Matt, why do you think it is becoming increasingly important to understand mule activity as a network rather than looking at individual accounts in isolation?
I think the important shift is to stop treating the individual account as the unit of risk. Mule activity is organised across people, accounts and institutions, so that is the level at which we increasingly need to understand it.
An individual account can look completely ordinary. It may belong to a genuine person, have years of legitimate history and only play a small role in moving fraudulent funds. Look at that account on its own and there may be very little to distinguish it. Look at the relationships around it, and the picture can change very quickly.
You start to see where money is coming from, how quickly it moves on, whether the same counterparties keep appearing and whether several apparently unrelated accounts are actually behaving as part of the same network.
This is where the breadth of the credit bureau becomes particularly valuable. Experian data covers 98% of the UK population and includes more than 913 million credit accounts and over 125 million current accounts. That gives us a deep, longitudinal view of the financial history behind people and businesses.
For fraud teams, that means being able to add much richer context about the counterparty receiving the money. Does that person or business have the financial footprint you would expect? Does the activity fit with their history? Are there changes or relationships that become significant when you look beyond the transaction itself?
That is how you start moving from detecting suspicious accounts to understanding the networks behind them.
Jonathan, what are some of the challenges financial institutions face when trying to understand the wider networks behind mule activity?
- Institutions usually only see their own piece of the network- Institutions can identify suspicious behaviour within its own customer base, but the actual criminal network may span dozens of institutions and jurisdictions.
- Data sharing is incomplete and often too slow- Firms do not always promptly identify mule accounts and recipient firms do not always respond quickly enough to notifications. There are gaps between firms participating in data-sharing initiatives and those outside of them.
- Criminal networks deliberately fragment their activity- Modern mule networks are designed to defeat traditional transaction monitoring systems. Funds may be moved through several institutions, mixed with legitimate transactions, split into many small payments or converted into cash or cryptoassets. A rule to detect a single large transaction may therefore miss a distributed network of payments.
- Institutions often optimise for stopping a payment rather than mapping the network- fraud teams are typically measured on immediate outcomes, for example – stop the payment, freeze the account. Those are important, but closing one mule account can simply displace activity elsewhere.
Matt, what makes it difficult for financial institutions to follow the movement of funds once they move beyond their own institution?
The problem is not that there is too little information. It is that the information is split across organisations.
Each institution can have a very detailed view of its own customer and the transactions happening on its systems. But the money does not stop at the edge of that institution. It can move through several accounts and providers very quickly, with each organisation seeing a different part of the journey.
That fragmentation creates opportunities for criminals because a payment that looks reasonable from one perspective can look very different when you understand what happened before it and what happens next.
This is where broader counterparty intelligence can help connect some of those dots. The credit bureau gives us context around the person or business at the other end of the payment, beyond the relationship held by any one financial institution.
Every month, more than 750 million records from over 600 UK sources add to that picture. That breadth helps us answer much more useful questions about the recipient. How established are they? Does their financial activity make sense for the person or business they appear to be? Has something changed? Does what we are seeing fit with their wider financial history?
The more context you can bring into the decision, the better chance you have of understanding the risk before the money disappears further into the network.
Jonathan, please can you outline the importance of having visibility of activity across multiple institutions when trying to build a clearer picture of a fraud case?
- It allows institutions to follow the flow of funds- without cross-institution visibility, each firm sees only a fragment of the transaction chain. Combining information makes it possible to reconstruct the end-to-end flow of funds and understand how the fraud has been executed.
- It provides a clearer understanding of the fraud typology- different institutions may observe different stages of the same fraud. Cross-institution visibility allows investigators to understand the role played by each account and distinguish between the victim, an unwitting mule and a potential controller of the network.
- It improves the speed and effectiveness of intervention- Visibility across institutions can enable firms to identify onward accounts more quickly and take coordinated action. For example- preventing onward movement, identifying additional mule accounts and securing evidence.
Matt, what do you see as the biggest challenge in scaling cross-institution visibility of mule activity without creating an unmanageable increase in alerts and false positives?
The hard part is not finding more signals. It is knowing which signals deserve action.
Fraud teams already have a huge amount of information available to them. Simply adding more data, more rules and more alerts can make the problem worse. Network intelligence has to reduce ambiguity, not add another layer of noise.
That means bringing signals together and looking at what they tell you collectively. One unusual payment might mean very little. A change in behaviour might also be perfectly legitimate. But when you combine transaction behaviour with what you know about the counterparty, their financial history and their connections to other activity, you can build a much stronger view of risk.
That is where I think the opportunity lies. Use the wider network to make the decision more precise. The measure of success is not how many more alerts we create. It is how effectively we surface the cases that genuinely deserve attention, give investigators better evidence to work with and allow legitimate customers to carry on without unnecessary friction.
Jonathan, what challenges do organisations typically encounter when trying to piece together and evidence the full journey of fraudulent funds?
- Cross-border and jurisdictional barriers- Once funds cross borders, the investigation may involve different legal systems, financial institutions, regulators, FIUs and law-enforcement agencies. Differences in information-sharing processes, response times and evidential requirements can create delays and break the continuity of an investigation.
- Commingling of legitimate and fraudulent funds- Funds may enter accounts that also receive legitimate income and make legitimate payments. This makes tracing more difficult because investigators may need to determine which portion of an account balance or onward payment relates to the original fraud.This is particularly challenging where funds are pooled, split, converted or repeatedly moved between accounts.
- Timing and preservation of evidence- Evidence can become harder to obtain over time. Accounts may be closed, devices changed, records retained for limited periods or funds moved beyond the reach of the institutions initially involved. A delay in recognising and escalating the fraud can therefore significantly reduce the ability to reconstruct the full journey.
Matt, how do you think the Failure to Prevent Fraud offence has changed the way organisations think about their fraud controls?
I think it has changed the question organisations are asking.
It is no longer enough to say, “We have a fraud control for that.” The more useful questions are: why is that the right control, what risk is it addressing, how do we know it is working and can we evidence that?
For large organisations in scope of the offence, reasonable fraud-prevention procedures are central to the defence. That naturally puts more focus on how controls are designed, governed, tested and evidenced.
For fraud teams, I think that is a positive development. It moves the conversation beyond simply detecting more fraud and towards understanding the quality of the decisions being made.
If a control intervenes in a payment, can you explain why? Can you show which signals mattered? If it does not intervene, can you understand why the activity fell within tolerance?
That kind of explainability is important because a strong fraud control should do two things well: make a good decision and leave you with a clear record of how that decision was reached.
Jonathan, how do you think the focus on fraud prevention and accountability will change the priorities of fraud teams over the next few years?
Historically, a significant proportion of fraud activity has focused on what happens after an incident: investigating the case, contacting the customer, recovering funds and closing or restricting accounts.
Over the next few years, teams are likely to be judged increasingly on whether fraud was prevented or disrupted before the customer suffered a loss. This will increase the importance of:
- earlier identification of suspicious behaviour;
- real-time transaction intervention;
- stronger scam and mule detection;
- behavioural and device intelligence;
- proactive identification of emerging typologies.
The question will increasingly become “Could we have stopped this earlier?”, rather than simply “Did we investigate this correctly?”
What session are you most looking forward to seeing at the Fraud FS Summit and why?
Matt: I’m particularly interested in Cross-Border Scams & Collaboration: Strengthening Responses to Organised Scam Networks Across Borders and Sectors. It speaks to one of the biggest challenges in fraud prevention: organised scam networks do not stop at national or sector boundaries.
A victim may be targeted in one country, send money through an institution in another and ultimately fund a network operating across several markets. Each organisation may see only one part of that activity, while the criminals benefit from the gaps between them.
That makes collaboration essential. Financial institutions, technology companies, telecoms providers and law enforcement all hold different pieces of the picture. The opportunity is to connect those insights more effectively, so the industry can identify common patterns, trace the movement of funds and disrupt networks earlier.
For me, the important point is that collaboration has to lead to better decisions, not simply more information. The right intelligence, shared at the right time, can help organisations move from responding to individual scams to understanding and disrupting the networks behind them.
Jonathan: The Panel discussion on adapting fraud risk management to keep pace with changing fraudster tactics and typologies- it will be interesting to hear other industry experts’ opinions on this as it is an ever evolving challenge, especially given some of the issues I have highlighted in this interview. I am curious to hear how people adapt their risk management to the evolving fraud landscape.
What’s the fraud trend that you think the industry is still underestimating?
Matt: I think it is the professionalisation of mule networks. We still sometimes talk about a mule as though it is a single suspicious account. Increasingly, I think it is more useful to think about mules as infrastructure.
Criminals need somewhere to receive the money, somewhere to move it and eventually somewhere to extract the value. The accounts involved might be recruited, compromised or created using increasingly convincing identities, but together they form the financial infrastructure that allows the fraud to work.
The lines between those different types of accounts are also becoming harder to draw. A genuine identity can be used for illegitimate purposes. A synthetic identity can build enough history to appear credible. A previously normal account can suddenly become part of a network.
That makes the wider context much more important. Instead of trying to write another rule for every new mule typology, we need to understand how the accounts connect, how the money moves and whether the financial history makes sense.
If we can identify the infrastructure as well as the fraudulent payment, we have a much better opportunity to disrupt the network rather than simply stop one transaction.
Jonathan: Fraudsters increasingly do not just want to steal money from a customer. They want access to a functioning financial identity or account infrastructure that can be used repeatedly. A compromised account can provide credibility, transaction history, an established payment profile and a route into the wider financial system.
That is why I think account takeover and account compromise will become increasingly important as an enabling trend. The UK government’s current work on unauthorised fraud highlights the growing use of compromised credentials, social engineering, deepfakes and AI to bypass authentication at scale.
About Matt Fitzgerald
Matthew Fitzgerald is a seasoned product leader with 15+ years turning complex data, AI, and decisioning capabilities into products that deliver clear business value across fraud, data enrichment, digital identity, and decision intelligence.
He has led product and data strategy for global risk technology providers and high-growth SaaS companies, building cross-functional teams and portfolios spanning enrichment, prospecting, and customer data management.
Today, as Director of Product, Fraud at Experian, he leads the strategy, roadmap, and delivery of market-leading fraud prevention solutions for regulated industries, turning complex risk and identity signals into clear, actionable outcomes that reduce losses, protect customers, and enable safer, more frictionless digital experiences.
About Jonathan Giannasi
Jonathan Giannasi is a senior regulatory compliance and financial crime leader with over a decade of experience managing risk for global financial institutions and fintechs.
Financial Crime Leadership: As a former Group MLRO and Head of Compliance, he has held primary accountability for AML, CTF, and Fraud frameworks across multiple jurisdictions.
Regulatory Expert: He specialises in navigating complex global regulatory landscapes, leading jurisdictional expansions and licensing across the UK, EU, Dubai, and Australia.
Pre-Event insights from Experian & Resistant AI – Knowledge Partners of the Fraud FS Summit
The Fraud FS Summit brings together senior fraud and financial crime professionals for a full day of presentations, panel discussions, interactive roundtables and networking; inclusive of 2 course lunch and drinks reception with canapés. Join the UK’s leading fraud conference in London, view the latest agenda for the Fraud FS Summit here.
