Money mule job offers explained by Ilia Nikolaevich Zavialov: how a remote role becomes a criminal one

The advertisement describes a real sounding role. Remote payments processing, financial operations assistant, refund handler, regional agent for a foreign company entering the market. The salary is modest enough to be credible and the hours are light.

The interview is short and conducted over a messaging application. There is a contract, sometimes a company registration number, occasionally a website with staff photographs. None of that costs anything to produce.

The work begins with something harmless. Fill in a form, confirm a delivery, verify an account. Then the first task involving money arrives, framed as a test payment or an onboarding exercise.

The task is always the same underneath. Money arrives in your account, you keep a percentage, and you send the rest onward by the method they specify, frequently a crypto exchange or a kiosk.

Nothing in the process asks the person to lie, steal or deceive anybody. They receive a transfer and make a transfer, which are two things they do in ordinary life every week.

The explanations offered are plausible on their face. Currency controls, a foreign company without a local bank account, a payment gateway under review, a client who prefers to settle in crypto. Each is a real situation somewhere.

The commission structure reinforces it. Being paid a percentage feels like commercial work rather than a favor, and it gives the arrangement the shape of employment rather than complicity.

By the time the first suspicion arrives, there is a history of completed tasks and a relationship with a person who has been polite for weeks. Withdrawing at that point feels like accusing somebody, and most people delay.

The recruitment also selects for people who cannot easily walk away. Students, new arrivals in a country, people between jobs and people supporting a household on an uncertain income are approached far more often, because the cost of refusing a paid role is higher for them and the willingness to overlook an odd instruction rises with it.

The funds arriving are somebody else's loss. They come from an investment scheme, a fake invoice paid by a company, a compromised business email account, or an older person who was told to move their savings somewhere safe.

The purpose of the account in the middle is distance. A direct transfer from the victim to the operation is traceable in one step. A transfer that passes through an ordinary person with a real name, a real address and a genuine banking history breaks that line.

Conversion into crypto usually happens at the end of the chain, because the point of the arrangement is to reach a form that cannot be recalled. The person in the middle is frequently the one instructed to perform that conversion.

This is organized work rather than opportunism. In one three month international operation, 2,469 money mules were arrested and 17.5 million euros were prevented from being laundered.

The bank freezes the account first, usually without warning and usually before anybody explains why. Access to salary, rent and direct debits goes with it.

The account closure follows, and the record of it travels. Opening an account elsewhere becomes difficult, and the difficulty lasts for years rather than months.

Then the legal position. Moving criminal proceeds is an offense in most jurisdictions regardless of whether the person knew, and not knowing is a defense that has to be argued rather than assumed.

The victim whose money passed through the account sees one name on the transfer, and it is not the name of whoever organized it. Civil claims land on the visible person.

The organisers are unaffected by all of this. They lose an account, which was always a consumable, and they recruit another one the same week.

No named employer with a checkable registration, or a name that belongs to a real company with no knowledge of the vacancy. A search of the company name alongside the word vacancy frequently returns a warning somebody else already posted.

Payment described as a percentage of transactions handled rather than a salary. Legitimate payments work is paid for the time it takes, not for the volume that passes through.

A requirement to use your own personal bank account, card or crypto wallet for company money. No genuine employer routes its funds through a new employee's personal account, because its own accounting would not survive it.

Recruitment and interviewing conducted entirely inside a messaging application, with no video call, no office address that exists and no contract that names a supervisor.

An advertisement that names no specific duties. Genuine vacancies describe the work in terms of systems, reporting lines and deliverables, because a real employer has to attract somebody able to do it. A description built entirely from adjectives about flexibility and earnings is describing the arrangement rather than the job.

Speed that does not match the role. An offer made without a proper interview, or a request to start today, exists because the account is needed for a specific transfer that is already in motion.

Instructions about wording. Being told what to say to the bank if it calls, or being asked to describe an incoming transfer as a gift or a loan from a relative, is the arrangement admitting what it is.

Conversion requirements. A request to withdraw cash and deposit it at a crypto machine, or to buy crypto and send it to an address supplied by the employer, has no legitimate business form.

Escalation. The first amount is small and the second is much larger, because the small one was a test of both the account and the person.

Stop immediately and do not send anything further, including money already received. Passing it on is the act that does the damage, and holding it is the position that is easiest to explain.

Contact the bank yourself before the bank contacts you. Somebody who reports the situation first is in a different category from somebody discovered by a monitoring system, both legally and practically.

Keep everything: the advertisement, the contract, the full message history, the names, the account details supplied and every instruction received. This material is the only evidence that the person was recruited rather than involved.

Report to the police, and accept that the money already passed on is unlikely to be recoverable. The purpose of reporting at this stage is the person's own position rather than restitution.

Expect an approach from somebody offering to make the problem go away for a fee. People in exactly this situation are a known target for that second offer.

I did not know the money was stolen. Does that protect me?

Not automatically. In most jurisdictions moving criminal proceeds is an offense whether or not the person knew, and lack of knowledge is something that has to be argued with evidence. The advertisement, the contract and the message history are that evidence.

Is it really that common?

Employment fraud produced 24,688 complaints and 362,934,762 dollars of reported losses in 2025, and complaints have risen every year from 15,443 in 2023. One three month international operation alone led to 2,469 arrests of money mules.

Why would they use me instead of moving it themselves?

Distance. A direct transfer is traceable in a single step. A transfer through a real person with a genuine banking history breaks the line, and the visible name on the transfer is yours rather than theirs.

The company has a website and a registration number. Does that mean anything?

Very little on its own. Both are cheap to produce, and registration numbers belonging to real companies are frequently reused without their knowledge. Contacting the company through details you found yourself settles it.

They asked me to buy crypto with the money. Is that normal for any job?

No. There is no legitimate employment arrangement in which a new employee receives company funds personally and converts them into crypto. That instruction is the purpose of the whole arrangement.

I already forwarded one payment. What should I do first?

Stop, keep anything still in the account rather than sending it, and contact the bank yourself before it contacts you. Reporting first puts the person in a different position from being found by a monitoring system.