Identity mule

A real person who lends their identity so that criminals can control an account in their name.

The person opens or verifies an account with their own documents and face, then hands over control, often for a payment.

A real individual who completes identity verification with their own genuine documents and selfie, and then gives control of the resulting account to someone else. This is a form of second-party fraud, in which a person with a real connection to the account helps another party misuse it.

The pattern usually looks like this:

1. A criminal recruits a person, who may be paid, pressured, or tricked by a fake job offer.
2. The person opens an account or completes verification using their real ID and a live selfie.
3. They hand over the login, the device, or remote access, or sell the verified account.
4. The criminal uses the account to move money or commit fraud, and the real person's verification stays attached to it.

Identity mules are hard to catch at onboarding because everything about the check is genuine:

• The document is real, so document verification passes.
• The face is real and live, so liveness and face match pass.
• No attack is injected, so camera integrity checks pass.

Detection therefore shifts to what happens after onboarding:

• Behavior changes, such as a new device or location right after the account opens.
• Linked accounts, such as several accounts that share devices or contact details.
• Unusual activity, such as money arriving and leaving quickly.

An identity mule sits next to terms that are easy to mix up:

• Money mule moves illicit money through an account, while an identity mule lends the identity or the verified account itself. The two often overlap.
• Second-party fraud is the broader category of fraud involving a cooperating insider.
• Synthetic identity fraud builds an identity that does not exist, while a mule uses one that does.