Money-mule profiling can help solve, prevent crimes

After a long search, a 57-year-old man from Yokohama, Japan, was thrilled to finally have a new job. Unemployed since 2012, he had sent out more than 400 résumés before receiving his dream position: a work-from-home job with a generous salary. His first assignment was to complete a simple written survey. However, his second assignment was much different. He was asked to transfer money to Russia via Western Union. Although he found the request odd, he didn't question it because he didn't want to lose his job. Three wire transfers later, the police came to his house and told him he was a "money mule." The funds he'd transferred had been stolen from various local bank accounts. (See Cyber Wars/Job-seeker turned into 'money mule,' by Yomiuri Shimbun, AsiaOne News Network, Jan. 3, 2014.)

Stories like these are becoming more common around the world everyday, and so it's critical for fraud examiners to recognize the profile of known money mules to aid their investigations.

What's a money mule?

A money mule is a person who's used in a criminal operation to transport and launder stolen money, according to the United States Computer Emergency Readiness Team (US-CERT). The term is a derivation of "drug mule," which is a person who transports illegal substances over a border.

Victims of money mule scams include individuals, businesses and financial institutions.

Criminals, often who have gained illegal access to business or consumer bank accounts, tend to recruit money mules via phishing emails. According to the Federal Deposit Insurance Corporation (FDIC), phishing is the act of "fishing for confidential information" during a scam in which a criminal obtains a victim's personal or financial information via fraudulent means.

The FDIC gives typical steps in the phishing process. A consumer will receive an email supposedly from a trusted source (i.e., their bank, the government) requesting personally identifiable information (PII); the email will include a link at which the consumer is asked to provide that PII. But when consumers click the links in the emails, they're instead taken to fraudulent websites where they provide their PII, which cybercriminals steal.

Fraudsters also hire money mules via work-from-home scam ads (such as the victim in the opening case) and task them with money laundering, which they disguise as job duties.

Money mules' roles

Money mules are a key element in cybercrime because they serve as conduits between victim and criminal members of illegal operations. According to security expert and journalist Brian Krebs, mules are viewed as an "integral," "vital buffer" to overall operations because they prevent law enforcement from directly linking the fraudsters to the crimes. (See 'Money Mules' Help Haul Cyber Criminals' Loot, The Washington Post, Jan. 25, 2008.)

This cybercrime scenario from the FBI illustrates the specific process. Coders create malicious software that criminal "malware exploiters" purchase and use to steal login credentials from unsuspecting victims. Then, these fraudsters pay money to mules — often as a skimmed percentage — to transfer stolen funds.

The mules serve as the links between the victim banks and the fraudsters who initiate the frauds. They receive the illegally obtained money from the victims and launder or integrate it legitimately back into financial systems. (See the FBI's "Cyber Theft Ring" PDF.)

Money mule recruiters

Why don't the mules realize the business they conduct is illegal? Money-mule recruiters exercise great care to ensure their businesses appear professional and legitimate.

Recruiters take their cybercriminal roles seriously. Steven R. Chabinsky, former deputy assistant director of the cyber division of the FBI, says cybercrime syndicates "work like 'corporations' with extraordinary logistics." (See Chabinsky's March 23, 2010, address to the GovSec/FOSE Conference.)

Recruiters work to make sure that potential mules perceive their ads for positions as legitimate. According to Chabinsky, the fraudsters will construct professional websites, post their positions on recognized jobseeker sites and sometimes provide money mules with documentation, such as written employment contracts and job descriptions. They'll also carefully word their emails to evade spam filters.

Money-mule recruiters are also careful not to give mules too much information. Their approaches demonstrate they're "becoming smarter about the ways they communicate, scheme, organize and network," Chabinsky says. "To them, money mules are " 'contractors' who don't always know the full picture of the criminal enterprise, but contribute bits and pieces. …"

Money-mule intent

Although money mules might be unaware they've committed crimes, they can still be held liable if they're caught, according to Krebs. For example, the U.S. federal government can freeze money mules' personal bank accounts when they use them to transfer illicit funds. Also, according to U.S. law, the government can then seize personal funds if the mules comingled them with illicit funds. A mule's demonstrated intent might also determine his or her punishment.

(See Asset Forfeiture, November 2007, U.S. Department of Justice Executive Office for U.S. Attorneys.)

According to Chabinsky, the FBI identifies three types of money mules, distinguished by their level of intent: 1) "one and done" mule, 2) "career money" mule and 3) "premier" mule. One-and-done mules lack intent, career money mules possess intent and premier mules possess intent plus take deliberate measures to further professionalize their work, such as traveling internationally and seeking advanced knowledge to improve their schemes.

One-and-done mules fall prey to social engineering schemes to send money or become home-based employees. They do it once, realize they were scammed and contact law enforcement. Punishments might be reduced if the mules are forthcoming and cooperate.

The career money mules, of course, habitually perform fraudulent money transfers. Prosecutors assume their intent.

Intent is also clear for premier mules because crime rings recruit them to commit specific schemes. These mules typically have an advanced understanding of bank anti-money laundering operations and skills in circumventing detection. Crime rings might send these mules to the U.S. on work or students visas and give them detailed instructions to complete their mule activities. These mules might also recruit other mules by posting work-from-home position ads on behalf of the criminal enterprises.

Japan's first confirmed money-mule operation

Money-mule fraud is on the rise in major economies around the world. A case in point is Japan.

In January 2014, Yomiuri Shimbun of AsiaOne News Network, reported Japan's first confirmed money mule operation. An investigation discovered 224 money mules committed 495 acts of fraud between March and December 2013 by transferring illicit funds totaling $2.5 million.

To date, authorities haven't arrested anybody in connection with these crimes. Although the money mules probably violated Japan's Anti-Organized Crime Law, the Japanese government didn't prosecute them, according to Shimbun, because the police were convinced they were victims recruited through online job ads and didn't know they'd committed crimes.

The opening case history in this column tells of one of the money-mule victims in the AsiaOne News Network article. The 57-year-old man from Yokohama found his job for a food-related company on a popular career-networking site.

A "personnel director" outlined the employment conditions and offered him a regular salary, starting at ¥500,000, which would soon increase to ¥700,000 (approximately $5,600) per month. He'd work from home and receive his assignments via email.

Although he thought his job tasks were strange, he didn't believe they were illegal. He made three wire transfers for ¥490,000 each, which was approximately $4,000, before law enforcement stopped him and told him he was engaging in money-mule activity. The police froze his bank accounts, and, of course, the fraudsters haven't remunerated him.

In February 2014, The Asahi Shimbun reported an active police investigation into another case in which mules transferred ¥80 million ($783,000 at the time) to an underground account.

The scheme involved a Chinese organized-crime faction, which stole money from bank accounts, laundered the money through the mules, and then used the money to purchase appliances and sell them abroad. One of the arrested mules, a 20-year-old Chinese man, said he engaged in the crime to simply make money. He deposited much of the stolen funds sent to his account — ¥417,000 of ¥500,000 — into the underground account. (See Police probe money laundering case involving 'mules,' online shopping, by Yuka Yokokawa and Roppei Tsuda, The Asahi Shimbun, Feb. 14, 2014.)

Profiling aids in fraud examinations

Money-mule profiling greatly aids fraud examiners' investigations and discovering the potential for recidivism. Information from both intentional and unwitting money mules might also greatly improve informed prevention and detection.

As shown in the case of the Yokohama man, fraudsters are tricking job seekers into laundering money. These unaware mules might be more willing than mules with criminal intentions to provide information to law information that could lead to the originating criminals.

Fraud examiners can evaluate cases involving international mules to determine if they're involved in isolated incidents, or if these actors are repeat offenders. Once fraud examiners identity recidivists, they can investigate past and future cases to establish possible connections.

Chelsea A. Binns, Ph.D., CFE, is a professor at St. John's University in New York City. Her email address is: binnsc@stjohns.edu.