NEW YORK — Suspected money laundering activity involving so-called money mule accounts increased sharply at U.S. credit unions and community banks during the past year, even as other forms of digital banking fraud declined, according to a new report from fraud prevention company BioCatch.
The company’s 2026 Digital Banking Fraud Trends in the U.S. Mid-Market report found a 25% increase in digital banking sessions involving money mule activity, while the average value of mule transfers rose 27%.
At the same time, overall fraud sessions declined 11% and automated bot activity fell 15%, suggesting criminals are increasingly turning to human-operated money movement that can be more difficult for traditional fraud detection systems to identify.
The findings are based on proprietary data from more than 250 U.S. credit unions and community banks that use BioCatch technology. The report compares activity during the second half of 2025 and first half of 2026 with the corresponding year-earlier period.
Key Findings From the Report
Among the report’s principal findings:
- Money mule activity: Digital banking sessions associated with mule activity increased 25%.
- Transfer values: The average value of money mule transfers increased 27%.
- New devices: Some 52% of mule sessions originated from new devices, an increase of 17 percentage points from a year earlier.
- Fraud sessions: Overall digital banking fraud sessions declined 11%.
- Bot activity: Automated bot activity decreased 15%.
- Remote access: Sessions involving detected remote access tools increased 6%, a trend BioCatch linked to social engineering scams.
- Transaction amounts: One in five transactions from confirmed mule accounts involved rounded dollar amounts.
- Account balances: Individual mule payments averaged 38% of the account’s total balance.
The company said the findings reflect a changing fraud environment in which criminals increasingly use legitimate accounts and human operators rather than relying exclusively on automated attacks.
How Money Mule Operations Are Changing
Money mules are individuals or accounts used to receive and transfer funds obtained through fraud or other criminal activity. The accounts can be operated by willing participants or individuals recruited or deceived into moving money.
According to BioCatch, criminals frequently split incoming deposits into multiple smaller outgoing transfers, a practice known as layering, to complicate investigations and avoid triggering transaction-monitoring thresholds.
“More than half of mule sessions among our mid-market customers now originate from new devices,” said Thomas Peacock, BioCatch director of global fraud intelligence.
“Mules often switch devices to obscure their identity and past transaction history, splitting up incoming sums into a series of smaller outbound transfers to make it difficult for investigators to follow the money. On average, mid-market mules transferred just 38% of the total balance in their accounts per payment.”
Patterns to Monitor
The report identified several patterns that financial institutions should monitor:
- Account testing: Criminals may initially conduct small transactions to verify that an account works before increasing activity.
- Gradual escalation: Transaction frequency and dollar amounts can increase over several weeks to make the activity appear legitimate.
- Overnight activity: More than 25% of mule activity occurs overnight, when criminals may believe fraud monitoring is less intensive.
- Geographic layering: BioCatch said its analysis of confirmed cases found funds frequently routed through Latin American countries before reaching final destinations in China.
- Reduced activity: After periods of heavy transaction activity, operators may temporarily reduce account usage to lower the likelihood of detection.
BioCatch said mule accounts are especially challenging to identify because they are often opened by real individuals using legitimate identification documents, allowing them to pass standard Know Your Customer verification procedures.
Credit Union Case Study: How One Mule Account Operated
The report includes a detailed case study of a retail account at an unidentified U.S. credit union that BioCatch classified as a confirmed money mule account.
The company examined activity over a 40-day period, finding what it described as a coordinated effort to move money rapidly before the account could be detected and shut down.
The account initially remained largely inactive for approximately three weeks before transaction activity accelerated.
The Findings
Among the findings:
- Approximately 2,400 banking sessions were scored during the analysis.
- The account used nine distinct devices.
- Three new payment beneficiaries were added.
- BioCatch recorded 347 sessions with risk scores exceeding 900 on its 1,000-point scale.
- Approximately 23% of sessions fell into the company’s most critical risk category, with scores between 900 and 1,000.
- Only 3.4% of sessions received risk scores below 400.
The analysis also identified three devices that played different roles in the operation.
One device was used primarily to establish new beneficiaries, while another was responsible for 76% of payments. A third handled balance transfers and check deposits.
BioCatch said high-risk sessions also involved repetitive, multistep operations occurring at six times the rate observed among legitimate banking customers.
Activity Continued Around the Clock
The case study found unusual transaction patterns throughout the day, including elevated activity during evening and overnight hours.
Unlike typical retail banking customers, who generally have extended periods of inactivity, the mule account remained active around the clock.
The company said the pattern was consistent with the possible use of automated access tools or shared account credentials among multiple operators.
BioCatch said its machine-learning behavioral models identified suspicious activity independently of traditional rule-based fraud alerts, illustrating how behavioral monitoring can help institutions recognize accounts that otherwise appear legitimate.
Smaller Institutions May Be Attractive Targets
The report also includes an analysis by Gary Warner, director of intelligence at DarkTower, who warned that cybercriminals do not necessarily favor the largest financial institutions.
Instead, he said, criminals increasingly target institutions they perceive as having weaker fraud defenses or easier account-opening procedures.
Warner said research into criminal marketplaces indicates that smaller credit unions have become attractive targets for account takeover attacks.
In one private Telegram group examined during his research, 23 of the last 25 stolen online banking accounts advertised for sale were associated with small, localized credit unions rather than major banks.
He said criminals often believe large banks have invested more heavily in device fingerprinting, behavioral analytics and risk-based authentication, making smaller institutions potentially easier targets.
Warner also identified neobanks and financial technology platforms as attractive to criminals seeking accounts that can be opened quickly and linked to payment services.
According to the analysis, criminals actively exchange information about weaknesses in financial institutions’ identity verification and account-opening processes, allowing successful fraud techniques to spread rapidly through online criminal communities.
Warner cautioned that the size of an institution is not necessarily the determining factor in whether it becomes a target. Rather, criminals evaluate how easily they believe its defenses can be bypassed and how quickly money can be moved.
Credit Union Fraud Manager Cites Evolving Threats
Lisa Allard, fraud manager at St. Mary’s Bank, said the changing nature of money mule activity requires financial institutions to look beyond conventional transaction monitoring.
“We continue to see evolving fraud trends, including increased suspected mule account activity and the suspected misuse of legitimate technologies in connection with unauthorized access attempts and payment fraud activity,” Allard said.
“By leveraging advanced behavioral intelligence, we are strengthening our ability to identify hidden account relationships, detect emerging suspicious activity, and proactively mitigate fraud risks as these tactics continue to evolve.”
The report’s findings suggest that declining levels of certain types of fraud do not necessarily mean financial institutions face less exposure to financial crime.
Instead, BioCatch said, the increase in mule activity indicates criminals are adapting their methods, using legitimate accounts, changing devices and structuring transactions to make suspicious money movement more difficult to detect.
Better Understanding
The company said understanding behavioral patterns throughout an account’s life cycle can help credit unions and community banks identify suspicious activity earlier and intervene before additional funds are transferred.
BioCatch said that, as of the end of the first half of 2026, more than 370 financial institutions worldwide used its technology, which analyzed approximately 19 billion digital banking sessions per month.
The company said its behavioral intelligence technology evaluates patterns such as keystrokes, mouse movements, touchscreen interactions and device characteristics to identify potential fraud, account takeovers and financial scams.
