Are You a Mule?

The Fourth episode of Digital Tells: A BioCatch Podcast dives into the phenomenon of online money mules. What is a mule? How does one become a mule? Why do or why should financial institutions care about mule activity? And what can be done to detect mules?

We open with commentary from Julie Conroy, Head of Risk Insights and Advisory at Aite-Novarica Group. Julie discusses the role of money mules inside criminal organizations and introduces some different mule back-stories. Digital Tells’ host Peter Beardmore digs deeper into 5 mule personas. BioCatch’s Raj Dasgupta explains the regulatory and reputational risks that mules represent to financial institutions. And John Paul Blaho, Senior Director of Product Marketing, shares a look at how behavioral biometrics can enhance mule account detection.

Transcript

Peter Beardmore

Are you a mule?

So, the title of this episode is admittedly a bit preposterous. If you’re listening to this podcast, it’s doubtful you're a money mule (or a drug mule, or an actual mule for that matter). But the point I’m attempting to make with this title is that there are different kinds of mules out there ~ ranging from the completely complicit (let’s just call them criminals) to the vulnerable / gullible victims of scam activities that we’ve discussed in previous episodes.

The FBI defines a money mule as <<someone who transfers or moves illegally acquired money on behalf of someone else. Criminals recruit money mules to help launder proceeds derived from online scams and frauds or crimes like human trafficking and drug trafficking.>>

Ok, that makes sense, right… I mean if you’re going to make money scamming people, stealing, selling drugs, human trafficking ~ that money’s got to get someplace where you can eventually retrieve it, right? ~ ideally below the radar of authorities ~ or even better ~ laundered sufficiently so the proceeds can be spent or invested without drawing the attention of law enforcement.

In episode 2 Tom O’Malley walked us through all the specialized functions in a cyber criminal syndicate that the U.S. government prosecuted a few years back. Remember there were malware developers, crypters, spammers, bulletproof hosters, account take over specialists - and then there were these cash-out specialists. These were the people who ran the money mules - they had these networks of accounts where money could be moved quite quickly - beyond the reach of the direct victims, their financial institutions, investigators, and authorities.

On this episode of Digital Tells - A BioCatch Podcast - we’re taking a look at the mules themselves. What is a mule? How does one become a mule? Why do or why should financial institutions care about mule activity? And what can be done to detect mules?

Act 1

Julie Conroy is the head of risk insights and advisory for Aite-Novarica Group. She advises financial institutions, vendors, and merchants about risks relating to fraud and financial crime ~ strategies and tactics to mitigate those risks ~ and what that all means for customer experiences.

I spoke with Julie recently about how financial institutions are struggling with mule accounts, and I asked her specifically about the spectrum of mule personas that I mentioned earlier.

Julie Conroy

You have this organization of functions in financial crime, just as we do on the side of the good. And so you do have some people that are specifically leveraging stolen identities, synthetic identities to open up your accounts with the express purpose of exiting these funds. You also have folks that have been brought over on visas, and they're using their identities for a period of time to open up accounts. And then after those accounts have been used to serve their muling purpose for a while, they go back to their country and there's no consequences, really. Somewhere in the middle, you have people that respond to the make money in your sleep signs. They know ultimately that this isn't quite right, but they are still using their own identities in order to help facilitate the mewling. And then at the other end of things, you have people that truly have been duped by romance scams or other things into opening up these accounts, facilitating the sending of funds and truly don't know that what they're doing is facilitating financial crime.

Peter Beardmore

At BioCatch, we’ve actually developed personas to help us bring some clarity to the spectrum of mules – from the more complicit to less complicit – we’ll share a link in the shownotes.

OK, so let’s briefly discuss these personas:

There’s The Deceiver – who opens an account specifically to perpetrate fraud – The deceiver is obviously the most complicit on the spectrum.

Then there’s The Peddler – who sells their genuine bank account to a criminal

There’s The Accomplice – a willing participant who’s chasing an “easy money” opportunity.

There’s The Chump – who executed a transaction believing the money is clean – this is your prototypical scam victim.

And then finally there’s The Victim – a victim of credential theft, unaware that there’s even been a break-in – The Victim obviously the less complicit persona.

As I started to research these personas, a couple things struck me.

First – with the exception of The Deceiver – the most complicit, and The Victim – the least complicit – the others – The Peddler, The Accomplice, The Chump, – they’re all kind of Sad, right? I mean, these aren’t societies winners… people basking in their own success? ‘living the dream’ so to speak? More likely – they’re desperate – They’ve fallen for easy money or get rich quick schemes – or romance schemes – and they’re either desperate enough to knowingly sell their own identity and accounts – or desperate enough to live with the ambiguity that they may have involved themselves in a criminal enterprise – or their just gullible – I mean, if you’re gullible enough to execute a transaction for a stranger on the internet - believing nothing is wrong – could that possibly be the only time someone has taken advantage or exploited you?

I’m reminded of that Clint Eastwood character in his movie The Mule that came out a few years ago. This very old man, clearly he’d made a slew of bad decisions in his life, and realizing in his final years that he was destitute – his home was foreclosed - and he’s alone / his family had lost faith in him and his x-wife (with plenty of justification) was rubbing his nose in his failures – but with just a glimmer of hope for redemption with his family and friends - he made a naïve decision to earn some money – and then around the time he realizes what he’s doing and who he’s involved with – the draw of all that money takes over – and the bad decisions just spiral.

And then the second thing that struck me, when I thought about the actual online behavior of money mules.

Well, there are elements of the account take over problem we discussed in episode 2 – there’s some of the Account Origination and identity theft issues we discussed in episode 3 – and the scams we explored in episode 4 are pretty thick here too. So as complex as the mules themselves are, so too will be connecting the dots through a continuum of online activity.

What are the digital Tells of mules?

Well, before we get to that, there’s another important question we need to ask.

Act 2

You may recall meeting Raj Dasgupta in an earlier episode. He’s director of fraud strategy at BioCatch. I asked Raj – Do Banks even care about mule accounts? And if so, why?

Raj Dasgupta

The banks do care and they're required to care because of regulation. So if there is money laundering activity going on within their account base, they're responsible for it because by law, they're required to look into suspicious activity and report that activity and take action. If they're not there, then inadvertently playing a role in money laundering and money laundering can be used to fund a variety of fraudulent activity, criminal activity, including terrorism. So there is a very strong responsibility on the part of the banks to make sure that money laundering is not happening within their account base. It's against the law. And if they are not following the law, there can be heavy penalties and fines levied on them. And then, of course, there's a reputational issue. If you are known to not pay attention to mule activity going on and it's all bringing you a lot of negative press, you wouldn't want that. But that's on the softer side and the hard side. If you've not followed the law, there will be real dollar value impact in terms of fines and fees.

Peter Beardmore

So there’s regulation and reputation. And those are good reasons – reasons that have been around for a while. But as Julie Conroy explains – ther...