Skip to content

Scam and money mule detection

Catch authorised push payment (APP) scams and the mule accounts behind them, with a decision on each payment in real time so your system can stop it before the money leaves.

How it works

Trusted by 130+ financial institutions across 30 jurisdictions

Money mule detection means spotting the accounts that take in stolen money and pass it on. The account usually belongs to a real customer coerced into letting money pass through.

The signs are payments arriving from several unrelated senders, or into a new or dormant account, then leaving within hours. Salv checks around 96 million transactions a month against them.

Why APP scams outrun detection

A customer is rarely defrauded in a single payment. They're talked into a series of them, and they keep sending until they realise what's happening.

By the time an analyst opens the alert, the money has moved on. You refund the customer and handle the complaint. But prevention is now the expectation: you have to stop the payment, not just explain it afterwards.

How money mule detection works on your own payment data

  1. 01Payments going outCatch a dormant customer who suddenly starts paying out, or several of your customers paying the same new counterparty within days. You can also review first payments to a given institution or country before they're authorised.
  2. 02Payments coming inSpot money arriving from many unrelated senders into one account, or coming in and going straight back out. The giveaway is how fast it leaves and how many counterparties it goes to.
  3. 03The scenarios behind itStart from a library covering investment scams, job scams, impersonation scams, money mules and structuring, or add your own. Watch payments, customers and counterparties together, tuned to your own segments.
  4. 04When an alert firesIt names the scenario behind it and can list the payments that contributed: counterparty, accounts, amount, status. Alerts on the same counterparty can be grouped, so a receiving account reads as one pattern. A customer whose risk score is climbing moves into tighter scenarios automatically.

See it on your own data

Real-time payment fraud prevention, before the money leaves

Stop a scam payment while it's still in flight. Your payment system asks for a real-time check, and the answer comes back before authorisation, so your system can hold or reject the payment on it.

Real-time checks look back up to one month. Longer patterns run after the event.

Combine fraud and screening signals on the same payment. You can reject only when screening is clear, or act only when a behaviour pattern and a screening hit land together.

Your team sets the conditions that decide the action, so the logic stays where they can change it, and held payments are released or rejected as the alert is resolved.

When the money has already gone

If the payment has already left, take it straight to the receiving bank's fraud team with a structured request through Salv Bridge, if that bank is in the network. Freezing, the joint case and getting funds back are covered in cross-bank fraud recovery.

Fraud tools that work together

  • Monitoring
    Scenarios you can read, test on your own data and change yourself. Watch payments, customers and counterparties, for AML and fraud.
  • Intelligence sharing
    The secure network where fraud, AML and sanctions teams settle a case directly with other institutions. Send structured requests, answered in minutes, under rules your network agrees.
  • Alert and case management
    When an investigation grows, it becomes a case. Bring the related alerts, customers and payments together and work it from one place as a team.
Trust and security What we hold, where your data sits, and how every decision is recorded.
Explore

FAQs

By the movement, not the identity. Money arrives from several senders with no relationship to each other, into an account that is new or has been quiet, and leaves again within hours across a handful of counterparties. Monitoring scenarios check each payment against those patterns as it happens.

Senders who have no connection to each other or to the account holder. Money in and straight back out. A dormant account that suddenly becomes busy. Onward payments split across several counterparties. The holder is often a real customer who was recruited, not a fake identity that slipped through onboarding.

It can, if the check happens before authorisation. When the payment is sent for a real-time check, the scenario's answer returns in the response and the bank's own system holds or rejects the payment on that answer.

The scenario library covers investment scams, job scams, impersonation scams, money mules and structuring. It detects them from how the money moves rather than from the story the customer was told, and you can add your own scenarios for what you are seeing.