Skip to content
FIN-CSIRT
RS

FIN-CSIRT / Search

What are you looking for?

Start typing to see results.
    Report an incident

    FIN-CSIRT / Practical lesson

    Recognise money mule recruitment

    Check an offer that asks you to receive other people’s money into your account and pass it on.

    Account holders and people seeking work or extra incomeAbout 4 minutes of reading + 3 questions
    Start with the example Has something already gone wrong?

    What you will learn

    • Recognise how an account can be used to move criminal funds.
    • Distinguish checking an employer from trusting a convincing advert.
    • Stop further transfers and contact the bank if already involved.

    Practice example

    Commission for “processing payments” through your personal account

    An offer of extra work on social media
    Today, 09:41

    We need a payment processing assistant. Receive customer funds into your account, then forward them to the accounts we provide. Keep a commission. No experience needed; the first payment arrives today.

    Fictional scenario for practice.
    Show the example explanation
    Your account as a route for other people’s funds
    This is a money mule recruitment pattern. Do not agree to transfers simply because they are presented as a job.
    Earnings without a clear business task
    A convincing company name or promised commission does not explain where the money comes from or why a personal account is needed.

    What is a money mule?

    A money mule receives, withdraws or forwards money obtained through crime on someone else’s behalf. Some participants know the purpose of the transfers; others are deceived by a job offer, extra income or a personal story.

    An important warning sign is a request to use your account as a route for other people’s money in exchange for commission. Recruitment may take place through adverts, messages and social media.

    Check what you are actually being asked to do

    Ask three questions before accepting an offer:

    • What actual work would you do apart from receiving and forwarding money?
    • Why would a company use your personal account for its customers’ payments?
    • Can you independently verify the company, person and job description beyond the contacts supplied in the advert?

    A professional website, branded document or recommendation from someone you know is not enough by itself. Check both the company and the particular request. Do not hand over banking access, a card or security codes for supposed “payment processing”.

    Understand the risk without assuming the outcome

    Moving money connected to crime can have serious financial and legal consequences. Being presented as an ordinary job does not establish the money’s source or purpose. The legal consequences of an individual case depend on the circumstances and applicable rules.

    For staff in financial institutions, this pattern is a reason to follow the relevant internal procedure and involve the responsible team. This lesson does not replace internal checks or determine an individual’s liability.

    If you have already received or forwarded money

    1. Stop further suspicious transfers. Do not send money to a new account on the instructions of the person making the offer, even when they call it a “refund”.
    2. Contact your bank or payment provider immediately and explain what happened. Follow their guidance on the funds and protecting access.
    3. Preserve the advert, correspondence, sender details and transaction records.
    4. Report your suspicions to the police. Europol likewise advises people who suspect involvement to stop transferring and notify their bank and police.

    If you also report a related cyber incident to FIN-CSIRT, do not send passwords, a PIN or one-time codes. That report does not replace contacting your bank and the police.

    Check your knowledge · 3

    Your turn to choose the next step.

    Choose one answer for each question shown. More complex lessons select three questions from a wider question bank when the lesson loads.

    Questions and explanations are also available without JavaScript.

    An advert offers commission for forwarding customer money from your personal account. What do you do?

    Why does this matter? Using your account for someone else’s transfers can make you part of a chain moving scam proceeds. A commission does not explain the funds’ origin or why the business is not using its own account.

    1. Accept if the first amount is small.

      A small amount does not explain the source of funds or remove the risk. Even a small payment can form part of the same money trail, so its amount does not replace checking the purpose.

    2. Accept if I receive a document with the company logo.

      A document and logo can be copied and are not sufficient verification. Convincing documents can conceal an unusual request; the work you are being asked to do needs checking too.

    3. Do not transfer funds and independently check the company and purpose of the role.Correct answer

      A request to use your account as an intermediary needs serious checking before any transfer. You retain control of your account while establishing the request’s origin and why you are being asked to act as an intermediary.

    Money has arrived and the sender wants you to forward it urgently to a third account. What do you do first?

    Why does this matter? Money already in the account does not establish that a transfer is justified. Forwarding it to a third account may continue a suspicious chain even when the new instruction is presented as a refund.

    1. Stop further transfers and contact the bank immediately with the offer and payment details.Correct answer

      The bank needs to assess the transaction and advise on next steps. Preserve the correspondence. Pausing avoids adding another transaction while the bank checks the payment and provides case-specific instructions.

    2. Forward it to keep my promise.

      A promise does not make a suspicious transfer safe. Feeling obliged to the sender does not verify the money’s origin or the person due to receive the next payment.

    3. Return it to a new account the sender has just provided.

      The new account may be part of the same scheme. Do not continue moving funds yourself under fresh instructions. Calling the action a refund does not change the fact that you are sending funds to a different, unverified destination.

    Someone you know sends the offer and says the arrangement is entirely legal. What does that mean for verification?

    Why does this matter? Trust in an acquaintance can transfer to work whose purpose you do not understand. A personal relationship and a compensation promise do not verify the origin of money passing through your account.

    1. Knowing the person removes the need to check.

      The person may have been deceived or may also be involved in the scheme. Even a well-meant recommendation can pass on a deception if the person has not checked what the money represents.

    2. I still check the role’s purpose and do not lend my account to suspicious transfers.Correct answer

      Your relationship does not establish the source of funds or justify the transfer. You assess the transaction itself rather than basing your account’s safety only on your relationship with the proposer.

    3. It is enough if the person promises to reimburse any loss.

      A promise does not establish legality or the ability to recover money. Even a sincere promise does not explain the flow of funds or guarantee that the person could compensate a loss.

    No registration. Your answers are not sent; the result is just for you.

    Remember

    Do not lend your account to receiving and forwarding funds under a suspicious offer. If already involved, stop transferring and contact your bank.

    Contacting your bank safely

    References

    Sources and further reading

    The pattern and the advice to stop transfers and contact the bank and police are based on the Europol guide to money muling. This lesson does not determine an individual’s legal liability, which depends on the facts and the law applicable in Serbia.

    Content last reviewed