Scott Anchin: Detecting Inbound Bank Fraud and Money Mules

Community banks have built strong fraud-prevention practices around customers who are sending money out. Tellers are trained to spot unusual wires. Verification thresholds catch large transfers. Conversations at the counter give customers groomed by fraudsters the chance to reconsider transactions. This work has long put community banks on the front lines of fraud prevention, but it captures only one side of the problem.

The other side is inbound activity. Investment fraud, romance scams and online extortion schemes all produce money that must land somewhere before it can move on. Sometimes, it lands at community banks.

A fraud network recruits a money mule, someone to move money on their behalf either knowingly or unknowingly, through a job posting, a relationship or coercion. The mule opens an account, presenting documentation that looks routine. The account receives inbound transfers from victims at other institutions, sent at the fraudster’s direction. Within days or hours, the funds move, often to cryptocurrency exchanges or other accounts in a layered chain. By the time the originating bank or law enforcement traces the funds back, the money has typically moved on.

Account opening can move faster at smaller banks than at large institutions, and fraud networks have noticed. Inbound activity runs against a smaller volume base at smaller institutions, which cuts both ways for detection. Much fraud detection technology was built around outbound patterns.

Federal authorities have been documenting the pattern. FinCEN issued an advisory in August 2025 describing how recruited money mules open accounts across multiple institutions to receive and move illicit proceeds. The agency issued additional guidance in September 2025 covering similar schemes targeting individual victims, where mules typically take a percentage fee for moving funds. The Department of Justice’s annual Money Mule Initiative has acted against thousands of mules in each recent cycle.

A few operational priorities deserve attention. Account opening reviews should weigh the indicators federal authorities have flagged, including inconsistent occupation information, addresses that match other recently opened accounts, and documentation that suggests third-party preparation. Transaction monitoring should give inbound activity the same scrutiny as outbound. Incoming wires that are quickly followed by transfers to cryptocurrency exchanges or money services businesses are the clearest indicator of a mule account in use.

Community banks should consider building or expanding an active 314(b) practice, one of the strongest tools available, as information sharing lets institutions coordinate directly when suspicious patterns appear. Filings should name the suspected mule, describe the inbound and outbound pattern and reference the relevant typology source so law enforcement has what it needs to act.

Community banks that build inbound detection into their fraud posture make these schemes harder to run. The attention to individual accounts that defines community banking is exactly what this work requires.