The Disposable Account: Why Britain's Mule Economy Survives Closure

Money mules are often portrayed as the foot soldiers of fraud: students, job seekers or financially squeezed individuals who lend their bank accounts for a fee. The description is partly right and strategically incomplete. A mule is not a mastermind, but the account is infrastructure. It receives the proceeds of a scam, a sanctions-linked evasion scheme or an overseas fraud and moves them on before the victim or the bank can react. In 2026, the UK's response still overweights the closure of the account and underweights the intelligence that closure could generate.

The mule as infrastructure

UK Finance and Cifas-style data have long shown that money muling is not a fringe activity. It is a service economy. Recruiters use social media, messaging apps and word of mouth. Some mules are knowing participants; others are victims of coercion or deception. Some accounts are opened specifically for the purpose; others are existing student or current accounts that are rented out. The common thread is not the person but the behaviour: credits arrive from multiple sources, are consolidated quickly and are paid out to beneficiaries who have no obvious connection to the account holder.

The proceeds can come from authorised push payment fraud, romance scams, investment fraud or overseas schemes. They can also include funds linked to sanctions evasion, where accounts are used to receive and disburse money on behalf of designated persons or circumvention networks. In those cases, the mule account is a layer of separation between the sanctioned interest and the banking system.

What the data can and cannot tell you

Cifas and UK Finance data are useful because they describe patterns rather than individual villains. They point to account age, inbound payment velocity, beneficiary reuse, device sharing and the speed with which funds leave. They also show how often mule accounts are closed only to be replaced. A customer who is exited by one bank can often open an account elsewhere, particularly if the closure is recorded as a commercial decision rather than a fraud marker.

The detection lesson is that static customer due diligence is not enough. A mule account may have a genuine identity, a plausible address and a normal-looking onboarding file. The anomaly is behavioural. Compliance teams should look for accounts that are dormant and then suddenly active, or that receive many small credits from unrelated senders before a single large outbound payment. They should look at shared devices, shared beneficiaries and repeated payment references. They should ask whether the customer's stated income and occupation are consistent with the flow.

Why closure fails

Closing an account is a control, not a strategy. It removes one node from a network but leaves the recruiter, the beneficiary and the victim unchanged. It can also push the mule towards informal value transfer, cryptoassets or a bank in another jurisdiction. For vulnerable customers, closure without a safeguarding referral can worsen financial exclusion without reducing harm. For law enforcement, a closed account with no intelligence referral is a missed opportunity.

A more proportionate response is intelligence-led and graduated. That means triaging alerts, investigating the network rather than only the account, filing suspicious activity reports where the threshold is met, and sharing information through Cifas and other lawful gateways. Where there is a sanctions nexus, the institution should consider its reporting obligations to the Office of Financial Sanctions Implementation and the National Crime Agency. Where the customer appears to be a victim, the response should include safeguarding and, where appropriate, a protective registration rather than a purely punitive exit.

A playbook for 2026

The UK's fraud reimbursement rules have changed the economics of APP fraud, but they have not removed the mule account. Banks now have stronger incentives to detect incoming fraud before it is paid out, yet the mule economy adapts. A 2026 playbook should include four elements.

First, network analytics. Single-account monitoring will always lag behind a recruiter who can open ten accounts. Shared device, beneficiary and address data can reveal clusters.

Second, proportionate restrictions. Closing an account immediately may be right in some cases, but a graduated approach can preserve evidence and avoid tipping off a network.

Third, consistent reporting. A closure without a Cifas entry or a suspicious activity report is a data loss. Institutions should record why they exited and what they shared.

Fourth, customer vulnerability. Not every mule is a criminal. Some are coerced, some are young, some are in debt. A response that ignores vulnerability may be lawful but ineffective.

Trace follows the money through UK finance. The mule account is where the trail often becomes a crowd: many senders, many recipients, one disposable account. Britain's fraud economy runs on those accounts. Closing them one by one will not stop it. Understanding them as a network might.