“Receive the money and keep a cut”: how people are recruited as money mules

The advert promises easy remote work. The task is short: receive money in your own account, send most of it elsewhere and keep a small percentage. The recruiter may call it payment processing, helping an overseas customer or a test before the real job begins.

This may be recruitment as a money mule—a person whose account is used to move proceeds from crime. Europol says recruitment can happen through fake job adverts, social media and instant messages. Students, people who are unemployed or facing financial hardship, and newcomers to a country may be targeted.

The most important warning sign is simple

A legitimate employer does not need a new worker’s personal account to route company or customer funds. If the “job” requires you to receive somebody else’s money and pass it on, do not complete a trial transaction. A PDF contract, a familiar company logo or a polite recruitment conversation does not make that request safe.

Recruitment does not always look like employment. INTERPOL describes offers of profit or commission, investment schemes, romantic relationships, trust-based requests and impersonation. The common feature remains the same: somebody wants to use your bank account, wallet or payment service to receive and forward money.

What the excuses can sound like

• “Our company does not have a local bank account yet.”
• “The customer used the wrong account number; just send the money back.”
• “One test transfer will unlock your full earnings.”
• “I cannot receive the money for tax reasons.”
• “Use the transfer to buy cryptocurrency or gift cards, then keep your bonus.”

Each story may include real names, documents and personal details. That does not make the purpose of the transaction legitimate. Urgency is used to discourage you from calling the bank or asking somebody you trust.

What to do before or after money arrives

If no money has arrived yet, end the contact. Do not share banking credentials, card details, codes or identity documents. Preserve the advert, conversation, website address and any details the recruiter provided.

If funds have already arrived, do not forward them and do not spend the commission. Contact your bank or payment provider immediately through an official channel and explain the full situation. Report it to the police. If you have already made another transfer, give the bank the time, amount and receiving account. Do not try to “fix” the situation by making more transactions yourself.

Legal consequences depend on the facts and the relevant jurisdiction, but INTERPOL warns that a person moving the funds may face prosecution even if they did not understand the full scheme. A prompt, honest report is therefore more useful than hiding the event out of embarrassment.

How to speak with someone who was recruited

“How could you agree to that?” will not recover the money and may delay a report. Better questions are: when was the last transaction, which channels were used for the conversation, and what information was shared?

Families, universities and employers can teach one memorable pattern: other people’s money should never pass through a personal account as part of a “job”. That rule is easier to remember than a long catalogue of scam names.

Source facts and Breachroad’s conclusion

The description of money mules, recruitment channels, groups at risk and the advice to stop transfers, inform the bank and report to law enforcement come from Europol and INTERPOL. The example excuses are Breachroad illustrations based on that pattern, not an exhaustive list of scripts.

Breachroad’s conclusion is that security education should connect with everyday financial choices and avoid blaming the person who asks for help. It is also worth learning how a fake remote-work task scam develops. Our cybersecurity training for employees helps teams recognise pressure and pause an unusual payment before it leaves the account.