Overview
A money mule is someone who receives or moves money obtained through fraud or other criminal activity on behalf of another person. The person recruiting the money mule may describe the arrangement as a job, a favor, an investment opportunity, a romantic relationship, or a simple way to earn a commission.
Some money mules know that they are helping criminals. Others are deceived and do not understand where the money came from. In either case, moving the funds can lead to financial loss, account restrictions, debt, and serious legal consequences.
Money mule scams may involve bank transfers, payment applications, checks, cash, gift cards, cryptocurrency, or other forms of payment. Related schemes may also ask a person to receive and reship packages.
How It Works
A typical money mule scam follows this pattern:
- The scammer establishes trust or offers an opportunity. The contact may appear to be an employer, online acquaintance, romantic partner, client, or business.
- Money is sent to an account you control. The funds may come from another fraud victim, a compromised account, a stolen payment method, or a fake check.
- You are told to move some or all of the money elsewhere. The scammer may ask you to use a wire transfer, payment application, cryptocurrency, gift cards, cash withdrawal, or another difficult-to-reverse method.
- You may be told to keep a portion as payment. The commission is intended to make the transaction seem like legitimate work.
A bank may make money from a deposited check temporarily available before determining that the check is fraudulent. If you send money elsewhere before the check is returned, you may still be responsible for the loss.
Money mule recruitment is often connected to fake jobs. Titles may include personal assistant, payment processor, financial agent, account manager, mystery shopper, or remote administrative assistant. A legitimate employer should not require you to use your personal account to receive and forward business funds.
Warning Signs
Be cautious when someone asks you to:
- Receive money in your personal bank account, payment application, or cryptocurrency wallet and send it somewhere else.
- Deposit a check and return part of the money or use it to pay a vendor.
- Keep a percentage of transferred funds as a commission.
- Open a new financial account, payment account, cryptocurrency account, or business entity at their direction.
- Buy gift cards, cryptocurrency, cashier's checks, or money orders with funds they provide.
- Withdraw cash and deliver or mail it to another person.
- Receive and reship packages as part of a vague work-from-home job.
- Misstate the purpose of a transaction to a bank, payment service, or other company.
- Act quickly, keep the arrangement secret, or avoid asking questions.
Other warning signs include an employer that does not conduct a meaningful interview, communicates only through personal email or messaging applications, or cannot be verified through an official company website.
How to Protect Yourself
- Do not use a personal account to move money for an employer, client, or online acquaintance. Legitimate organizations use established business accounts and payment processes.
- Verify job offers independently. Contact the employer using information from its official website, not the phone number or link supplied by the recruiter.
- Do not send money because a deposited check appears in your available balance. Available funds do not prove that a check is valid.
- Never share online-banking credentials, debit-card information, PINs, or verification codes. Do not let another person control an account in your name.
- Do not open financial or cryptocurrency accounts for someone else. An account in your name may leave you responsible for activity conducted through it.
- Be cautious when an online relationship becomes financial. Do not receive or transfer money for someone you have not independently verified.
- Stop before moving suspicious funds. Contact your financial institution and explain the situation before taking further action.
What You Should Do at UM
If a job offer, request, or financial arrangement arrives through a UM account or claims to involve a UM employee, department, or program:
- Do not deposit a check, receive funds, or transfer money.
- Do not reply using the contact information in the message. Verify the person or department through an official UM website, the UM directory, or a contact method you already trust.
- If the request arrived by email, use Outlook's Report Message tool and report it as phishing. Delete the message after reporting it. The Report Message tool may remove it automatically.
- Contact the UM IT Helpdesk or UM Information Security Office if the message uses UM branding, impersonates a UM community member, involves a UM account, or asks you to use university information or systems.
If you already received or moved money:
- Stop further transfers and do not attempt to return the money on your own.
- Contact your bank, credit union, payment service, or cryptocurrency platform immediately and explain that the transaction may be connected to fraud.
- Preserve messages, transaction records, checks, receipts, account details, and shipping information.
- Contact the UM Information Security Office if a UM account, device, message, or business process was involved.
- Change your UM password through the normal UM account-management process and contact the UM IT Helpdesk if you entered your password on an unfamiliar site or shared account information.
If the request involved actual UM funds or a UM financial process, also contact the appropriate UM office through a trusted method before any transaction continues.
Additional Questions
For a money mule request involving a UM account, UM device, university data, or UM business process, contact the UM IT Helpdesk and the UM Information Security Office.
For a personal account used to receive or transfer suspicious funds, contact the financial institution or payment service immediately. Follow its instructions and do not move or return the funds unless the institution directs you to do so.
Suspected internet-enabled fraud can be reported to the FBI's Internet Crime Complaint Center.
Additional Resources