HomeAutomation/AIMoney mules and location-based financial forensics

    Money mules and location-based financial forensics


    Sponsored: Preventing low-level street crime is important in protecting public safety and property – and as an investigative gateway into larger criminal enterprises.

    Drug and human trafficking are common examples of complex, multinational criminal operations that depend on hyper-local foot soldiers. Uncovering such relationships sets the stage for law enforcement to turn small-time players into cooperating witnesses that can help agents work upward in the illicit organization.

    While lawful intelligence solutions continue to adapt to sophisticated new financial realities like cryptocurrencies, applying modern technologies to traditional targets remains vital. Some low-level foot soldiers are responsible for transporting and laundering the millions of dollars in small bills collected from street crimes. Identifying these ‘money mules’ using location-based services allows law enforcement agencies (LEAs) to both de-fund criminal enterprises and rehabilitate the disadvantaged individuals often lured into these serious criminal roles.

    Recruiting money mules and the cycle of exploitation

    Organized crime gangs have refined a technique that uses ATMs to launder their ill-gotten gains while perpetuating a cycle of exploitation for the money mules making the illicit transactions.

    The cycle begins with the recruiting step, where a criminal identifies people willing to help launder profits in exchange for a small portion of the money. Contact may be made in person, by e-mail, or through social media and often takes the form of a fraudulent job offer, meaning the recruit may not even realize they are committing a crime. Those targeted to be money mules are often the most vulnerable members of society, including the young, the elderly, and the poor.

    The financial stage of the crime begins with the criminal organization depositing cash from illegal sources into a mule’s bank account. The technique requires breaking the large sums of cash into many small deposits to avoid triggering reporting thresholds that notify authorities, which vary by jurisdiction and are well-known to criminals.

    This means the illegal enterprise recruits many mules specifically for this purpose. In addition to keeping transaction amounts low, criminals must control the number of deposits to one person to avoid bank analytics that might flag a large aggregate inflow of money to the account of someone on welfare or other social aid, for example. 

    Once the funds have been deposited, the mule is instructed to withdraw them from a local ATM, then transfer the cash. In some cases a second mule – usually a foreigner from a country with weak money-laundering safeguards – completes this step, using a service like Western Union to send the money to their home country, where another member of the illegal entity retrieves it.

    At that point, the criminal origins of the money are effectively untraceable, and the mules are left with significant criminal liability in exchange for relatively little. Even worse, the cycle of exploitation may continue if criminals extort a mule by threatening to turn them in to law enforcement, reveal their financial details, or worse.

    Using lawful intelligence to counter money mules

    To detect this type of money laundering, law enforcement starts by querying a particular ATM’s data. For example, ATM withdrawals within a given time and geographic area, in amounts just below the reporting threshold, may be of interest.

    Successful criminals are experienced in covering their tracks, however, and will avoid obvious indicators such as numerous withdraws of the same amount from several ATMs in close proximity, but modern lawful intelligence measures can help tilt the balance of power back to law enforcement.

    Location-based services are a central pillar of this effort, providing insights into a person of interest’s patterns of behavior in relation to one or more ATMs. It is common, for example, for a member of the criminal organization to chaperone the money mule during the transaction. By establishing geofences around targeted ATMs, for example, authorities can identify a mobile device that repeatedly enters the area many times per day, staying just a few minutes each time.

    These evidentiary patterns are contextualized with other information such as source data about ATM transactions from the central bank’s anti-money laundering software, human and open source intelligence from the field, anonymized or warranted call data records (CDRs), additional location data, and other lawfully intercepted information.


    SS8’s MetaHub empowers LEAs to identify and prosecute the individuals in charge of criminal enterprises by efficiently fusing and analyzing all these data sets to form a cohesive case. Its purpose-built, automated queries search for sequences or patterns of events as well as individual ones, with text and email alerts to notify analysts.

    MetaHub also provides robust but intuitive tools to visualize the results using dashboards, delivering advanced insights to help stop financial crimes. SS8’s acquisition of Creativity Software also enhances our solutions with precise location capabilities encompassing the Gateway Mobile Location Center (GMLC) and Location Management Function (LMF) for 5G networks, as well as the Serving Mobile Location Center for 4G and prior networks. This allows for more robust active and passive geofence monitoring, even in crowded areas, and enriches data with real-time and historic location information, giving LEAs the tools they need to arrest criminals and end the exploitation of money mules.

    Author: David Anstiss
    Author Rory Quan