Community banks have built strong fraud-prevention practices for customers sending money out. Tellers are trained to spot unusual wires. Verification thresholds catch large transfers. Conversations at the counter give customers who have been groomed by fraudsters the chance to reconsider their transactions. This work has long put community banks on the front lines of fraud prevention, but it captures only one side of the problem.

The other side is inbound activity. Investment fraud, romance scams and online extortion schemes all produce money that must land somewhere before it can move on. Sometimes, it lands at community banks.

A fraud network recruits a money mule, someone to move money on their behalf, either knowingly or unknowingly, through a job posting, a relationship or coercion. The mule opens an account, presenting documentation that looks routine. The account receives inbound transfers from victims at other institutions, sent at the fraudster’s direction. Within days or even hours, the funds move, often to cryptocurrency exchanges or other accounts in a layered chain. By the time the originating bank or law enforcement traces the funds back, the money has typically moved on.

Account opening can move faster at smaller banks than at large institutions, and fraud networks have noticed. Inbound activity runs against a smaller volume base at smaller institutions, which cuts both ways for detection. Much fraud detection technology was built around outbound patterns.

Federal authorities have been documenting the pattern. FinCEN issued an advisory in August 2025 describing how recruited money mules open accounts across multiple institutions to receive and move illicit proceeds. The agency issued additional guidance in September 2025 covering similar schemes targeting individual victims, where mules typically take a percentage fee for moving funds. The Department of Justice’s annual Money Mule Initiative has acted against thousands of mules in each recent cycle.

A few operational priorities deserve attention. Account-opening reviews should weigh indicators federal authorities have flagged, including inconsistent occupation information, addresses that match those of other recently opened accounts and documentation that suggests third-party preparation. Transaction monitoring should give inbound activity the same level of scrutiny as outbound activity. Incoming wires that are quickly followed by transfers to cryptocurrency exchanges or money services businesses are the clearest indicator of a mule account in use.

Community banks should consider building or expanding an active 314(b) practice, one of the strongest tools available, as information sharing lets institutions coordinate directly when suspicious patterns appear. Filings should name the suspected mule, describe the inbound and outbound pattern and reference the relevant typology source so law enforcement has what it needs to act.

Community banks that embed inbound detection into their fraud posture make it harder for these schemes to run. The attention to individual accounts that defines community banking is exactly what this work requires.