The use of money mule accounts is commonly used in financial schemes, illicit financial flows, romance scams, job scams and a myriad other scams. These are serious crimes which generate proceeds from unsuspecting victims, who unwittingly send money to the bank accounts of money mules, for use by the criminals who take over the money mules’ accounts. Criminals use money mules to obfuscate the flow of money which benefits them.
Money muling is often a precursor to or part of other criminal activities such as identity theft and money laundering which adds to its complexity and complicates the detection and prevention of this crime.
In developing this publication, the Financial Intelligence Centre (FIC) reviewed suspicious and unusual transaction reports (STRs) regarding money mules submitted by accountable institutions, during the period August 2016 to July 2023.
The FIC set out to include a search of the database of keywords used by accountable institutions associated with money mule activities. The keyword search proved insufficient, however, as accountable institutions do not explicitly refer to money muling when filing regulatory reports with the FIC. Account behaviour proved to be more useful indicators of money mule activity.
During the review of the suspicious and unusual transaction report database, the FIC identified 58 cases referring to money muling and related illicit flow of funds for its analysis. The contents of 153 section 29 regulatory reports linked to the 58 cases were analysed to extrapolate trends, role players, occupations, and business entities involved in money mule activity.
The FIC’s analysis found extensive use of shell companies to host fraudulent funds, while South Africans were identified as directors or signatories of entities implicated in money muling or illicit financial flow activities. The majority of money mule activity identified in the review took place in the Gauteng and Western Cape provinces.
In some instances, South Africans received funds via money remitter transactions from foreign jurisdictions with no clear purpose for the funds and unknown relations between the sender and the receiver.
There was a prevalence of crypto assets being used in money mule activity, with suspected accounts reflecting high-value daily cash deposits in the banks, followed by rapid transfers to crypto asset service providers.
There was also pervasive use of shell companies to receive fraudulent South African Revenue Service (SARS) refunds in high-value amounts.
Some accountable institutions filed defensive suspicious and unusual transaction reports in response to adverse media, subpoenas or section 27 requests for information from the FIC.
The learnings gleaned from the case analysis are reflected in this report which should be useful to accountable institutions. As a result of this report, the FIC has embarked on expanding the list of indicators relating to money mules on its registration and reporting system, goAML, to enhance categorisation of money muling and related financial crimes.
June 28, 2024 Published by The Financial Intelligence Center. (Download the PDF report)
