Dwight Watt - Newspaper Article #247 4/16/2014

Question: What is a money mule?


Money mules are computers used to transfer money from accounts of people who responded to a phishing or similar attack then transferred to the computer criminal who did the attack. They are just a way to divert where the money is ultimately going so it is harder to trace the money. They are machines that are working with money the way drug mules (people) transport drugs.

Basically what happens is you receive a phishing email or click on a phishing web site. Then you give the site the personal information it asks you for; such as account number, social security number, passwords, PINs, etc. Now that the attacker has your information there is a request sent to your bank account or debit or credit card to send money to the one who is running the attack.

However instead of having the money directly sent to them (could be an individual criminal or organized crime or others) they have also sent messages that contained malware to other machines that are set up to collect the money. This gets on that machine like other malware and can be prevented/removed with anti-virus/anti-spyware programs. The person who has that machine does not realize the machine has become a money mule. The first machine sends the money it just got from the account to this second machine that is a money mule.

Now the second machine sends the money to the real destination which is the criminal who is stealing the money. They have to be careful in which machines they use as money mules so it does not become obvious and also have the risk the machine they infected is cleaned by the owner before it sends the link with the money to the originator.

So basically the money mule is just a machine that helps transport the money stolen from an account to the ultimate machine or account of the criminal who is stealing the money.