Indians lost about ₹19,813 crore to cyber fraud in 2025, according to I4C data, and mule accounts carried much of it (Source: IANS). In one 2026 crackdown alone, Gujarat Police acted against 913 accounts tied to ₹2,289 crore in fraud (Source: Drishti IAS).
This is the scale at which fraud is committed, and most sources are identified and caught only after the money has moved.
The question is how banks can identify the traces of such mule accounts early. This is exactly what we are going to cover in this blog:
How Indian payment instruments end up on illegal platforms
Why offshore fund transfers make this a serious risk
Where in-bank mule account monitoring falls short
How mFilterIt catches mule networks at the source
Restricted by Rule, Still in Use: Indian Payment Instruments on Illegal Platforms
Indian payment instruments cannot be used for certain restricted activities. Under FEMA, residents cannot send money abroad for lotteries, sweepstakes or forex trading on overseas platforms (Source: RBI). The RBI also maintains an alert list of unauthorized forex platforms, and the 2025 Online Gaming Act bars banks from processing payments for online money games.
Illegal merchants work around this. Many declare a legitimate category while onboarding with a payment gateway, then switch to restricted ones, often at odd hours. A one-time onboarding check cannot catch this.
Others display Indian UPI IDs, VPAs, QR codes, and bank account numbers directly on their websites, apps, and Telegram channels to:
Collect deposits for betting, gambling, gaming and forex
Run offers like sign-up bonuses and cashback
Pay commissions to agents and promoters
Route funds through rented accounts, turning them into mules
Banks have no visibility into any of this. Inside the bank, it is just another account receiving UPI credits. In 2025–26 alone, mFilterIt has detected more than 20 million mule accounts linked to illegal betting, gambling, gaming, and forex platforms.
How Transaction Laundering Runs Through Mule Accounts: Money That Leaves The Country
The end goal of transaction laundering is to move the money offshore.
In September 2026, the Enforcement Directorate said one offshore betting network had allegedly routed about ₹2,500 crore through sham overseas investments, bogus service imports, hawala and crypto (Source: Free Press Journal). Once funds cross the border, recovery is rarely possible, and the bank’s accounts have already served as the conduit.
Where In-Bank Mule Account Monitoring Falls Short
Transaction monitoring does exactly what it is supposed to do: flag unusual activity in accounts the bank already holds. The challenge, however, is timing. A mule account goes through several stages before its first suspicious credit, and the bank is involved in almost none of them.
The mule lifecycle begins outside the bank
Recruitment: Fraud networks advertise openly on Instagram, Facebook, X, WhatsApp and Telegram, offering commissions to anyone willing to sell or “rent” a savings or current account.
Disguised offers: Pitches are framed as part-time jobs, work-from-home roles or investment schemes, often aimed at students, young people and low-income households. Recruiters ask for account access, net banking credentials, debit cards, and even the linked SIM card.
Handover and seasoning: The account changes hands and is often “warmed up” with small, ordinary-looking transactions so that it passes routine checks.
Activation: Only now does fraud money arrive, and only now does the bank’s monitoring have anything to flag.
Catching Mules at the Source with mFilterIt
mFilterIt approaches mule account detection from the outside in. Rather than waiting for funds to hit an account, it finds the payment instruments that illegal platforms hand out to depositors and traces them back to the issuing bank.
Identification and aggregation: Suspected merchant websites, apps, hidden URLs and shadow sites are found and categorized, from betting and gambling to forex trading, gaming, and adult content.
Registration: It registers on these platforms as a user to see the real deposit journey.
Web crawling: Automated bots crawl the platforms at configurable intervals and capture every UPI ID, VPA, QR code and bank detail shown to users.
Reporting: Each payment instrument is mapped to its issuing bank and shared with that bank.
Investigation: The bank links the instrument to the account holder, reviews transaction history and traces onward transfers, including overseas flows.
Action: Confirmed mule accounts can be blocked, reported and added to internal watchlists.
The Role of OSINT in Mule Account Detection
This approach runs on open-source intelligence (OSINT), drawn from the web, deep and dark web, social media, and forums.
It offers three advantages for mule accounts detection:
It works earlier: Payment details appear online before suspicious money reaches the bank.
It produces evidence: Each finding is captured with its source, giving banks grounds to act.
It adds context: Findings are cross-checked against mFilterIt’s and banks' mule repository and negative databases.
What This Looks Like in Practice
In one case, an illegal betting site’s deposit page displayed a personal UPI ID for users to pay into. Our automated bots captured the ID during routine crawling and shared it with the issuing bank. On investigation, the bank confirmed the account was being used for transaction laundering. The same pattern has repeated across multiple banks and payment providers.
Going Deeper: Mule L2 Analysis
Blocking one exposed account stops one collection point, but mule networks rarely run on a single account. L2 analysis goes further.
L1, direct identifier screening: mFilterIt detects a QR code on a website, resolves its mobile number and UPI ID, and checks them against its mule database.
L2, network expansion: The matched mobile number becomes the anchor for mapping linked mobile numbers and bank accounts, enriched with risk intelligence.
By surfacing shared devices, shared KYC, common addresses and common beneficiaries, L2 turns a single flagged account into a connected network view, with focused leads for investigators.
See Mules Before the Money Moves
Mule networks depend on staying invisible inside the bank for as long as possible. But to collect money, they have to show their accounts somewhere. That is the moment banks can catch them.
Find out which of your bank’s payment instruments are live on illegal platforms.
Book a free mule detection scan with mFilterIt.
Frequently Asked Questions
1. How to detect money mule accounts in banking transactions?
Banks detect mule accounts by combining transaction monitoring with account behaviour analysis, flagging pass-through activity, sudden volume spikes, and profile mismatches. Adding external intelligence, such as UPI IDs exposed on illegal betting platforms, helps banks act before funds move.
2. What are the signs of a money mule account in banking?
Common signs include dormant or new accounts with sudden high volumes, funds leaving almost as soon as they arrive, many small credits from unrelated payers, activity that doesn’t match the customer’s profile, and frequent device or SIM changes.
3. What is a money mule account and how do banks detect it?
A money mule account receives and moves illicit funds, with or without the holder’s knowledge. Banks detect such accounts through transaction monitoring, KYC checks and shared suspect registries, increasingly supported by external signals like recruitment ads and fake job offers.
4. How does AI detect money mule activity in banking transactions?
AI models learn patterns across millions of transactions to spot mule behaviour that fixed rules miss, such as structured small credits, rapid layering and linked accounts. This can reduce false positives and help investigators prioritize the highest-risk accounts faster.
5. How can transaction monitoring help detect money mule networks?
Transaction monitoring tracks how funds move between accounts, revealing clusters that share devices, receive from common payers or pass money on rapidly. Mapping these links exposes the wider network, and external intelligence helps banks catch it earlier.