Money mule recruitment

What it is

The job offer is real enough that the first payment clears. A recruiter — sometimes a stranger on a job board, sometimes a romantic partner, sometimes the very people who scammed you last month — asks you to receive money or packages and pass them on. You open an account, or use one you already have. Money lands in it: a wire transfer, a cashier’s cheque, a cryptocurrency deposit. You are told to move it on — convert it, forward it, withdraw it as cash and hand it over — usually keeping a cut for your trouble.

The money is not yours, was never meant for you, and belongs to someone who was scammed by whoever recruited you. You are the money mule: the account that turns an untraceable online fraud into cash the people running it can actually spend.

Some mules know exactly what they are doing. Others do not, at least not at first. The law, and the sentences that follow, do not treat that distinction as cleanly as you might expect.

How it actually works

1. Recruitment, four ways

   USPIS names the same four vectors again and again: a work-from-home job offering easy money to reship packages or transfer funds; a social media “confidence” offer of a commission for moving money; a lottery scam requiring you to accept or transfer funds to release a prize; and a romance, where an online partner asks you to receive or send money on their behalf.

2. Or you are already a customer

   A growing share of mules are recruited by the same fraud ring that scammed them first. Having your money taken once does not disqualify you from being asked to help take someone else’s — it can make you a more convincing, more cooperative recruit.

   Where it could have stopped

   CFPB’s own list of red flags is short and mechanical: an unsolicited request from a stranger to receive or send money; a job posting that emphasises fast earnings from transfers; instructions to open an account in your name for someone else’s use; an online partner asking for a transfer. Any one of these, on its own, is reason enough to stop and verify independently — before opening anything.

3. The account

   A personal account, sometimes several, sometimes one opened specifically at the recruiter’s instruction. Business accounts carry more credibility and higher transfer limits, which is why knowing operators like Ogiekpolor directed the opening of dozens of them.

4. Money lands

   A wire transfer, a cashier’s cheque, a personal cheque, a cryptocurrency deposit — the proceeds of a scam running against someone else entirely, arriving as an ordinary-looking deposit.

5. Fast extraction

   Cryptocurrency conversion, debit cards handed to co-conspirators, rapid withdrawal before a bank can flag or freeze the account. Speed matters more than subtlety at this stage.

6. Overseas, and gone

   The money crosses a border, usually several, before an investigator can trace it — which is most of why restitution orders exist but rarely mean full recovery.

7. The account gets noticed

   Banks close accounts after unusual activity — one closed Sharon Dolisi’s after her first deposit. A mule’s choice at that point, continue elsewhere or stop, is often what separates the eventual sentences more than anything that came before it.

8. Consequences that vary enormously

   Prison, for a knowing, organising role. Probation and a six-figure restitution order, for an elderly participant a court believed was used rather than complicit. Both are documented outcomes of functionally the same conduct — being the account the money passed through.

Why it works

It looks like a normal job, romance, or windfall until the money arrives. Nothing about the recruitment pitch — “financial agent,” “payment processing,” “help me with a transfer” — announces itself as criminal, and the first sign that something is wrong is often the money itself.

The mule is the only visible, domestic part of an otherwise offshore operation. Organisers in Nigeria, Jamaica or elsewhere are hard for a US bank or investigator to reach. A bank account opened at a US branch, in a real name, is not — which is precisely why the recruitment pipeline never stops needing new ones.

Being a victim once does not immunise you against being recruited again. Samuel Marcus’s case is the clearest documented example: the same fraud ring that took his money in a romance scam kept him as a contact, and prosecutors say he then knowingly helped launder money stolen from other people.

The legal exposure is not proportional to what you kept. A mule who forwarded $2 million and kept a few hundred dollars in “commission” is not judged on the commission. Restitution and charges attach to the money that moved through the account, not the fraction that stayed.

And the recruitment message is built to survive scepticism. A real-looking company name, a plausible job title, an actual conversation with a person who seems to have a genuine relationship with you — these cost the recruiter little and defeat most people’s informal checks.

Where it comes from

Domestic accounts, offshore direction.

The organisers are typically abroad. Marcus’s case describes a Nigeria-based group operating under aliases; Dolisi’s co-conspirators were in Jamaica. The Justice Department’s transnational fraud enforcement work — including its 2025 Money Mule Initiative, which took action against more than 3,000 mules — is explicitly framed around disrupting the domestic end of networks run from elsewhere.

Recruitment happens over the same channels as everything else on this site. Job boards, social media, dating apps and, in a meaningful share of cases, the aftermath of a previous scam against the same person.

Scale runs from one account to a laundering desk. Ogiekpolor’s 50-plus fraudulent business accounts sit at one end; a single elderly homeowner supplying debit cards to overseas contacts sits at the other. Both moved money on the same principle.

And the Department frames this explicitly as elder protection work. Attorney General Bondi’s statement accompanying the 2025 initiative ties money mule enforcement directly to schemes — lottery, romance, grandparent, tech support imposter fraud — that disproportionately target older Americans, and notes the Department’s Consumer Data Victim Compensation Fund had returned over $129 million to more than 100,000 victims as of June 2025.

Real cases

Red flags

• An unsolicited offer from a stranger to receive or send money on their behalf.
• A job posting emphasising fast, easy earnings from transferring money or reshipping packages, with no clear description of what the “company” actually does.
• Instructions to open a bank account — personal or “business” — for someone else’s transactions to run through.
• A romantic partner you have never met in person asking you to receive or send funds.
• A prize, lottery or inheritance that requires you to accept or forward money before you can claim it.
• Being asked to convert deposits to cryptocurrency or hand over a debit card linked to your account.
• Pressure to move money quickly, before you have time to ask questions or verify anything independently.
• A bank closes or flags your account for the activity, and the recruiter’s response is to suggest opening another one elsewhere.

If it’s happening to you

If you have already opened an account or accepted a package at someone’s instruction, stop moving anything further right now. Do not withdraw, convert, forward or reship anything already in your possession.

1. Contact your bank or credit union directly, using the number on your card or statement, and tell them exactly what has happened. They can flag the account and may be able to stop further transfers.
2. Stop all contact with whoever recruited you — the job “employer,” the online partner, the person who offered the commission.
3. Report it. In the US: the FBI’s Internet Crime Complaint Center at ic3.gov, the FTC at ReportFraud.ftc.gov, and USPIS at 1-877-876-2455 if packages were involved. See where to report for other countries.
4. Keep every message, screenshot and transaction record. These are what separates “I was used” from “I knew,” and they are the evidence a prosecutor and a court will actually look at.
5. Do not assume reporting it yourself makes you immune from charges. It does not guarantee immunity, but cooperating early and stopping the conduct is consistently better, in every documented case on this page, than continuing.
6. If you are still being paid a “commission,” that money is not yours to keep. Expect it to be part of any restitution calculation.
7. Expect the account itself to be affected, separate from any prosecution: the FDIC’s Office of Inspector General names frozen accounts and lasting credit damage as consequences on their own, whether or not charges follow.

Where the money goes

The victim’s money never really stops moving, and that is the entire design.

It enters the mule’s account looking like an ordinary deposit — a wire, a cashier’s cheque, a cryptocurrency transfer. From there it needs to leave fast, before a bank’s fraud controls or a victim’s own bank notices the transfer was fraudulent and attempts a recall. Conversion to cryptocurrency, rapid cash withdrawal via debit cards mailed or handed to co-conspirators, and transfer to further accounts are all documented methods, sometimes used in combination within days of the money landing.

From there it typically leaves the country. Both documented cases with an identified destination in this scheme’s real cases moved money to overseas co-conspirators — Nigeria in one, Jamaica in the other — which is also why restitution orders, even sizeable ones like Dolisi’s $1.97 million, rarely translate into money victims actually get back.

By the numbers

No published dataset breaks this scheme out as its own category yet, so there is no chart to show. The data page explains which agency categories exist and why some schemes are invisible in official statistics.