{"id":987,"date":"2026-06-06T07:04:40","date_gmt":"2026-06-06T06:04:40","guid":{"rendered":"https:\/\/www.befisc.com\/fintechsherlock\/?p=987"},"modified":"2026-08-19T12:42:20","modified_gmt":"2026-08-19T11:42:20","slug":"mule-account-detection-india","status":"publish","type":"post","link":"https:\/\/www.befisc.com\/fintechsherlock\/mule-account-detection-india\/","title":{"rendered":"Mule Account Detection in India: How to Identify Fraudulent Accounts and Stop Account Takeover Fraud"},"content":{"rendered":"\n

The Reserve Bank of India has reported a consistent rise in banking fraud involving mule accounts accounts opened using real or stolen identities for the sole purpose of receiving and forwarding fraudulent funds. In FY2025, Indian authorities blocked over 9.42 lakh SIM cards linked to cyber fraud. Fraudsters often used the devices associated with those SIM cards to operate mule accounts at scale. For banks, NBFCs, payment apps, and wallets, mule accounts pose a compounding risk: they pass standard KYC checks <\/a>but exist solely to launder proceeds of fraud.
Fraudsters create a parallel exposure by seizing existing legitimate accounts through SIM swaps, phishing, or credential stuffing. Together, these two attack vectors account for a significant share of India’s digital banking fraud losses.<\/p>\n\n\n\n

What Is a Mule Account and How Does the Network Operate<\/h2>\n\n\n\n

A mule account is a bank or wallet account used to receive and transfer money obtained through fraud. The fraudster may use an account opened by a knowing participant (a recruited mule who receives payment for allowing account use) or an unknowing victim (someone whose stolen credentials the fraudster uses to open an account without their knowledge or control).<\/p>\n\n\n\n

In India\u2019s organised fraud ecosystem, mule accounts act as nodes in a layering network. Fraudsters transfer stolen funds from cyber frauds, such as vishing calls, OTP scams, and UPI phishing, into mule accounts. They then move the funds through one or two more accounts before cashing them out, often through prepaid cards, cryptocurrency, or merchant accounts. The speed of movement is the key characteristic: funds typically leave a mule account within minutes to hours of receipt, before the victim or the originating bank can initiate a recall.<\/p>\n\n\n\n

The NPCI’s transaction recall mechanism and the RBI’s framework for mule account identification have put pressure on financial institutions to identify and freeze suspected mule accounts more quickly. Still, the detection challenge remains difficult because mule accounts often have identity verification processes<\/a>.<\/p>\n\n\n\n

Mule Account Detection: Signals at Onboarding<\/h2>\n\n\n\n

The onboarding signals most predictive of mule account risk fall into four categories. The first is device and phone number signals.
A device that financial institutions use to onboard multiple accounts in a short period, even across different institutions, is a strong indicator of mule activity. Devices associated with multiple recent account openings represent a high-risk onboarding signal. Recent SIM swaps also indicate elevated risk because fraudsters use them to take over existing accounts and create new accounts with controlled phone numbers.<\/p>\n\n\n\n

The second category is identity signal clustering. A cluster of onboarding attempts using the same Aadhaar number across different name variants, or the same device with different identity documents presented, indicates systematic mule factory activity rather than individual account opening.<\/p>\n\n\n\n

The third is address and location anomalies. An address associated with a high number of previously opened accounts, particularly those that later showed suspicious activity, can indicate a potential fraud risk. A geolocation at onboarding that is inconsistent with the claimed address on the identity document is a secondary indicator.<\/p>\n\n\n\n

The fourth is application velocity. In mule factory operations, batches of digital onboarding workflows<\/a>. A financial institution can detect factory-style mule creation before account activation by monitoring onboarding velocity and identifying clusters of applications with similar device characteristics or address patterns.<\/p>\n\n\n\n

Post-Onboarding Mule Account Detection: Behavioural Signals<\/h2>\n\n\n\n

Because mule accounts often pass onboarding checks, continuous financial monitoring <\/a>for detection. The transaction patterns characteristic of mule accounts are distinctive: immediate and large inbound transactions shortly after account activation (particularly from unusual counterparties), followed immediately by outbound transfers or withdrawals. The account balance approaches zero very rapidly after each inbound transaction.<\/p>\n\n\n\n

The counterparty patterns also matter. Mule accounts typically receive funds from victims they have no prior relationship with, and transfer funds to other accounts in the mule network \u2014 accounts that themselves have unusual transaction patterns. Financial behaviour analysis<\/a> looking at the network of counterparties connected to an account, not just the account’s own transaction pattern is significantly more effective at detecting mule networks than account-level monitoring alone.<\/p>\n\n\n\n

Additional behavioural signals: no use of the account for routine financial activity (bill payments, salary credits, recurring transfers) that characterises genuine accounts; access from devices or IPs inconsistent with the account holder’s claimed profile; and UPI or IMPS transaction patterns that match known mule layering typologies (many equal-value transfers in rapid succession, or transfers timed to avoid banking hours).<\/p>\n\n\n\n

Account Takeover Fraud in India: How It Happens<\/h2>\n\n\n\n

Account takeover (ATO) fraud involves a fraudster gaining control of a legitimate customer’s existing account without the customer’s knowledge or consent. In India, the primary mechanisms are: SIM swap fraud (persuading a telecom operator to issue a new SIM for the victim’s number, giving the fraudster control of OTPs and two-factor authentication); fraud risk assessment <\/a>(using credentials leaked from other data breaches to attempt login at financial platforms where the same credentials were reused); and vishing (calling the victim under a pretext to obtain OTP or security information).<\/p>\n\n\n\n

Once fraudsters take over an account, they typically change the registered mobile number to stop the legitimate owner from receiving alerts, transfer the available balance, and apply for any pre-approved loan or credit facility linked to the account. Pre-approved credit draws where a lender has already approved a credit line available on demand are particularly attractive to account takeover fraudsters because the disbursement can happen within minutes.<\/p>\n\n\n\n

Account Takeover Detection: Device, Session, and Behavioural Signals<\/h2>\n\n\n\n

Account takeover detection requires institutions to monitor signals that indicate an unauthorised user is accessing the account. The most reliable signals are device change a login from a device that has not previously accessed the account, particularly if followed by a contact detail change or a high-value transaction; session behaviour login timing, transaction velocity, and navigation pattern inconsistent with the account holder’s established behaviour profile; and geolocation access from a location inconsistent with the holder’s prior access pattern.<\/p>\n\n\n\n

Device intelligence plays a central role: when fraud network databases show that a device fingerprint has links to previous ATO events across financial institutions, the institution should treat it as a strong risk signal and trigger step-up authentication before allowing sensitive account actions.<\/p>\n\n\n\n


For UPI-based platforms, institutions can strengthen ATO controls by checking whether fraudsters recently swapped the SIM linked to the registered mobile number before processing high-value transactions. The NPCI and individual banks have implemented SIM swap lookups at the payment authorisation layer, but not all platforms have integrated this check.<\/p>\n\n\n\n

RBI and NPCI Guidance on Mule and Takeover Fraud<\/h2>\n\n\n\n

The RBI has issued multiple advisories on mule account risk and the obligations of financial institutions to monitor and report suspected mule activity. The Integrated Ombudsman Scheme requires banks to resolve customer complaints about fraudulent transactions within defined timelines, creating a regulatory incentive to have effective detection and recall mechanisms in place.<\/p>\n\n\n\n

The NPCI operates a transaction fraud monitoring system for UPI that flags high-risk transactions for additional verification. It has also published typology guidance for mule account detection including the rapid account activation to first significant transaction pattern and the equal-value rapid transfer signature of layering operations.<\/p>\n\n\n\n

Financial institutions must embed mule account detection into both the onboarding workflow and post-activation monitoring system to meet regulatory expectations. Institutions that detect mule accounts only after customer complaints rather than through proactive monitoring face both reputational risk and regulatory scrutiny under the cyber fraud response framework the RBI published in 2024.<\/p>\n\n\n\n

Industry Collaboration in Mule Account Detection: Shared Intelligence<\/h2>\n\n\n\n

Individual financial institutions face a structural fraud detection limitation: siloed data. A mule account operator can use the same or slightly modified credentials to open an account at another bank after the first bank flags and closes the account because the second bank cannot access the first bank\u2019s fraud findings. Addressing this structural gap requires industry-level data sharing.<\/p>\n\n\n\n

Several initiatives in India are building the shared intelligence infrastructure required for effective mule account detection at scale. The NPCI’s transaction fraud monitoring system shares suspicious transaction patterns across member banks and payment systems. The Indian Banks’ Association (IBA) facilitates fraud data sharing through the Banking Community Fraud Intelligence Platform. The RBI’s Financial Crime Intelligence Unit (FCIU) coordinates intelligence sharing on systemic fraud patterns.<\/p>\n\n\n\n

For NBFCs and fintechs, participation in industry fraud consortiums where confirmed fraud event data is shared in near-real-time with other members is increasingly valuable. A device fingerprint associated with a confirmed mule account at one lender becomes a risk signal at every other lender who has access to the shared database. The network effect of shared fraud intelligence grows as more institutions participate.<\/p>\n\n\n\n

The data governance framework for fraud intelligence sharing must be carefully designed: shared data must be limited to confirmed fraud signals (not suspected or pending cases), must be accompanied by appropriate data security obligations on all recipients, and must comply with the DPDP Act’s requirements for lawful data sharing including whether sharing is covered by legitimate use or requires specific legal basis documentation.<\/p>\n\n\n\n

Key Takeaways<\/h2>\n\n\n\n