Incognia Finds 81% of Financial Institutions Report Rising Mule Account Handovers
Financial institutions are reporting a sharp rise in mule accounts that are opened legitimately and later handed over to other operators, according to research from cross-device risk intelligence provider Incognia.
Incognia’s 2026 State of Mule Account Handovers report surveyed 511 fraud prevention, risk management and AML professionals at financial institutions in the United States, United Kingdom, Germany, France and Spain. The 20-question survey was conducted between January 28 and February 10, 2026 by Datalily via Centiment on Incognia’s behalf.
Most institutions say mule account handovers are increasing
According to the report, 81% of respondents said mule account handovers had increased during the previous 12 months, including 30% reporting a significant increase. Incognia describes an account handover as a case in which an account opened by a genuine customer using valid identity information later shifts to another person or criminal operator.
The cross-border dimension is also material. Thirty percent of respondents said their institution had confirmed cases in which account control or usage shifted outside its primary operating country, while another 34% strongly suspected cross-border handovers based on behavioural, device or transaction signals.
Incognia’s research also indicates that many institutions are detecting the activity late. The company says 83% detect mule account handovers reactively — after early suspicious behaviour appears, once funds are already moving, after funds have exited the institution, or following complaints or external alerts. Only 16% catch handovers before suspicious transactions occur.
More than half of respondents, 53%, said detecting this form of mule activity is harder than most other fraud types. The same proportion said mule-account handovers create a greater false-positive risk than other fraud categories.
AML and financial-crime implications
The findings are relevant to AML controls because these accounts can pass normal KYC and customer identification checks at onboarding before being repurposed to receive or transfer criminal proceeds. Incognia says 51% of institutions respond to suspected handovers by temporarily restricting account or payment activity, while 44% use enhanced transaction or behavioural monitoring, 41% use step-up authentication or re-verification and 41% file regulatory or compliance reports such as suspicious activity reports.
Incognia also reported that 78% of respondents now regard improved mule-account-handover detection as either a high or top-tier priority for the next 12 months. Planned investment areas include AI and machine learning, better integration of fraud, AML and payments data, network analysis, device-integrity checks and location-behaviour analysis.
Separately, in a September 2 update on the industrialisation of financial crime, Incognia linked these patterns to cross-border scam networks operating clusters of devices and accounts from concentrated physical locations. The company said such structures can allow legitimate-looking accounts to become part of organised fraud operations after standard onboarding checks have already been completed.
For AML and fraud teams, the findings reinforce a growing control gap between point-in-time identity verification and post-onboarding monitoring: detecting who opened an account is increasingly different from detecting who is actually operating it later.
