PRODUCT LAUNCH

Meet Incognia AI-Powered Browser ID: The New Standard in Web Risk Intelligence>>
Report

The State of Mule Account Handovers in 2026

How mule activity involving account handover is escalating—and what financial institutions must do to detect it, stop it, and stay compliant.
Based on a survey of 500+ fraud, risk, and AML professionals across the US and Europe.
Read the report
hero-banner-april-report

Key findings

81%

report an increase mule account handovers over the past 12 months.

53%

say detecting mule account handovers is more difficult than most other fraud types.

83%

detect mule account handovers reactively, whether it’s after early suspicious behavior, once funds are already moving, or once funds have already exited the institution.

78%

say their organizations have made improving detection of mule account handovers either a high (52%) or top (26%) priority over the next 12 months.

Introduction

Mule account handover fraud is growing and outpacing the industry's ability to detect it

The challenge isn't awareness or investment. It's that the current system wasn't built to catch them.

Unlike traditional fraud, these accounts are opened by real people using their own data, which makes them look entirely legitimate. Some account holders are coerced or manipulated, others are willing participants. Either way, by the time control shifts, the account has already cleared standard detection.

We surveyed more than 500 fraud, risk, and AML professionals across the US and Europe to understand exactly where detection is breaking down. Most institutions are still catching handovers reactively. 78% say improving detection is a high priority for the year ahead.

This research reinforced my conviction that solving this problem requires a different approach to verification altogether: one that's continuous and grounded in physical reality, not point-in-time checks at onboarding. Despite the size of this problem today, there is a clear path forward. We're excited to continue partnering with financial institutions to help them put it into practice.

Only
16%

of institutions catch mule account handovers before any suspicious transactions occur

Avatar - André Ferraz, CEO and Co-founder of Incognia
André Ferraz

CEO and Co-founder of Incognia

The compliance floor is not enough

Despite the regulations financial institutions must comply with, mule activity involving account handover falls in a gray area. Know Your Customer (KYC) and Customer Identification Program (CIP) requirements apply only when accounts are first opened. Financial institutions do have an obligation to consistently monitor account holders' identities in response to specific events, but how this happens varies from one organization to another.

Mule account handovers exploit this gap, putting verified accounts in bad actors' hands without triggering any compliance review. But failure to detect anomalous post-onboarding behavior can constitute anti-money laundering (AML) noncompliance, exposing institutions to millions in penalties.

Even as behavioral and location signals prove their value as identity verification tools, formal regulatory guidance on their use remains vague. Today, risk and compliance leaders are responsible for protecting their institutions against emerging and quickly changing threats as they wait for industry regulations to catch up.

To understand the current challenges, trends, and opportunities the industry faces related to mule account handovers, Incognia surveyed more than 500 fraud prevention, risk management, and AML professionals at financial institutions across the US and Europe.

Detect mule account handovers earlier—with fewer false positives.

Learn more
BENCHMARKS

Mule account handovers are on the rise across institution types

Mule account handovers are growing across the global financial services industry. US financial institutions in particular are over 20% more likely to have experienced significant increases in mule account handovers compared to those in Europe.

In the past 12 months, which of the following best describes your organization’s experience with mule activity that involves an account handover?

Decreasing activity Increasing activity
  • Significant decrease 1%
  • Slight decrease 4%
  • No change 14%
  • Slight increase 51%
  • Significant increase 30%

Cross-border mule activity reinforces the global nature of fraud

Complicating the fraud landscape even more, most respondents surveyed reported suspected or confirmed cases of mule account handovers that span multiple countries.

Larger institutions are a prime target for these global threats. Respondents at institutions with over 50M accounts are 40% more likely than all respondents to report confirmed cross-border account handover.

Respondents at organizations who report a significant increase in mule activity are almost twice as likely than all respondents to have confirmed cross-border account handover.

In the past 12 months, which of the following best describes your organization’s experience with cross-border mule activity involving account handover?

  • We strongly suspect cross-border handover based on behavioral, device, or transaction signals 34%
  • We have confirmed cases where account control or usage shifted to outside our primary operating country 30%
  • We observe cross-border fund flows, but account control appears domestic 21%
  • We primarily observe domestic mule activity with limited cross-border involvement 9%
  • We have limited visibility into whether account handover is domestic or cross-border 3%
  • Not sure 2%
  • Do not currently monitor for cross-border aspects of account handover 1%

Most mule account handovers are a result of coercion

 In some cases, customers may act as willing or voluntary mules in hopes of being rewarded, but our research shows this to be the exception rather than the rule. Most are a result of coercion. Because victims often don't realize what's happened, they don't report it—and by the time suspicious activity surfaces, the damage is already done. 

In the past 12 months, how often does suspected mule activity involving account handover at your organization involve customers who appear to be coerced, manipulated, or socially engineered, rather than willing participants motivated by personal benefit?

The consequences are significant. Financial losses from fraud write-offs, reimbursement costs, and lost funds are the greatest impact of mule account handovers, cited by over one in five respondents. But the damage extends beyond direct losses, encompassing:

16%

Reputational and
brand risk

15%

Elevated regulatory and compliance exposure

15%

Increased exposure to organized financial crime

For US institutions, financial losses are the dominant concern. European respondents are equally worried about regulatory exposure and organized crime networks—a split that reflects different policy environments on each side of the Atlantic.

Mule account handovers among different types of financial institutions

Money service businesses

44

of money service businesses (MSBs) report significant increases in mule account handovers (47% more than all financial services institutions).

Neobanks

38

of neobanks most commonly report that their institutions have confirmed cases of account control shifting to individuals outside of their primary country.

Credit unions

3

more respondents at credit unions report that “nearly all” cases of mule account handovers involve coerced or manipulated customers compared to all respondents.

What the data reveals about your exposure

A spike in mule activity could indicate cross-border cases you haven't found yet.

Institutions reporting significant increases are nearly twice as likely to have confirmed international handovers—highlighting the essential role location data should play in early detection.

Benchmark against your peer group, not the industry average.

MSBs and neobanks face the highest rates of significant mule account handover increases. If you're in either category, industry-wide benchmarks will understate your risk.

challenges

Mule account handover is one of the most difficult types of fraud to detect proactively (and accurately)

Because financial institutions' identity compliance protocols primarily apply to new account creation, more than one-third don't flag mule activity until (some) damage has already been done.
83%

detect mule activity reactively, whether it’s after early suspicious behavior, once funds are already moving, or after funds have already exited the institution.

In the past 12 months, which best describes when your organization can typically detect mule activity involving account handover?

Earlier detection Later detection
0%

Before any suspicious transactions occur

0%

After early suspicious behavior, but before significant funds move

0%

After funds begun moving, but before most funds exit

0%

After funds exited or losses have occurred

0%

Detection is usually reactive (e.g. complaints, external alerts)

Detecting mule account handovers is a major challenge

 This delayed reaction comes as little surprise, considering 53% of all respondents say detecting mule account handovers is more difficult than most other fraud types. More than half of respondents (53%) also feel there is a greater risk of false positives when detecting mule account handovers compared to other forms of fraud. 

Which best describes how difficult it is for your organization to detect mule activity involving account handover compared to other types of fraudulent activity?

  • Somewhat more difficult than most other fraud types
  • About as difficult as other fraud types
  • Somewhat easier than most other fraud types
  • Much more difficult than most other fraud types
  • Much easier than most other fraud types

"Mule account detection is critical, not just to protect the customer, but to avoid becoming criminals' favorite financial institution. In one case, we helped a bank detect 28 devices in the same location that were associated with 2,900 accounts. But that institution had only identified 11 as being mule accounts previously."

Avatar - André Ferraz, CEO and Co-founder of Incognia
André Ferraz

CEO and Co-founder of Incognia

Multiple flagged devices appear concentrated in one area. When zoomed in, these devices are confirmed to share a single physical location.

Map - Depoiment
Address - Depoiment

Evolve your detection from reactive to proactive

Shift from identity snapshots to continuous verification.

Point-in-time checks at onboarding won't catch account handovers. Continuously monitoring a user's journey allows you to spot the exact moment a legitimate account changes hands.

High manual review volume is a signal quality problem.

If your fraud team is spending significant time on false positive cases triggered by device or location flags, you need to address your data precision problem.

TOOLS + PROCESSES

Institutions rely on a patchwork of tools to detect and respond to mule account handovers, often at the customer's expense

Financial institutions rely on a few different signals to detect mule activity and most often use real-time or near-real-time monitoring.

Respondents whose organizations identify mule activity before suspicious transactions occur are most likely to rely on behavioral analytics or biometrics focused on post-onboarding activity (41%), real-time or near real-time monitoring capabilities (35%), and location intelligence or location behavior analysis (35%).

Which of the following technologies does your organization currently use to detect mule activity involving account handover?

  • Real-time or near-real-time monitoring capabilities
  • Network or relationship analysis
  • Location intelligence or location behavior analysis
  • Internal machine learning models specifically trained on mule or account misuse behavior
  • Behavioral analytics or biometrics focused on post-onboarding activity

The most common technology used by organization type

Organization Type TOP TECHNOLOGY CITED BY
Credit unions
Location intelligence/behavior analysis and internal machine learning models
43%
Digital-only or neobanks
Network or relationship analysis (55%)
55%
Fintech
Behavioral analytics or biometrics focused on post-onboarding activity
43%
MSBs
Location intelligence or location behavior analysis
45%
Payment processor/payment networks
App tampering or device integrity checks
44%
Traditional retail or commercial banks
Real-time or near real time monitoring capabilities
42%

Many false positives come down to precision, not signal

Device identity is the most frequent cause of false positive alerts for mule account handovers, cited by 28% of all respondents. These numbers reflect an implementation problem, not a signal problem.

Device identity and location are the right signals for detecting handovers, most institutions just aren't using precise enough versions of them.

A location check built on city-level or IP-derived data will flag legitimate travel as suspicious. One built on behavioral patterns at apartment-level precision can tell the difference between a user who moved and an account that changed hands.

“Imprecise signals lead to inaccurate flags. When you have more accurate signals for both device identity and location, you can cut down your false positives significantly.”

Avatar - Eduardo Pires, Director of Fraud Solutions, Incognia
Eduardo Pires

Director of Fraud
Solutions, Incognia

Which of the following risk signal(s) are the most frequent cause of false positive alerts for mule activity with account handover?

  • Device identity: Confirming if a "new device" is actually the user's valid upgrade or reset
  • Location: Verifying if the user is at an unknown or implausible location
  • IP address: Dynamic IPs flagged as risky
  • Behavioral biometrics: Subtle changes in typing speed, mouse movements, or gyroscope handling flagged as "not the user"
  • User intent or coercion: Trying to determine if the user is acting under duress (scams) vs. normal hesitation
  • Identity documents: Manual review of ID scans, selfies, or document authenticity
  • Facial biometrics or liveness: Legitimate users failing liveness checks or AI/deepfake detection tools triggering false alarms
  • Cross-account links: Untangling complex webs of shared devices/IPs
  • Transaction context: Calling the customer or checking history to validate a high-value transfer

Suspected mule account handovers often lead to account restrictions, which can be frustrating for account holders

When mule account handover is suspected, 51% of institutions respond by temporarily restricting account activity or payment capabilities. This creates friction in the customer experience and, combined with high false positive rates, can result in legitimate customers being unfairly penalized simply because their institution is a target for mule activity. 

Respondents at digital-only or neobanks are more likely to use step-up authentication or customer re-verification and enhanced transaction or behavioral monitoring compared to all respondents. Traditional retail or commercial bank respondents are more likely to conduct manual investigations or case escalations and file regulatory or compliance reports than the overall respondent base. 

Which of the following best describes the actions that your organization
takes when mule activity involving account handover is suspected?

What the data reveals about your exposure

Leveraging some form of location data isn't the same as leveraging precise location intelligence.

Location verification is simultaneously one of the most widely used detection tools and one of the top two causes of false positives.

Technology diversity without coordination creates detection gaps.

If your stack was built by layering solutions over time rather than designed around a unified signal strategy, the gaps between tools may be allowing mule activity to slip through.

BENCHMARKS

Account handover detection is a top investment priority

Most financial institutions plan to invest in their mule account handover detection operations in the year ahead.

87% of respondents who say that detecting mule activity is much more difficult than most other fraud types say that improving detection is a top-tier priority with active executive sponsorship (54%) or say it is a high priority with planned initiatives underway (33%).

78%

of respondents say their organizations have made improving detection of mule account handover either a high (52%) or top (26%) priority.

Which of the following best describes your organization's priority level for improving detection of mule activity involving account handover over the next 12 months?

Lower priority Higher priority
  • Not currently a strategic focus 1%
  • Lower priority 2%
  • Moderate priority 19%
  • Top-tier priority 26%
  • High priority 52%

Financial leaders plan to use AI, improved data integration, and network analysis to detect mule account handovers

Looking at the top five investment priorities, each target individual symptoms of mule activity:

  1. AI and machine learning could detect behavioral pattern changes after onboarding.
  2. Data integration connects signals that currently live in silos.
  3. Network analysis can spot shared devices and locations across accounts.
  4. Device integrity checks catch tampering, emulators, and app cloners.
  5. Location behavior reveals the geographic mismatch that signals a handover.

Together, they describe institutions trying to answer one question: Who is actually behind the account after onboarding?

This convergence points toward a single underlying need: reconnecting digital identity to the physical world.

Which areas does your organization plan to increase investment in for detecting mule activity involving account handover over the next 12 months?

  • AI, machine learning, or advanced modeling capabilities
  • Improved data integration across fraud, AML, and payments
  • Network effect capabilities and/or relationship analysis
  • Device integrity checks for tampering, emulators, or app cloners
  • Location behavior analysis and precise location signals
  • Investigator tooling and case management
  • Behavioral biometrics (e.g. typing, mouse movement)
CONCLUSION

Accurate mule account handover detection requires a new standard of truth

The financial services industry knows it has a mule account handover problem—and most institutions are preparing to do something about it.

Mule account handovers are an identity issue, not only at account onboarding but throughout a customer's lifecycle.

The most effective fraud and risk teams will adapt by:

1

Moving detection earlier, flagging mule account handovers before suspicious transactions occur

2

Leveraging cross-device intelligence and cross-institution collaboration to detect and prevent mule activity

3

Investing in more precise signals to mitigate false positives and eliminate friction from the customer experience

From fraud farms to AI-powered social engineering, mule account threats are becoming more sophisticated and diverse. As the rise of mule account handovers underscores, financial institutions need to invest in continuous verification rather than point-in-time checks to make threat detection a truly proactive process.

The most resilient and future-proof method for establishing trust throughout the customer journey is using signals grounded in physical reality, going beyond digital identity alone.

“Today's most advanced fraud prevention systems don't rely on any single signal. Instead, they weave together multiple data points into a persistent thread of identity. The financial institutions that master mule account handover prevention won't be those who build higher walls, but those who design systems smart enough to recognize customers without asking.”

Avatar - André Ferraz, CEO and Co-founder of Incognia
André Ferraz

CEO and Co-founder, Incognia

Prevent mule account handovers while providing a frictionless user experience with Incognia.

Methodology

 The research in this report was conducted by Datalily via Centiment, a market research provider, on behalf of Incognia. A 20-question survey was administered to 511 professionals at financial institutions in the US, UK, Germany, France, and Spain between January 28, 2026 and February 10, 2026.

Respondents included fraud prevention, risk management, and AML professionals at financial institutions who have direct involvement with detecting and managing mule account activity.

Report created in collaboration with Datalily. 

By clicking "Accept" or continuing to use this Website after this notice, you agree to our Terms of Use - including your rights, responsibilities, and how we handle disputes.