The rise of money mules and APPF in South Africa: How financial institutions can fight back

Combatting financial crime.

---

Criminal groups in South Africa increasingly commit crimes such as authorised push payment fraud (APPF), identity theft, phishing and digital scams. The South African Banking Risk Information Centre (SABRIC) reports that South Africans lost nearly R3.3 billion in 2023 alone due to financial crime, with growing threats from cyber crime, online fraud and the use of generative AI for fraudulent activities. The same report found:

• Digital banking fraud incidents increased by 45% and associated financial losses rose by 47%.
• Card not present (CNP) fraud rose 19% as a share of total card fraud losses.
• Banking app fraud accounted for 60% of digital banking crimes, an 89% increase.

However, the cycle of crime doesn’t stop there. Criminals route fraudulently obtained funds through legitimate banking systems to launder illicit profits from digital crimes, drug trafficking, smuggling, terrorism and other violent crimes, before reinvesting it into such activities.

Enter money mules: an integral part of the money laundering and fraud ecosystem in South Africa and globally.

Money mules play a crucial role in money laundering. Money mule accounts receive and transfer illegally obtained funds on behalf of criminals, obscuring the money’s illicit origins.

Money mule accounts fall into three categories:

• Compromised mules (third-party fraud): Legitimate customer accounts compromised through phishing, identity theft and other methods.
• Recruited mules (first-party fraud): Accounts opened deliberately by individuals who fraudsters have recruited. Recruits may or may not be aware of the illegal nature of the activities in which they are involved.
• Fake mules (new account fraud): Accounts created by fraudsters using stolen or synthetic identity data, including AI-generated fake identities.

As the cost of living and unemployment remain high throughout South Africa, criminals increasingly recruit people in desperate need of funds to become money mules.

Financial institutions (FIs) in South Africa must consider the regulatory context around money mules and money laundering, as well as associated financial losses, to effectively combat financial crime in their systems.

In February 2023, South Africa was placed on the Financial Action Task Force’s (FATF) greylist due to weaknesses in systems to combat money laundering, terrorist financing, proliferation financing and financial crime. While significant progress has since been made – including proposed legislation to strengthen the country’s Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) system and a potential exit from the greylist in October of 2025 – FIs and banks in South Africa must seize the initiative to stop illicit funds and accounts.

As real-time payments become more widespread throughout the country, real-time prevention strategies are more essential than ever. Money mules can receive and send fraudulently obtained funds almost instantly. It’s critical to detect and stop illicit funds and mules in real-time by blocking suspicious transfers before they exit financial systems, shutting down existing mule accounts and thwarting attempts to onboard mules.

Reactive strategies fall short by allowing illicit funds to flow unabated, leading to financial losses and potential regulatory penalties. This real-time problem demands immediate and effective real-time solutions.

FIs in South Africa should adopt the following strategies to effectively combat rising threats from APPF, money mules and other financial crimes:

• Utilise real-time fraud and money mule detection technology and embrace emerging AI innovations – such as Lynx’s Daily Adaptive Models for Fraud Prevention and Mule Detection – which update daily to stay ahead of the latest criminal tactics, emerging payment channels and shifting customer behaviours.
• Implement enhanced account opening verification and integrate identity verification (IDV) and know your customer (KYC) processes to prevent criminals from using synthetic identities to open and use fake mule accounts.
• Develop partnerships with peer organisations across the financial ecosystem to share insights, best practices and case studies.
• Prioritise customer education and share reliable resources, such as SABRIC’s materials, to help customers recognise and report fraudulent and money mule activities.

By taking a proactive real-time approach, FIs in South Africa can stop criminal activities in their systems and the resulting financial losses, protect their customers, meet evolving AML compliance requirements and ensure cohesive strategies benefiting fraud prevention, AML and money mule detection.