From Victim to Money Mule: How Fraudsters Turn Their Victims Into Conduits

EFRI Case Note. Based on an Austrian investment-fraud file (May–August 2026) and subsequent correspondence with payment and crypto-asset service providers. Published 28 October 2026. All natural persons are anonymised; identifying details concerning third parties and the family’s conduct have been deliberately reduced.

Money mules are usually pictured as recruits: students answering a “financial agent” advert, or people lending their account for a fee, alongside the familiar shell and shelf companies. A less visible category matters just as much to victim protection: fraud victims turned into mules by the same operation that defrauded them. In EFRI’s casework this is no longer an isolated pattern. We increasingly see victims of investment fraud used as money mules once their own funds are exhausted. The lever is the one thing the victim still wants: “Receive this payment, forward it, and your funds will be released.” In the file discussed here, the step from victim to conduit took one day after the family told the operation there was no money left to invest. The bank account was frozen nine days later. On the banking record, the family appeared as recipient and onward sender of third-party money; the people directing the transfers did not appear at all.

This is an operational illustration from EFRI’s work with victims. The origin of the third-party funds has not been established, and nothing in this note attributes knowledge or culpability to any member of the family.

Four stages from investment loss to account freeze

Stage 1: the investment loss (four weeks). An Austrian investor in her eighties was contacted by telephone in late May 2026 and offered a high-return cryptocurrency investment, displayed on an online trading dashboard. There was no signed contract. From the outset, the operation worked through AnyDesk remote-access software on her computer. According to her family, she can barely send an email; she did not understand that she was giving a stranger control of her screen.

The payments escalated in a familiar pattern: €3,000 and €2,000 on 26 May, €50,000 on 11 June, then €178,000 on 23 June, €109,000 on 24 June and €44,400 on 25 June. Ten payment orders totalled €386,400, €331,400 of it within three days. The family sold its entire securities portfolio and drew on a joint account to fund them.

Every order went to the same Dutch IBAN and named the victim herself as payee. It was a virtual IBAN, issued through OpenPayd on the account of a Polish crypto-asset company (see below). She never knowingly opened a wallet or account with that company or underwent identity verification there, and did not know it existed until the providers named it.

Stage 2: the release-fee loop (three weeks). On 30 June the dashboard showed a “result” of €748,510.66. Instead of a payout came a demand for €66,726 for a “source-of-funds certificate”, taxes and transaction charges, “negotiated” down to €60,000 by telephone. A 6% “service fee” and 2% “licence fee” were to be payable after the payout. On 7 July the family sold physical gold and paid the €60,000. Three days later the service fee was suddenly due in advance: €36,400. On 16 July the operation first floated a third-party “pre-financing” of part of the fees, withdrew it on a pretext, and offered a staged deal instead: pay €15,000 now, receive €460,000, settle the remaining €21,400 from it. The family borrowed the €15,000 from a private lender and paid it the same day. Own-funds losses: €461,400.

Both payments went to a second, Maltese IBAN in the victim’s name, again provided through OpenPayd, this time for a different corporate customer (see below); Verification of Payee returned a name match.

New obstacles followed in regulatory language: a licensing problem after the end of the “MiCA transition period” and an alleged review by the EU Anti-Money Laundering Authority (AMLA). On 28 July the operation sent a purported confirmation from a German savings bank of a €460,000 transfer. It was false. No money arrived.

Stage 3: the mule turn (nine days). By 20 July the family had told the operation that its resources were exhausted. On 21 July their Austrian current account received an instant credit from a private individual they did not know. The operation explained it as a pre-financing of the outstanding release fees, to be repaid to the senders once the payout arrived, and instructed the family to forward it at once to the Maltese IBAN in the victim’s name as a necessary step before release. Two further credits from the same sender followed within a week, each with the same instruction and the reference “Payment for services”. The family’s own chronology records each forwarding as a transfer “to her own account”.

On 30 July the operation announced that “the remaining €380,000” would be sent that day. Instead, two credits of €29,000 arrived from another sender the family did not know, this time with an instruction to forward to a corporate beneficiary.

Stage 4: the freeze, and the recovery scam. The same day, the Austrian bank blocked the account. The onward order was not executed; the two credits were returned on 31 July and the account was released. The scam operation promised its “finance department” would resolve everything, then stopped responding. On 5 August a caller from an “AMLA team”, who knew all names and amounts, offered help for €16,000 in “licence fees”. The family refused. None of its own funds has been recovered.

Why the recovery promise works

Recruited mules are in it for a fee. Victim-mules are in it for recovery, which makes them more compliant and less suspicious.

Sunk cost and panic. Someone who has sold gold and borrowed to chase her savings will take any route back. Third-party money presented as a bridge loan, repayable from the payout, looks rational rather than suspicious.
The account in her own name. Every destination bore the victim’s name. Verification of Payee, mandatory for payment service providers in the euro area for euro credit transfers since 9 October 2025 (Regulation (EU) 2024/886), checks name against account. It does not check who opened or controls the account, or why the payment is made.Here the positive match increased the victim’s confidenceIt also lowered the guard on the other side: to her own bank, payments naming the customer herself as payee look like transfers between her own accounts, which typically attract less scrutiny than payments to third parties.
Borrowed authority. The operation used the real end of the MiCA transitional period (1 July 2026 at the latest, Article 143(3) Regulation (EU) 2023/1114) and the new AMLA. AMLA’s FAQ states that it “will not issue fines, fees or sanctions on individual citizens” and that anyone posing as AMLA to offer recovery is attempting a scam (AMLA FAQ).

Mule recruiters also supply cover stories for bank enquiries (“an old acquaintance”, “payment for services”). These are the operation’s work product, not evidence of what the account-holder understood.

Criminal exposure: from victim to suspect

Directive (EU) 2018/1673 requires Member States to criminalise intentional money laundering (Article 3(1)) and allows them to extend liability to cases where the offender “suspected or ought to have known” of the criminal origin (Article 3(2)). The divergent use of that option matters for victim-mules:

Austria. §165 StGB covers converting or transferring criminal proceeds with the intent to conceal their origin or to assist a person involved in the criminal activity in evading the legal consequences of their conduct (paragraph 1(1)); concealing their nature, origin or movement (paragraph 1(2)); and acquiring, holding or using them knowing, when obtained, that they derive from another’s criminal activity (paragraph 2). There is no negligence variant, but conditional intent (dolus eventualis) generally suffices for paragraph 1, so a victim’s doubts can become the evidential battleground.
Germany. §261(6) StGB also penalises recklessly failing to recognise the criminal origin (Leichtfertigkeit).
Switzerland. Article 305bis of the Criminal Code requires intent, but courts accept conditional intent (Eventualvorsatz) in money-mule cases.

Where the funds are proceeds of fraud on other victims, accessory liability for that fraud may also be considered. In every case liability turns on the individual’s conduct and state of mind at the time; a transfer pattern settles neither. The risk is real: EFRI is directly aware of three cases in Germany and Switzerland in which fraud victims used to move third-party money received suspended sentences for money laundering, while the scammers were never identified.

Civil exposure: repayment claims and damages

Senders who were themselves defrauded may pursue the account-holder through whose account their money passed, because that is the one party they can identify. A lawyer has reported to EFRI an Austrian case in which an 82-year-old fraud victim, who had already lost his own money, was sued for around €80,000 by another Austrian victim; the claimant’s lawyer was funded by a legal expenses insurer. EFRI has no further details and does not know the outcome. The case shows where civil redress can end up: with whoever is within reach of a court.

Restitution claims do not depend on proof of money laundering; damages claims require unlawful and culpable conduct, loss and causation (§1295(1) ABGB). In a phishing case, the Austrian Supreme Court upheld a bank’s unjust-enrichment claim against a recipient who had forwarded the funds abroad (OGH 19 February 2009, 2 Ob 107/08m). A criminal acquittal does not automatically defeat a civil claim (OGH 4 July 2018, 7 Ob 125/18k). Neither decision determines this file, where the origin and authorisation of the incoming payments remain unresolved, and no civil proceedings have been brought against the family.

Banking consequences and the opposing case

Freezes, terminations and fraud-database entries follow the visible account-holder. They are necessary – here the freeze stopped the last onward transfer – but rarely distinguish a recruited mule from a manipulated victim, and can cut an elderly person off from basic banking.

For the victim, the consequences compound. A person who has just lost her savings, often the reserves of a lifetime, now faces a second front: a possible criminal investigation, civil claims for money that has long since gone, and the cost of lawyers to defend against both. Debanking frequently follows. Accounts are frozen or closed, fraud-database entries make it hard to open new ones, and an elderly person can be cut off from the basic banking she needs to pay rent, receive her pension or settle her bills. Each of these steps may be defensible on its own terms. Together they turn a fraud victim into a defendant, a debtor and an unbankable customer at the same time. For those affected it is a financial and psychological catastrophe, inflicted not by the fraudsters alone, but by the systems meant to protect against them.

We understand the opposing case: victim status cannot be a blanket immunity, some victims do become complicit, and a “victim exemption” would quickly be exploited by mule networks. But we do not accept the conclusion usually drawn from it – that the visible account-holder is where the inquiry should start and, too often, where it ends.

What we see in practice. In EFRI’s casework, proceedings against the visible account-holder – often the victim herself – are pursued with vigour because she is identifiable and reachable for the local law enforcement agencies, while complaints against the scammers are closed because the perpetrators “cannot be identified”.

Following the money: what the victim’s data requests revealed

Scammers are routinely said to be impossible to identify. In this file, the victim’s side traced both payment chains within about two months, using nothing more than requests for access to personal data under Article 15 GDPR (and its UK equivalent). The use of the victim’s name on the destination accounts provided a starting point: the requests sought her personal data held by the providers and information about its processing under the applicable EU or UK data-protection framework. Each response pointed to the next company in the chain.

The Dutch IBAN (€386,400). ClearBank Europe replied on 16 September 2026 that the receiving route belonged to its customer SettleGo Solutions, acting as OpenPayd, and referred any recall to the sending bank. In its final response of 30 September 2026, OpenPayd Financial Services Malta Limited stated that the payments were allocated to its corporate customer Coinmaster Sp. z o.o., a Polish crypto-asset service company; that virtual IBANs are identifiers linked to that customer’s e-money account; and that it had no direct contractual relationship with the victim. The victim’s request to Coinmaster of 2 October, followed by a reminder on 7 October, had not been answered at the time of publication; the ordinary one-month response period under Article 12(3) GDPR runs from receipt of the request. An extension of up to two further months is possible where necessary in light of the complexity or number of requests, provided the controller gives notice and reasons within the initial month. EFRI will update this note after checking receipt and any extension notice.
The Maltese IBAN (the €75,000 release-fee payments and the forwarded third-party credits). Although the payment instructions referred to OpenPayd, SettleGo Solutions Limited in the United Kingdom identified its corporate customer for this route as WeWire Technologies Inc. WeWire in turn pointed to Bitsduck, trading as Mayfair Payments Inc., and to that company’s own checks on its end customers. On 22 September 2026 Bitsduck asserted that the victim had registered personally on 5 July 2026, passed identity verification and authorised five crypto-asset orders. She disputes this.

None of these responses shows who actually controlled the accounts opened in the victim’s name. But each identifies a company whose onboarding, login or transaction records may help establish who supplied the identity data, controlled the relevant access and directed the transactions. The replies map the provider chain; they do not identify the organisers or establish that any provider knowingly assisted the fraud. They give investigators concrete leads for seeking further records through the applicable legal procedures. The account-holder on the Austrian bank statement is where the trail ends, not where it begins.

What the European framework covers

The Payment Services Regulation (provisional political agreement November 2025; compromise texts 2026) will allow payee-side PSPs to withhold and return funds on objectively justified suspicion of fraud and provides for fraud-data sharing between PSPs. These rules are prospective and focus on stopping the transaction. None addresses the account-holder who is at once fraud victim, recipient of third-party funds and onward payer. Article 18 of the Victims’ Rights Directive (2012/29/EU) requires protection from secondary and repeat victimisation. It guarantees neither reimbursement nor immunity from investigation, but it supports treating the mule turn, and the fake-AMLA approach that followed, as continued victimisation rather than as a separate matter.

EFRI’s conclusions

The operation needed four weeks to take the savings, three more to take the gold and borrowed money, and one day to start using the victim’s account for someone else’s money. Elderly victims under financial and emotional pressure are particularly vulnerable to this manipulation: they may be trusted by their banks, have clean account histories and be desperate for recovery. EFRI sees such cases on a daily basis and the number is growing over time.

First, turning victims into mules continues the original manipulation. Investigators, banks and civil courts should assess each account-holder individually and in the context of the preceding fraud: the losses, the release-fee loop, the explanations the operation gave. Treating successful manipulation as proof of culpability rewards the operation that designed it.

Second, investigations must not stop at the visible account-holder. The victim-mule is the end of the trail the operation laid, not its source. The records that lead further – who issued and controlled the destination accounts, who directed the onward transfers – sit with named companies. This file shows that the chain can be traced: with Article 15 GDPR requests, the victim’s side identified the corporate customers behind both IBANs within about two months. A victim-mule who cooperates is the best route to them.

Third, a freeze should come with a victim assessment. Interrupting the transfers is right; in this file it worked. But a freeze, a termination or a fraud-database entry should be accompanied by contact with the customer, an assessment of whether she is herself being defrauded, and referral to support, not only an exit decision.

Fourth, warnings must name the mule script. Generic “beware of scams” messaging does not reach a victim at the release-fee stage. Warnings should say plainly: no legitimate body needs you to forward other people’s money before paying out yours; money from strangers presented as a “pre-financing” of your fees may come from other fraud victims, and forwarding it can expose you to criminal investigation and civil claims; an account in your own name is no proof your money is safe; and anyone asking you to receive and forward money from strangers is using you. Where victims are convicted and sued while the organisers stay out of view, the cost of the fraud lands on those least able to bear it.

Source and conflict-of-interest note: This note draws on EFRI casework on behalf of the victim, including payment orders, provider correspondence and the family’s chronology. Statements attributed to the family reflect their account. It is not a judicial finding. The origin of the third-party funds is unresolved and is a matter for the competent authorities.