The device was familiar. The location matched. The transfer stayed inside the institution. The withdrawal came in under $10,000.

Every check passed, and the money was still gone. 

That's the pattern behind one of the account takeover stories in Q2's latest research, The Fraud Intelligence Report: Account Takeover Signals, which analyzes signals across nearly 200 banks and credit unions. In some cases, the fraudster spent as long as 12 weeks  quietly logging in to a victim's account before moving a dollar. 

The tell isn't the transfer. It's the patience.

Why every check passes

Most fraud controls check a moment. Is this the right password? Has this device been seen before? Does this transaction look normal? A patient fraudster is built to pass each of those questions. 

It often starts with social engineering,: persuading an account holder to hand over credentials or security codes. Fraudsters repeat the tactic across other accounts at the same institution, and they open mule accounts there too, using forged, stolen, or synthetic documents to create new “account holders”. 

Then they wait. 

 They log in from their own device, often from the victim's own geographic region, until the system treats that device as legitimate. They age the mule account (Q2 has seen instances in which this has been done for up to 12 weeks) so it no longer looks new. Only then do funds move, quickly, through internal transfers where controls tend to be lightest. The money often ends at a teller, with cash withdrawals kept under $10,000 to stay beneath reporting thresholds. 

Each step alone looks benign, which is exactly the problem with judging sessions one at a time. As Angelica Gascon, senior product manager for Fraud Intelligence at Q2, explained on a recent episode of The Purposeful Banker podcast, many of the solutions institutions use today miss this kind of attack because they're "usually looking at a session by itself, not at the history behind that fraudster starting to build that internal trust." 

It used to be that if you'd seen a device a few times, you were good. Now we have to patch together many different pieces to get a story that makes sense.

What fraud teams can watch for 

Because mule accounts are hard to identify in advance, we look at both ends of a transfer. The sender matters, but so does the destination. A transfer into an account that is brand new, or one that has seen little movement and suddenly receives money, is a reason to pause and ask for a review. 

The sequence matters more than any single event: a device quietly logging in for weeks with low activity and consistent geography, then a sudden burst of internal transfers into a recently aged account. That’s the moment to step in, before a teller withdrawal occurs, and the money is gone.  

What the data shows

Mule accounts are a growing problem across the industry. U.S. money mule cases rose 168% year over year from the first half of 2024 to the first half of 2025, according to the 2025 Digital Banking Fraud Trends in the United States report.  

Our report adds a view from inside digital banking sessions. It draws on anonymized signal data from Q2's User Activity Monitoring (UAM) product across 199 financial institutions, a mix of banks and credit unions of different asset sizes. Additionally, mule account signals appeared in credit unions at twice the frequency of banks. 

Historically, most credit unions offer member-to-member transfers, while not all banks offer an account-to-account equivalent, and some credit unions have told us they suspect members may be selling credentials. But that's a working theory, not a conclusion.

Why this matters

This mule account attack pattern is a critical one for institutions to focus on because it hides inside an institution's own trusted rails. It reframes fraud from a single suspicious event into a long-running relationship the fraudster builds with your risk engine. Recovery becomes significantly more difficult once funds are withdrawn at a teller, so the window to act is before the cash-out. 

That's the thinking behind Q2’s User Activity Monitoring. It’s trained to recognize this pattern, among others, as it unfolds across sessions instead of judging each behavior alone, so a suspicious transfer can be flagged for review before the money leaves.

(Curious to learn more about User Activity Monitoring? Learn more here.) 

Read the full report

The mule account story is one of three field stories in the report, which also breaks down six categories of account takeover signals by institution size and charter type. You can download it now at q2.com/ato-signals.