-one-is-a-money-mule-aaOHl3O0qyin