What money mule recruitment means
Money mule recruitment is the practice of persuading someone, often through a fake job offer, an online relationship, or a promise of easy income, to use their own bank account or crypto wallet to receive and pass on funds that came from fraud or theft. The person recruited is the money mule. They rarely meet the people directing them, and at the start they often do not realize the money moving through their account did not come from a legitimate business.
The signs that identify this kind of recruitment sit in the practical details of the offer: how the so-called employer pays, what they ask you to do with money that lands in your account, and how much pressure they apply to move it quickly.
How it works in practice
A recruiter makes contact through a job board, a social media message, a dating app, or an unsolicited email, offering a vague role such as "payment processing agent" or "local representative" with easy pay for little work. Once the target agrees, funds arrive in their personal bank account. They are told to withdraw the money and forward it on, by wire transfer, gift cards, or cash pickup, keeping a percentage as a commission. If the recruit asks questions or their account gets flagged by their bank, the recruiter typically disappears.
With crypto, the same pattern plays out through a wallet instead of a bank account: the recruit receives coins or tokens and is asked to send them onward to another address. This is one reason checking the wallet itself matters as much as checking the company behind the offer. Running a suspicious address through a wallet checker can show whether it has already been linked to flagged activity, before you agree to touch it.
Warning signs to look for
Most money mule offers share a small set of features. On their own, any one of these could have an innocent explanation, but together they describe a pattern worth stopping to check.
- The job title is vague ("payment processing agent", "money transfer agent", "local representative") and there is no written contract.
- You are asked to receive money or crypto into your own personal account, then move it elsewhere and keep a percentage.
- The offer arrived unsolicited, through social media, a dating app, or a message with no real interview process.
- There is pressure to act fast, often paired with reassurance that "everyone does this" or that it is "just a favor".
- You are told to open a new bank account or crypto wallet specifically for the arrangement.
- The company behind the offer is hard to verify: no clear address, no working website, no way to check who owns it.
What to do if you are targeted
If you recognize these signs in an offer you have already accepted, stop moving money immediately and do not send or forward anything further. Continuing can turn a mistake into serious legal exposure, so contact your bank or the platform holding your wallet, explain what happened, and keep every message from the recruiter.
Before agreeing to move money on someone else's behalf, verify the company and the website behind the offer yourself rather than relying on what the recruiter sends you. Running the site through a website checker is a faster way to see whether it has already been flagged than judging it by tone or promises alone. To see entities TrustSniffer has already reviewed for similar patterns, browse the sanctions directory.
How TrustSniffer checks for this
TrustSniffer's analysis draws on the same signals described above, applied at scale. At the time of analysis, TrustSniffer has published analyses for 3,356 websites and assessed 17,128 cryptocurrency wallet addresses, the same underlying data that surfaces the sites and wallets recruiters route money through.
Checking a company's website or a wallet address before you agree to help move money gives you an independent read on the offer instead of relying on the recruiter's word. The current risk picture across everything TrustSniffer tracks is on the Risk Index.
