Mule accounts have moved from a cybercrime problem to a lending problem. The same accounts that receive and pass on the proceeds of digital fraud are now used to inflate borrower turnover, receive loan disbursals that vanish within hours, and route funds through layers that make recovery almost impossible.
Regulators have noticed. RBI’s innovation arm built MuleHunter.AI specifically to detect these accounts, and the government has pushed banks to use AI and network analytics to find mule networks. For lenders, the question is no longer whether mule accounts touch their portfolio, but whether their underwriting can recognise one when it appears in a loan file.
What a Mule Account Is
A mule account is a bank account used to receive and move money on behalf of someone else, usually to disguise the origin of illicit funds. The account holder, the money mule, may be complicit, paid a small fee for lending the account, or entirely unaware that their credentials are being used.
Mules are the layering stage of modern fraud. Money from a phishing scam or fake investment scheme lands in one account, is split and forwarded to several others within minutes, and is finally withdrawn as cash or moved offshore. Each hop makes tracing and clawback harder.
Why Mule Accounts Are a Lending Risk
Most discussion of mule accounts focuses on deposit-taking banks. Lenders face the problem from three directions.
The borrower’s own account is a mule. A statement full of rapid pass-through credits looks like a business with healthy turnover. The inflows are real, but they are not the borrower’s income.
Disbursals land in mule accounts. Organised loan fraud rings apply with synthetic or borrowed identities and route disbursements to accounts they control. The funds leave within hours; the EMI never arrives. This overlaps closely with synthetic identity fraud.
Mule inflows inflate eligibility. Turnover-based and ABB-based programmes reward high credits and balances. Mule activity can push an applicant into a loan size their real business cannot support.
In each case the lender’s loss is not a credit loss in the usual sense. It is fraud, which carries reporting obligations and reputational cost alongside the write-off.
The Regulatory Response in India
The Reserve Bank Innovation Hub developed MuleHunter.AI, a machine learning model that classifies mule accounts from transaction and account data. It is designed to replace static rule-based systems, which RBIH notes produce high false-positive rates and miss evolving patterns.
Adoption has moved quickly. In mid-2025, an RBI official said MuleHunter was live at six banks, with more joining, and that it produced far fewer false positives than existing tools. Industry reports in September 2026 put adoption at 31 banks.
The government has also said banks have been advised to deploy real-time transaction monitoring and AI/ML tools, including network analytics, to identify mule networks. It also noted that the Indian Digital Payment Intelligence Corporation was incorporated in October 2025 to detect and prevent digital payment fraud.
Most of this infrastructure sits with banks. NBFCs and fintech lenders do not operate the accounts, so they cannot see mule behaviour directly. They see it through the bank statements borrowers submit, which makes statement analysis their primary line of defence.
Bank Statement Patterns That Indicate a Mule Account
No single signal proves an account is a mule. Combinations of the following should trigger review.
Pass-through velocity
Credits are followed by debits of similar value within minutes or hours. The end-of-day balance stays close to zero despite high daily throughput. A genuine business retains some float between collections and payments.
Many small credits from unrelated individuals
Dozens of UPI or IMPS credits from personal accounts, often in similar amounts, with no recognisable trade pattern. Legitimate merchant collections usually come through payment aggregators or show repeat customers.
Fan-in, fan-out structure
Many sources pay in, and funds are forwarded to a small set of beneficiaries. Counterparty analysis exposes this shape quickly.
Sudden activation
A dormant or new account moves from minimal activity to high volumes within weeks, often shortly before a loan application.
Inflow and outflow narration mismatch
Credits described as business receipts, debits to individuals or wallets. Or narrations that change pattern abruptly, suggesting a different person is now operating the account.
Cash withdrawal after large credits
Large inward transfers followed quickly by ATM or cash withdrawals across locations. This is the cash-out stage.
Geographic dispersion
Credits from counterparties spread across many states with no business logic, particularly when the applicant describes a local trade.
Separating Mule Behaviour From Legitimate High-Volume Accounts
The hard part is not spotting velocity. It is avoiding false positives on borrowers whose legitimate businesses look similar.
Pattern Mule-like reading Legitimate explanation to test
Many small UPI credits Scam proceeds from victims Kirana, pharmacy or food vendor collections
Near-zero closing balances Pass-through layering Sweep to a linked current or overdraft account
Rapid outward transfers Forwarding to next layer Supplier payments on cash-and-carry terms
Credits from many states Victims spread nationally E-commerce seller receiving marketplace payouts
The test is consistency. A kirana store shows credits clustered in trading hours, supplier payments to known distributors, and GST filings roughly in line with collections. A mule account shows credits with no matching business costs, outflows to unrelated individuals, and no tax footprint. UPI transaction analysis combined with GST data resolves most borderline cases.
Building Mule Checks Into Underwriting
A practical approach for NBFCs and fintech lenders:
Screen every statement for velocity and retention. Compute the ratio of average daily balance to average daily credits. Very low retention with high throughput should route the file to manual review.
Map counterparties. Identify the top inflow sources and outflow beneficiaries by value and frequency. Fan-in, fan-out structures are the strongest single indicator.
Check account age and activation. Flag accounts that went from dormant to active in the 90 days before application.
Verify the disbursal account. Confirm that the account receiving the loan belongs to the borrower and shows ordinary behaviour, not only the account used for eligibility.
Cross-check with GST and bureau data. A high-turnover account with no GST registration and a thin bureau file is a strong combined signal.
Validate the document itself. Mule operators often edit statements to hide outflows. Tampering checks at intake, before analysis, stop edited documents from entering the pipeline.
FinEye’s Pre-Analysis and Data Parsing blocks incomplete or tampered statements before analysis begins. The Bank Statement Analyser then maps counterparties, measures balance retention and flags circular and pass-through flows, so mule patterns surface as part of standard underwriting rather than a separate fraud review.
Key Takeaways
A mule account receives and forwards money for someone else, usually to layer fraud proceeds.
For lenders, mule accounts inflate turnover, receive fraudulent disbursals and distort ABB-based eligibility.
A growing number of banks now uses RBIH’s MuleHunter.AI; NBFCs must rely on statement analysis.
The strongest signals are pass-through velocity, near-zero retention, fan-in fan-out structures, and sudden activation.
Legitimate cash-heavy businesses can look similar; GST, supplier payments and trading-hour patterns separate them.
Check the disbursal account as carefully as the eligibility account.
Conclusion
Mule accounts sit at the intersection of fraud and credit, which is exactly why they slip through. Fraud teams look for identity mismatches; credit teams look for income. A mule account offers a real identity and real inflows, and fails only when someone asks where the money came from and where it went.
Lenders that answer those two questions for every statement, before sanction and again before disbursal, close one of the most active fraud channels in Indian lending today.
To see how FinEye flags pass-through and fan-in, fan-out patterns in bank statements, request a demo.
Top comments (0)