Mule accounts receive and forward illicit funds, often recruited through social engineering. Device graphs reveal clusters of accounts sharing fingerprints despite different credentials.
Operational playbook
Combine inbound/outbound velocity limits, device clustering, and IP reputation at onboarding and transfer events. Enrich SAR workflows with FraudDefense AML signal APIs.