Mule accounts at a digital wallet
A digital wallet with 2.3 million users opens about 11,000 new accounts each month through 140 merchant partners. One partner, which sources 47% of new accounts, has a fraud rate six times the portfolio average. In the last quarter, INR 18 million was lost to mule accounts used to receive and transfer scam proceeds. Analysis shows 83% of the mule accounts shared device IDs with at least five other accounts, 61% were opened between 11 p.m. and 4 a.m., and many used identical address proof images. The wallet's customer service team currently reopens frozen accounts after a selfie and a call, and there is no central owner for partner due diligence. The board wants faster growth but the regulator has asked about mule account controls. The compliance head must propose preventive vigilance measures, a partner risk framework, and a defensible account-freeze and reopening process.
1. Diagnose the root causes and control gaps behind the mule accounts.
Read the worked answer
The pattern is not random customer fraud; it points to industrialised mule onboarding. Shared device IDs across five or more accounts, night-time openings, identical address proofs, and one partner producing 47% of accounts with six times the fraud rate are red flags. Control gaps include weak partner due diligence and concentration limits, weak document and device checks, no velocity rules, no central owner for partner risk, and a reopening process controlled by customer service with only a selfie and a call. The incentive structure rewards account volume, so the partner has little reason to reject suspicious applicants.
The INR 18 million loss is a lagging indicator; the bank should also count prevented and attempted mule accounts as near misses. Treat this as fraud risk and operational risk, with possible money-laundering reporting obligations.
2. What preventive controls and partner-risk framework would you put in place?
Read the worked answer
Preventive controls should operate before account activation. Tier partners by risk; require beneficial ownership, AML checks and site visits; set onboarding caps and concentration limits. Use device fingerprinting, IP and geolocation checks, document forensics, liveness, and duplicate-image detection. Add velocity rules for night-time openings and multiple accounts per device. Delay full functionality for high-risk accounts and use random callbacks. Monitor inbound credits and rapid transfers.
Give one function clear ownership of partner risk. Use a partner scorecard with fraud rate, rejection rate and complaint rate; suspend or terminate partners above thresholds. Growth targets must not override these limits. Report partner concentrations and mule attempts to the board risk committee.
3. How should the wallet design a defensible freeze and reopening process?
Read the worked answer
Freeze accounts on documented risk indicators, not on a single unverified alert. Record the reason, evidence and decision-maker. Reopening should require independent review, verification of identity and source of funds, device and transaction checks, and senior approval for high-risk cases. Give customers a clear complaint and appeal route and a stated timeline.
Do not allow customer service to reopen on a selfie and a call alone, because that is the same weak control that let mules in. Compensate genuine customers for wrongful freeze only under a defined policy. Report suspicious cases, preserve records, and track reopening decisions as a control metric.