A fraudulent payment enters a mule account. The money moves again. Then again. By the fifth account, much of the trail may already have gone cold. 

But what if the money has already been spent? 

On 23 September 2026, the Financial Conduct Authority (FCA) published findings from an investigation involving 22 regulated firms, tracing 140 fraud cases across seven fraud types. 

One finding stands out: card payments were the most common cash-out method in the cases examined. 

Not cryptocurrency or international transfers, but purchases that could resemble ordinary consumer spending. 

The findings raise a question: are institutions identifying suspicious transactions while overlooking how those funds are subsequently spent? 

The Second to Fifth Account: Where the Money Goes 

The FCA found that cash-out activity was concentrated between the second and fifth mule accounts, with the highest concentration at the second. 

The investigation identified several patterns: 

• Card payments: The most common cash-out method, involving low-value purchases and larger retail transactions. 

• International transfers: Higher-value cash-outs included recurring destinations in South Asia, West Africa and the Middle East. 

• Cryptocurrency: Lower transaction volumes, but generally larger cash-out values. 

• Account-to-account movements: Proceeds were frequently divided into smaller payments as they moved through successive accounts. 

Identifying the first receiving account may reveal where criminal proceeds entered the network, but not necessarily how they were dispersed or monetised. 

If cashing out is already occurring at the second account, how much opportunity remains to intervene further down the chain? 

When Money Laundering Looks Like Everyday Spending 

A card payment at a retailer is not inherently suspicious. But the FCA’s findings show why such transactions cannot always be assessed independently of the funds entering an account. 

Consider an account receiving several unrelated payments, followed by multiple retail purchases that rapidly reduce its balance. 

Each purchase may appear legitimate. Viewed alongside incoming funds, rapid account turnover or connections to other mule accounts, the activity may indicate something different. 

The individual transaction may not be unusual. The sequence of activity is what matters. 

This presents a challenge for transaction monitoring. Controls may identify suspicious incoming transfers, but can they also recognise the subsequent spending patterns through which those funds are dispersed? 

The question is whether that relationship can be identified early enough to support intervention, rather than reconstructed after the proceeds have been spent. 

238,396 Suspected Mule Accounts Closed. What Was Actually Disrupted? 

The FCA’s survey of 35 financial institutions found that 238,396 suspected money mule customers were offboarded in 2025, compared with 184,935 in 2023. 

That represents a 28.9% increase over two years, although growth slowed in 2025. The FCA cautioned that higher closure numbers may reflect customer growth and improved detection, rather than necessarily indicating more mule activity. 

Another finding deserves attention: some accounts had been used repeatedly for mule activity, including across different fraud types, before being closed. 

This suggests that certain accounts may form part of established criminal infrastructure rather than isolated incidents. 

Closing an account can prevent further activity through it. But it does not establish whether connected accounts, beneficiaries or cash-out routes have also been identified. 

An account closure demonstrates that action was taken. It does not necessarily show how much of the wider criminal operation was disrupted. 

What Should Mule Detection Actually Be Measuring? 

The FCA’s findings raise four considerations for institutions assessing their existing controls. 

1. Timing of detection 

With cash-out activity concentrated between the second and fifth accounts, identifying suspicious behaviour before funds are spent is critical to effective intervention. 

2. Incoming funds and subsequent spending 

Monitoring individual transactions may overlook patterns that become apparent when suspicious credits, rapid account turnover and card purchases are assessed together. 

3. Repeat account use 

Accounts appearing across different fraud cases may reveal recurring criminal infrastructure that would be missed if incidents were investigated independently. 

4. Extent of disruption 

Beyond account closures, identifying connected accounts, beneficiaries and cash-out routes can provide a clearer picture of the criminal activity involved. 

The FCA also found differences in exposure across firm types. Retail banks handled higher transaction volumes, while other institutions experienced lower volumes but higher-value activity. 

These findings provide a basis for institutions to assess whether their monitoring reflects their particular exposure, rather than relying on transaction alerts or account closures alone. 

The analysis covers a defined sample of firms and cases, not all UK mule activity. 

Are We Following the Account or the Money? 

The FCA’s findings expose a distinction between identifying suspicious accounts and understanding how criminal proceeds are ultimately used. 

A mule account may be detected and closed. But if the proceeds have already moved through several accounts and been converted into ordinary-looking purchases, the wider operation may remain only partially understood. 

If a mule account is closed after the money has been spent, what has been prevented, and what has only been discovered? 

The challenge extends beyond the UK as criminal proceeds move between banks, payment institutions and digital asset services. 

Ultimately, the findings raise a question about how institutions measure the effectiveness of mule detection: by the suspicious activity identified, or by the criminal activity successfully disrupted? 

Continue the Conversation in London 

Money mule activity is among the challenges being explored at the 3rd Annual Fraud & Scams Leaders Summit UK, on 22 October 2026 at The Tower Hotel, London. 

The session ‘Beyond Transactions: The Human Factors Behind Money Mule Activity’, featuring Jamie Wolff, will explore the human factors behind mule activity, complementing the transaction patterns and criminal infrastructure highlighted by the FCA. 

Join senior fraud and financial crime professionals to explore the challenges shaping fraud prevention, detection and disruption. 

Explore the agenda and register for the summit⁠! 

Use invite code VIP-A* to claim your complimentary pass. We look forward to seeing you in London! 

* Complimentary tickets are only available to employees of financial institutions. Consultants, solution providers and service providers must purchase a ticket.