FORTERIS.Risk & Compliance Group
Answers › Red flags and typologies

What are the red flags that a customer is acting as a money mule?

Checked against the cited primary sources: October 2026

Look for customers who move money on behalf of someone else: pass-through activity, or a new account opened for an unexplained job or "business". No single indicator proves a customer is a mule.

What the guidance says: • A money mule is a person who transfers illegally acquired money on behalf of or at the direction of another. Mules may be unwitting, witting or complicit (FIN-2020-A003). • In work-from-home schemes, the target is told to move funds through accounts or to set up a new account in their own name for the "business", and keeps a percentage of the funds transferred. Other recruitment examples are good-Samaritan and romance schemes (FIN-2020-A003). • General red flags written for banks and examiners include many small incoming transfers or deposits that are almost immediately wired to another city or country in a manner inconsistent with the customer's business or history; funds transfers sent or received from the same person to or from different accounts; and large deposits and withdrawals shortly after opening, followed by closure or dormancy (FFIEC BSA/AML Examination Manual, Appendix F). These are not mule-specific, and a red flag alone is not evidence of criminal activity but may warrant closer scrutiny.

What we would look at: • Compare the activity with the customer's historical activity and with prevailing business practices, and note whether several indicators appear together (FIN-2020-A003). • Make additional inquiries where appropriate, for example how the customer came to be moving the funds.

When it becomes a SAR question: If you file on activity tied to this advisory, FinCEN requests the key term "COVID19 MM FIN-2020-A003" in SAR field 2 and the narrative, and SAR field 34(z) (Fraud - other), naming the type of fraud, such as money mule scheme (FIN-2020-A003).

For the advisory's own list of money mule indicators, check the full text of FIN-2020-A003.

Sources

  1. FinCEN FIN-2020-A003: https://www.fincen.gov/sites/default/files/advisory/2020-07-07/Advisory_%20Imposter_and_Money_Mule_COVID_19_508_FINAL.pdf
  2. FFIEC BSA/AML Examination Manual, Appendix F (red flags): https://bsaaml.ffiec.gov/manual/Appendices/07

This answer is general information, not legal advice. Forteris is not a law firm.

Have a question this doesn't cover?

The Forteris Compliance Assistant answers your team's BSA/AML questions in Slack, from the same checked library, with every answer reviewed by Forteris before it is posted. Free for 14 days or 10 questions.

General information, not legal advice. Checked against the cited primary sources in October 2026.