How to investigate suspected money mule accounts with an AI agent

Give the agent the evidence work and keep every judgement with an investigator. At depth 1 it reads the alert, builds the account timeline and maps linked accounts; at depth 2 it drafts the case summary and any report. A named person decides whether to restrict the account, report it, return funds or exit the customer.

What is a mule investigation, and who owns it?

A money mule account receives the proceeds of fraud or other crime and passes them on, usually quickly and in smaller amounts. Some holders are complicit, some are recruited with a job offer, and some have had their account taken over. The investigation has to tell these apart, because the right outcome differs for each.

Ownership usually sits with the fraud or financial crime operations team. The decision to file a suspicious activity report belongs to the nominated officer or MLRO, and exit decisions follow the bank's own policy. The agent works for these people. It never holds the decision, and it never speaks to the account holder about the case.

What are the steps?

1. Agent, depth 1: reads the trigger. A monitoring alert, a fraud notification from a sending bank, or a victim's report naming the receiving account. It records which of these started the case and how much of the reported money is still on the account.
2. Agent, depth 1: builds the timeline. Account opening, identity evidence, changes of phone or address, login and device history, every credit and debit since opening. Typical mule shape is many unrelated payers in, fast payments or cash out, and little ordinary spending.
3. Agent, depth 1: maps the network. It looks for other accounts sharing a device, phone number, address or payee, and lists each link with the record that supports it.
4. Agent, depth 2: drafts the case summary. Each indicator is stated with its source, and the summary separates what the records show from what they suggest. It proposes an outcome, labelled as a proposal.
5. Person: decides on restriction. An investigator decides whether to block outgoing payments while the case runs. Where a live victim report shows funds still present, the bank may pre-agree that the agent places a temporary hold at depth 3, inside the customer's own limits. Anything wider is held for a person.
6. Agent, depth 2: drafts outbound messages. Requests to the sending bank and replies to fraud notifications are drafted for an investigator to send.
7. Person: reports, repatriates and exits. The nominated officer decides on a report. Any return of funds is a depth 4 movement that a person releases. Closure follows policy and a person signs it.

Which controls matter, and what evidence do they leave?

No customer contact. The agent has no capability to message the account holder on a mule case. Tipping off is a real risk, and the safest bound is one the agent cannot reach. The verdict on any attempt is filed as refused, naming the role scope as the bound that decided.

Provenance on every claim. A fraud notification from another bank arrives as an external claim. It can start an investigation, but it cannot authorise moving money. Returning funds needs a person's release, which is why moving money between accounts is treated as depth 4 work.

Held drafts. The summary, the report draft and every outbound request are filed as held, with the name of the person who approved, edited or rejected them. The edits are kept, so you can see where investigators disagree with the agent.

Minimum chain on holds. If the agent places a temporary hold, the record shows the five bounds it met, the one that decided, and the time the hold was placed against the time the victim's report arrived.

What should you measure?

• Time from trigger to restriction decision. Mule funds move within hours. The agent's job is to shorten the wait for a person, not to skip the person.
• Edit rate on case summaries. Heavy edits mean the agent is overreaching or missing context.
• Network links confirmed by investigators. A high share of rejected links shows the matching is too loose.
• Restrictions later lifted. Each one is a customer who was wrongly blocked; read every case.
• Funds still present at first hold. This shows whether faster preparation reaches money before it leaves.

Some of the same skills serve other cases. The timeline work overlaps with how you investigate failed payments with an agent, so certify each agent separately even if the agent is shared.

Where does it usually go wrong?

Over-linking. Families share devices and addresses. A network that treats every shared phone as evidence will pull innocent relatives into a case. Require the agent to state the type of link and keep household links in their own category.

Conclusions in the draft. An agent that writes "this customer is a mule" has reached a finding it is not entitled to reach. The draft should describe indicators, not guilt, because the account holder may be a victim recruited through a fake job advert.

Treating repeat patterns as proof. Rapid in and out is also how some legitimate small traders and students use accounts. The agent should list innocent explanations it has checked and ruled out.

No path when the agent itself fails. If a hold is placed wrongly, you need to reconstruct why. Run it as you would investigate an AI agent incident: replay the filed verdicts, find the bound that allowed the action and adjust it.

Where Pryme fits

In Pryme, the timeline, network and draft capabilities are certified separately through Attest on your own closed mule cases. The temporary hold, if you choose to allow it, needs its own certificate. Each fact in the summary carries its provenance class, and every verdict is filed so a reviewer can follow the case end to end. The wider bounds for bank agents are set out in AI agents in banking.