Blog Careers Support +1 408 944 0250

Money Mules and Location-Based Financial Forensics

Preventing low-level street crime is important not only to protect public safety and property, but also as an investigative gateway into larger criminal enterprises. Drug and human trafficking are common examples of complex, multinational criminal operations that depend on hyper-local foot soldiers. Uncovering such relationships sets the stage for law enforcement to turn small-time players into cooperating witnesses that can help agents work upward in the illicit organization. While lawful intelligence solutions continue to adapt to sophisticated new financial realities like cryptocurrencies, applying modern technologies to traditional targets remains vital. Some low-level foot soldiers are responsible for transporting and laundering the millions of dollars in small bills collected from street crimes. Identifying these “money mules” using location-based services allows law enforcement agencies (LEAs) to both de-fund criminal enterprises and rehabilitate the disadvantaged individuals often lured into these serious criminal roles.

Money Mule Recruiting and the Cycle of Exploitation

Organized crime gangs have refined a technique that uses ATMs to launder their ill-gotten gains while perpetuating a cycle of exploitation for the money mules making the illicit transactions. The cycle begins with the recruiting step, where a criminal identifies people willing to help launder profits in exchange for a small portion of the money. Contact may be made in person, by e-mail, or through social media and often takes the form of a fraudulent job offer, meaning the recruit may not even realize they are committing a crime. Those targeted to be money mules are often the most vulnerable members of society, including the young, the elderly, and the poor. The financial stage of the crime begins with the criminal organization depositing cash from illegal sources into a mule’s bank account. The technique requires breaking the large sums of cash into many small deposits to avoid triggering reporting thresholds that notify authorities, which vary by jurisdiction and are well-known to criminals. This means the illegal enterprise recruits many mules specifically for this purpose. In addition to keeping transaction amounts low, criminals must control the number of deposits to one person to avoid bank analytics that might flag a large aggregate inflow of money to the account of someone on welfare or other social aid, for example. Once the funds have been deposited, the mule is instructed to withdraw them from a local ATM, then transfer the cash. In some cases a second mule – usually a foreigner from a country with weak money-laundering safeguards – completes this step, using a service like Western Union to send the money to their home country, where another member of the illegal entity retrieves it. At that point, the criminal origins of the money are effectively untraceable, and the mules are left with significant criminal liability in exchange for relatively little. Even worse, the cycle of exploitation may continue if criminals extort a mule by threatening to turn them in to law enforcement, reveal their financial details, or worse.

Using Lawful Intelligence to Counter Money Mules

To detect this type of money laundering, law enforcement starts by querying a particular ATM’s data. For example, ATM withdrawals within a given time and geographic area, in amounts just below the reporting threshold, may be of interest. Successful criminals are experienced in covering their tracks, however, and will avoid obvious indicators such as numerous withdraws of the same amount from several ATMs in close proximity, but modern lawful intelligence measures can help tilt the balance of power back to law enforcement. Location-based services are a central pillar of this effort, providing insights into a person of interest’s patterns of behavior in relation to one or more ATMs. It is common, for example, for a member of the criminal organization to chaperone the money mule during the transaction. By establishing geofences around targeted ATMs, for example, authorities can identify a mobile device that repeatedly enters the area many times per day, staying just a few minutes each time. These evidentiary patterns are contextualized with other information such as source data about ATM transactions from the central bank’s anti-money laundering software, human and open source intelligence from the field, anonymized or warranted call data records (CDRs), additional location data, and other lawfully intercepted information.


SS8’s MetaHub empowers LEAs to identify and prosecute the individuals in charge of criminal enterprises by efficiently fusing and analyzing all these data sets to form a cohesive case. Its purpose-built, automated queries search for sequences or patterns of events as well as individual ones, with text and email alerts to notify analysts. MetaHub also provides robust but intuitive tools to visualize the results using dashboards, delivering advanced insights to help stop financial crimes. SS8’s acquisition of Creativity Software also enhances their solutions with precise location capabilities encompassing the Gateway Mobile Location Center (GMLC) and Location Management Function (LMF) for 5G networks, as well as the Serving Mobile Location Center for 4G and prior networks. This allows for more robust active and passive geofence monitoring, even in crowded areas, and enriches data with real-time and historic location information, giving LEAs the tools they need to arrest criminals and end the exploitation of money mules.

About David Anstiss

David Anstiss Blog Head Shot - SS8 NetworksDavid Anstiss is a Senior Solutions Architect at SS8 Networks. He has been with SS8 since 2015 and has significant experience in critical network architecture technology and advanced data analytics. He is responsible for working with both intelligence agencies and Communication Service Providers (CSPs) around the world and is instrumental in helping them transition to 5G, defining system requirements to meet regulatory compliance. As a member of ETSI, he represents SS8 to ensure the adoption of cloud-native infrastructure is met with industry best practices and to guarantee that compliance of lawful interception is maintained. Learn more about David here on his LinkedIn profile. 

About Rory Quann

Rory Quann is Head of International Sales at SS8 Networks and brings with him over 10 years of experience in the Lawful Interception and Data Analysis industry. Prior to joining SS8 in 2013, Rory worked for BAE System Applied Intelligence where he was focused on large scale Government deployments of Intelligence Solutions. Rory has held multiple positions in the Lawful Intelligence space ranging from Deployment Engineer, System Consultant, and Sales Engineer with focus being on Country-wide Passive deployments. Rory is a Certified Microsoft MCSA Engineer and EMC Certified deployment Engineer. You can learn more about Rory on his LinkedIn profile by clicking here.

About SS8 Networks

SS8 provides Lawful Intelligence platforms. They work closely with leading intelligence agencies, communication providers, law enforcement agencies and standards bodies. Their technology incorporates the methodologies discussed in this blog and the  Xcipio®  and Intellego® XT product portfolios are used worldwide for the capture, analysis, and delivery of data for the purposes of criminal investigations.

Tweet Us @SS8       Follow Us LinkedIn


SS8 Newsletter



How to Ingest, Filter and Query 5G Volumes

Webinar Presented by Kevin McTiernan

CLICK HERE to watch!