Scammernomics: How Banks Fight Fraud by Attacking Money Mule Economics

Banks fight fraud by targeting the money mule networks that criminals rely on to move and launder stolen funds. Rather than only blocking fraudulent transactions, they monitor account behaviour for mule patterns, freeze suspicious accounts, disrupt cash out points, and raise the cost and risk of recruiting mules, attacking the criminal business model at its weakest economic link.

1. The wrong metaphor

Every serious conversation about fraud eventually arrives at the same unhelpful metaphor, which is that of the fortress. We are told that the criminals are outside and the customers are inside, that the job of a bank is to build the wall higher every year, and that the measure of success is how few people manage to climb over it. It is a comforting way to think about the problem because it is simple, it is visual, and it turns an enormously complex adversarial system into a straightforward engineering exercise. It is also, in my experience, one of the least useful ways to understand what is actually happening to money in South Africa, because the people we are up against are not laying siege to anything. They are running a business, and businesses do not respond to walls. They respond to margins.

I should be precise about the claim I am making here, because it is easy to overstate and a security practitioner would be right to object if I did. We have not stopped building conventional defences and we have no intention of doing so, since malware detection, behavioural analytics, graph analytics, anomaly models and beneficiary scoring are all still running and all still necessary. What changed is not the presence of the wall but the question we ask of everything we build, because we stopped assuming that a higher wall was sufficient and stopped measuring our success by its height. The question we now ask first of any control is what it does to the attacker’s economics, and that single change of lens has altered which controls we prioritise, how we design them and, most of all, how we know whether they are working.

Once you accept that framing, the entire strategic picture changes. A syndicate is not a shadowy adversary testing our defences out of malice; it is a small enterprise with a cost base, a working capital cycle, a supply chain, a labour problem and a return on investment that has to justify the effort. It has acquisition costs, it has operational overheads, it has staff who need to be paid and managed and occasionally distrusted, and it has a payback period that determines whether the whole thing is worth doing at all. If that is true, then the most effective thing a bank can do is not simply to make the wall taller, because the wall on its own only ever changes where they attack. The most effective thing a bank can do is to make the business unprofitable. I have started calling this scammernomics, and it has quietly become the organising idea behind a great deal of what we build.

2. The unit economics of a mule account

To see why this matters, you have to look closely at the mule account, which for the authorised payment scams that move money through the banking system is one of the most important assets in the entire fraud supply chain. Most of those scams, whether a given one begins as a romance approach, a fake investment in forestry and carbon credits, a Marketplace deposit scam or a phone call from somebody claiming to be from the fraud department, end in the same place. The victim is persuaded to move money from an account they control into an account the criminal controls, and that receiving account is the mule. Everything upstream of it, all the social engineering and the spoofed numbers and the carefully rehearsed urgency, exists only to deliver money into that one container.

The cleanest way to think about it is to borrow the language of online retail, because the parallel is uncomfortably exact. The scam is the sales funnel and the mule account is the checkout. The syndicate runs lead generation, it runs persuasion, it runs conversion, and none of that produces a cent of revenue until the payment infrastructure at the end of the funnel actually settles. Everything they do upstream is marketing spend against a checkout they do not truly control and whose continued reliability they cannot guarantee, which is precisely the structural weakness in the model and precisely where a bank has leverage.

What is often missed is how cheap that checkout is to acquire and how expensive everything upstream of it turns out to be. In our experience a scammer can acquire a mule account for somewhere around five hundred rand, and it is worth being clear about what that five hundred rand actually buys. The typical route is not a sophisticated forgery or a compromised onboarding process at all. It is a recruited account holder, a real person who opens a perfectly legitimate account in their own name and then hands the credentials to the scammer in exchange for cash, often alongside a plausible story about processing payments for an overseas employer. That person may well not understand the downstream criminal purpose their account will serve, and questions of intent and culpability are a matter for the courts rather than for me, but from the scammer’s point of view the outcome is entirely straightforward. They have acquired disposable banking infrastructure for roughly the price of a decent dinner.

Once you internalise that figure, the conventional scorecard starts to look rather thin. Blocking three hundred empty mule accounts sounds like a triumph until you price it honestly, at which point you realise you have inflicted a loss of perhaps a hundred and fifty thousand rand on an operation that turns over considerably more than that, spread across three hundred separate assets that were individually almost worthless to begin with. It is a rounding error in their cost of goods sold. Preventing forty thousand rand of victim funds from being extracted, by contrast, denies the syndicate proceeds equivalent to the acquisition cost of roughly eighty replacement mule accounts, and it does so at the exact moment they believed all of that upstream effort had converted into revenue.

The scarce resource in this business, in other words, is not the bank account at all. It is a successfully converted victim, because the criminal has to identify a target, engage them, build enough trust to survive scrutiny, overcome whatever doubt and family interference arises along the way, and then move that person all the way through to an authorised payment. That process consumes days or weeks of skilled labour and fails far more often than it succeeds, and it is the genuinely expensive input in the entire model, because mule accounts are cheap and endlessly replaceable in a way that a successfully converted victim never is. Any control worth building should therefore be aimed at the expensive input rather than the cheap one, and the objective is not merely to kill mule accounts but to destroy the economics that make them worth acquiring in the first place.

3. Why an instant freeze subsidises the criminal

Consider the sequence from the other side of the table. The syndicate acquires an account at some cost, and before they risk a real operation on it they do what any competent operator would do, which is to test the inventory. They push through a small transfer and they watch what happens. If the money moves, the account is live and goes into the working pool. If the transfer bounces or the account is visibly frozen, they have learned within seconds that this particular asset is dead, and they discard it and move to the next one in the queue.

The critical thing about that interaction is that the only cost they have incurred is the acquisition cost of one account, and they have incurred it with perfect information and almost no delay. We have told them, instantly and for free, exactly which of their assets are compromised. We have effectively provided them with quality assurance on their own supply chain, and we have done it at the cheapest possible moment for them, which is before they have invested anything of real value. All the expensive work of a scam, the weeks of building trust with a victim, the fabricated documents, the emotional labour of the persuasion itself, still lies ahead of them and remains entirely intact. They lose an account. They do not lose an operation. The game of cat and mouse has a predictable rhythm, and predictability, for a business, is close to the same thing as safety.

That leads to the single sentence I would keep if I had to discard everything else in this piece, along with its inverse, because between them they contain the whole argument.

A control that fails the criminal cheaply and quickly is a control that trains them.

A control that fails them expensively, late and unpredictably is a control that prices them out.

Look at the conventional freeze through that pair of statements and you realise it is not really a deterrent at all. It is an eviction, and the tenant has other addresses.

4. Delayed failure, and the Ghost Stop

So we changed where in that sequence the failure happens. What follows is one mechanism among several that we have deployed to break the economics of fraud, and I have chosen it here because it illustrates the principle more vividly than the others rather than because it does the heaviest lifting.

The design intent, stated at the level that matters, is this. Rather than revealing immediately that a mule account has been identified, the control is built so that the observable failure is delayed until considerably more criminal effort and capital have been committed, while ensuring that the victim’s funds cannot ultimately be extracted. We call it the Ghost Stop, because the account is dead in every way that counts while continuing to look ordinary to the person holding the credentials. The syndicate’s own inventory testing therefore stops telling them anything useful, and the moment of discovery is moved from the cheapest point in their investment cycle to the most expensive one.

I want to be careful about how that is read, because a mechanism like this can be flattened into a headline it does not deserve. The point is not that a bank sits back and watches money it knows to be stolen flow towards a criminal, and no victim is worse off for the design. The entire purpose of the control is to ensure the funds cannot leave, so that they can be secured and returned rather than converted, layered and lost within minutes as they otherwise would be. What changes is not whether the money is protected. What changes is when the criminal finds out, and the answer is late enough that the discovery is expensive.

There is a byproduct of that design which matters a great deal more to the person on the other end of the phone than any of the economics I have set out so far, and it deserves saying plainly rather than leaving it as an implication. Money that is still sitting in an account at the moment the criminal discovers he cannot move it is money that can be given back. A payment that is converted, layered and dispersed across a chain of accounts within minutes is, in every practical sense, gone, and everything that follows is an investigation, a report and an apology to somebody whose savings are not coming home. A payment that is immobilised where it landed is a recovery, and a recovery is a phone call telling a person who had already accepted the loss that their money is being returned to them. So the same design decision does two things at once, and they are not in tension. It moves the criminal’s discovery to the most expensive possible point in his investment cycle, and it holds the funds in a place from which they can be returned to the client rather than watching them dissolve into a laundering chain we will never follow to the end.

The mechanism itself is conceptually simple, which is precisely why I find it interesting. There is no new cryptography in it and no exotic model. What has changed is the timing, and in this business the timing is the entire weapon.

5. The landmine selfie

The second mechanism worth describing does the same economic work from an entirely different direction, and it begins with an observation about what a mule account actually is once it has changed hands. The syndicate has not really bought an account. What they have bought is a set of credentials, and the value of those credentials rests entirely on an assumption, which is that nobody will ever check again whether the person using the account is the person who opened it.

We check. Capitec periodically captures a selfie at the point of transacting in order to bind the human being holding the phone to the human being who sat through the onboarding, and it is a quietly powerful control precisely because it is not aimed at any individual payment. It is aimed at the transferability of banking access itself, which is the thing the entire mule market depends on being able to trade.

The interesting design problem arrives with business banking, because a business that makes dozens of payments in a working day cannot reasonably be asked for a selfie on every one of them, and a control that imposes that much friction per payment is a control that will be worked around, resented or switched off. So we preserved the substance of it and changed the shape. Business clients register the browsers they use regularly, confirming each one with a selfie in the Capitec app, and thereafter we request the selfie again periodically and at random, driven by a range of signals rather than by a schedule. The ordinary rhythm of a working day is left alone. The binding between the account and the person who opened it is not.

What that does to a criminal is more interesting than what it does to a client. A step up that happens every time is a cost, and any competent syndicate will simply price it in and route around it. A step up that can happen at any time but does not happen every time is something else entirely, because there is no rhythm in it to learn, no threshold to stay beneath and no sequence to replay. It is deliberately difficult to predict or to game reliably, which means the syndicate can never establish that an account is safely theirs. They can only establish that it has not been challenged yet.

Follow that through to the moment that matters and the consequence is stark. It is entirely possible for a substantial sum to land in a mule account and to be immovable, because moving it requires producing the actual human being who opened it, in front of a camera, willing to cooperate. That is a materially different problem from any technical control, since it cannot be solved with better malware, a purchased credential or a more convincing script. It has to be solved with a person, and people are the most expensive, least reliable and most legally exposed component in any criminal operation. It is also, and this is not incidental, the state in which stolen money is most easily recovered, because funds that are stranded in an account nobody can operate are funds that are still there to be traced, secured and sent back to the client they were taken from.

The economic effect is therefore to convert what the syndicate thought was a purchase into an ongoing dependency. A recruited account holder who sold access for five hundred rand and considered the transaction closed must now remain reachable, cooperative and available indefinitely, which turns a clean one off cost into an open ended labour and coercion problem. It also materially degrades the second hand value of the account, because one that cannot be reliably operated by whoever happens to hold the credentials is a poor thing to sell on, and a mule account with impaired resale value is worth a fraction of what the syndicate underwrote when they bought it. The same control reduces the value of stolen credentials in account takeover scenarios for the same reason, since access to an account you cannot prove you own gets you a good deal less than it used to.

I am comfortable describing this one publicly, incidentally, in a way I would not be with every control we run, because the deterrent depends on the opposite condition to secrecy. It works best when the people buying accounts know perfectly well that the check exists and still cannot predict when it will arrive. Uncertainty is the weapon again, exactly as it was in the previous section, and uncertainty is one of the very few weapons that becomes stronger rather than weaker when you talk about it.

6. The criminal profit and loss account

Once you start thinking this way it becomes natural to write the other side’s income statement down, and I would encourage any fraud team to do so explicitly, because it turns a collection of instincts into something you can argue about in a meeting.

Criminal profit equals successful fraud proceeds, less victim acquisition cost, less mule acquisition cost, less the cost of failed attempts, less infrastructure replacement, less operational effort.

Traditional fraud prevention tends to obsess over the first term, since stopping a transaction reduces proceeds and that is what a blocked payment feels like it achieves. Scammernomics attacks every term in the equation, and it does so along two axes that are worth separating because they call for entirely different controls.

The first axis is revenue suppression, which means interrupting successful social engineering, reducing conversion, stopping high value transactions before they leave and warning a client at the precise moment they are being manipulated. The second axis is cost inflation, which means destroying the lifetime value of a mule account, forcing constant infrastructure replacement, wasting criminal labour on operations that were dead before they began, raising the rate of failed attempts and, above all, injecting uncertainty into a business that depends on knowing which of its assets work. Most institutions are reasonably competent on the first axis and have barely begun on the second, which is unfortunate, because the second is where the durable damage is done.

Run a single Ghost Stop through that equation and the effect compounds in several directions at once. The account acquisition cost is written off exactly as it was before, so nothing is gained there, but now the entire operational investment behind the scam is written off with it, and that investment is enormous relative to the price of an account. Weeks of manipulation, the working capital tied up in the operation, the opportunity cost of the operators who ran it and the scarce supply of successfully converted victims all evaporate together. It does not destroy one asset. It destroys a completed sales cycle at the moment of revenue recognition, which is the most expensive possible moment for any business to lose a deal.

There is a term on the other side of that ledger which does not appear in the criminal’s income statement at all, and it is the one I would put first if I were explaining this strategy to a client rather than to a fraud team, because proceeds that never leave the mule account are not simply proceeds the syndicate failed to earn. They are funds that are still recoverable, and a strategy built on stranding money in accounts the criminal cannot operate turns out to be, almost incidentally, the most reliable mechanism we have for putting stolen money back where it came from. Every design decision in this piece was made to attack the economics of the other side, and the byproduct of all of them, taken together, is that a great deal of money which would historically have been written off as gone is instead returned to the people it was taken from.

The second order effect is more corrosive still, and it is the part I did not fully anticipate. Once a syndicate knows this is happening but cannot tell which accounts are affected, every account in the pool becomes suspect, because a successful test proves nothing whatsoever. That uncertainty propagates straight into the syndicate’s own internal trust structures, since when an operation fails at the payday the obvious explanation is not always a bank countermeasure. Sometimes it looks a great deal like the recruiter sold them a bad account, or the operator skimmed the payload, or somebody informed. Organisations built entirely on coercion and mutual suspicion do not absorb that kind of ambiguity gracefully. We did not set out to manufacture paranoia inside criminal networks, but it turns out to be a remarkably effective byproduct, and it costs us nothing to produce.

The rational response, once the expected value of running an operation against a particular institution goes negative, is not to try harder. It is to go somewhere else, and that is exactly what we have watched happen. It is worth being honest that this is displacement rather than elimination, because the industry problem does not go away until every bank makes the same trade unattractive, which is an argument for far more sharing between institutions than we currently manage.

7. None of this is a new idea, and the research says so

One of the more reassuring things about scammernomics is that we did not invent it in a workshop. The academic literature arrived at the same conclusion more than a decade ago, with considerably better evidence than any single bank can generate on its own, and anybody sitting where I sit would be foolish not to read it.

The clearest precedent is a study published at the IEEE Symposium on Security and Privacy in 2011, in which Levchenko and a large group of colleagues bought their way through the entire spam value chain in order to work out which link in it was actually worth attacking. What they found was that the visible parts of the operation, the spam itself and the domains and the hosting, were essentially unattackable in economic terms, because a domain could be had for under a dollar in bulk and new hosting could be provisioned on demand at trivial cost, which meant every takedown simply moved the problem sideways. The payment tier behaved completely differently. Just three banks were servicing payments for more than ninety five per cent of the goods advertised in the spam they studied, and replacing a merchant account required coordination with a bank, a card association and a processor, a process measured in days or weeks rather than seconds. Their conclusion was that defenders should stop attacking the cheap, replaceable parts of the chain and concentrate on the expensive, concentrated bottleneck.

That is the intellectual bridge that makes this argument bigger than a description of one bank’s control, because it generalises cleanly. Attack the cheap and replaceable and you achieve very little, since a mule account at five hundred rand is cheap infrastructure in exactly the way a bulk domain is cheap infrastructure. Attack the expensive and the scarce and you do real damage, and in this business the expensive things are a converted victim, criminal trust, reliable payment rails, time and predictability.

The second piece of research explains why a delayed failure damages far more than the account it catches. In a paper with the wonderful title of Nobody Sells Gold for the Price of Silver, Herley and Florêncio applied Akerlof’s market for lemons to criminal marketplaces and showed that the defining problem in any underground economy is that nobody can verify quality before paying. Their key observation is that the risk of dealing with a ripper, somebody who takes payment and delivers nothing, operates as a tax on every single transaction in the market, and that the only practical way for criminals to escape that tax is to deal repeatedly with the small number of partners who have performed reliably in the past. Reputation, in other words, is the load bearing structure of the whole criminal economy. An account that appears healthy but is not is a lemon that passes every available inspection, which means it does not merely cost the syndicate one payload, it corrupts the verification mechanism the mule supply chain depends on to function at all, and it raises the ripper tax on every account anybody buys from anybody.

The third is the most uncomfortable for those of us who spend money on defence for a living. In their work on measuring the changing cost of cybercrime, published in 2019, Ross Anderson and his collaborators concluded that it would be economically rational to spend rather less in anticipation of cybercrime, on the traditional protective layers, and rather more on response, and they were blunt that we are particularly bad at prosecuting the criminals who operate the infrastructure that other wrongdoers rent. Attacking mule infrastructure directly is an attempt to take that advice seriously inside a bank rather than leaving it entirely to law enforcement.

Regulators have been travelling in the same direction, which is worth noting because it changes the economics for every institution rather than just for us. When the United Kingdom introduced mandatory reimbursement for authorised push payment fraud in October 2024, with claims payable up to eighty five thousand pounds, it required the receiving institution to pay the sending institution half of whatever was reimbursed. The Payment Systems Regulator was explicit that part of the purpose was to create an incentive for receiving institutions to keep fraudulent accounts off their books in the first place, which is a deliberate decision to put a price on the mule account and to charge it to the bank that opened one, and it converts what used to be somebody else’s problem into a line item. Whatever one thinks of the mechanism, the underlying instinct is sound, because the receiving side of a scam payment is the side with the leverage. It is also, and this is the part that tends to get lost in the argument about who pays, the side that still has the money, which means the receiving institution is the only party in the chain in a position to hand it back rather than merely to compensate for its absence.

Set against that literature, the local numbers make the case on their own. Using SABRIC’s 2025 figures, gross losses of R2.4 billion across 110,074 reported digital banking incidents, a rise of about twenty nine per cent on the previous year, the average reported gross loss per digital banking incident was somewhere close to R21,865. Set that against our observed mule acquisition cost of roughly five hundred rand and the asymmetry stops being a rhetorical device and becomes an operating instruction, because a single average incident is worth the acquisition cost of around forty four mule accounts to the people running it. Every rand of that value sits on the receiving side of the transaction, waiting for somebody to decide when it stops moving.

8. Both sides of the transaction, and how we knew it was working

It would be seriously misleading to present any single control as the whole strategy, because the useful version of this idea operates across the entire fraud journey rather than at one point in it. At the victim end we are trying to make persuasion harder. At the transaction level we are trying to introduce friction at exactly the right moment and no other. At the beneficiary end we are trying to make mule infrastructure unreliable and to keep the account bound to the person who opened it. At the network level we are mapping the relationships between accounts so that one identified mule exposes the others around it. At the level of the criminal operating model we are trying to raise replacement cost and, more than anything else, to raise uncertainty.

The most important of those in day to day terms is the one that faces the victim rather than the criminal. Every payment beneficiary is now scored in real time before money leaves an account, so that when one of our clients reports a beneficiary as fraudulent, that intelligence enters a live risk score the next client sees before they confirm a payment, and where the signal is strong enough the payment does not proceed at all. Fraud today far more often begins with a person being convinced than with a system being hacked, and behavioural interruption, a deliberate pause placed in front of somebody who is being actively manipulated, does more good than another layer of authentication ever will. Running that alongside the controls aimed at mule infrastructure means the criminal is squeezed from opposite ends of the same transaction, losing victims at the front and losing payloads at the back.

The published numbers give some sense of the scale. Between July 2025 and June 2026 our defences blocked roughly R699 million in potential losses across 113,410 clients, flagged more than 394,000 potentially fraudulent payments, blocked over 131,000 suspicious beneficiary accounts in real time and identified and shut down more than 64,000 mule accounts.

I have learned to be wary of numbers like these, though, because a large count of blocked accounts can just as easily be a symptom of a leaky front door as evidence of a capable defence, and counting your own activity is not the same thing as measuring your effect on somebody else’s business. The measure we actually ran the strategy against was a much less flattering one, which was simply how many of our accounts were turning up on the receiving end of a fraudulent payment, whether that was one Capitec client paying another or an external bank sending money to us and subsequently reporting the payment as fraud. It is an unforgiving metric precisely because it is not ours to massage, since the external half of it is reported to us by our competitors and reflects a choice made by a criminal about where to send stolen money. That is the number that moved radically as we got better at seizing funds, and watching it fall is a far more honest signal than any count of accounts closed, because it says the people running these operations have concluded that our accounts are the wrong place to put a payload.

It is worth dwelling on what that seizure actually produces, because it is the part of the strategy most easily lost when the argument is conducted in the language of unit economics, and it is the part that a client would consider the point of the entire exercise. A payload that is stopped inside a mule account has not merely been denied to the criminal. It is still sitting somewhere identifiable, in an account we control, in a form that can be traced and secured and paid back, which means the natural conclusion of a successful seizure is not a closed case file but a return of funds to the person the money was taken from. That is the difference between telling somebody we prevented a crime and telling them we got their money back, and only one of those conversations is any comfort to a person who has just been talked out of their savings by somebody they believed was helping them. It also aligns the incentives rather neatly, because the same discipline that makes our accounts a bad destination for stolen money is the discipline that keeps the money recoverable while we still have hold of it, and I would rather run a strategy where doing the economically damaging thing and doing the decent thing turn out to be the same action.

9. Never confuse activity with economic outcome

The broader management lesson here has very little to do with fraud, which is why I think it travels. Any security function can report accounts blocked, alerts generated, rules written, transactions challenged, devices fingerprinted and warnings displayed, and every one of those is a measure of our own activity rather than of the adversary’s condition. They tell you the machine is running. They do not tell you whether anybody is losing.

The questions worth putting on an executive dashboard are the ones asked from the other side of the table. Are criminals making less money from our clients than they were a year ago? Are they spending more to make it? Are they abandoning our customers for somebody else’s? Are they avoiding our accounts as destinations? Is their infrastructure becoming less reusable? Has their return on invested criminal capital fallen? And then the one question asked from the client’s side rather than the criminal’s, which is how much of what was taken from our clients we actually managed to give back to them. Those are harder to instrument and considerably harder to flatter yourself with, which is exactly what recommends them, and a fraud team that can answer even two of them credibly is running a genuinely different operation from one that reports blocks.

Traditional fraud prevention asks whether we stopped the transaction. Scammernomics asks a different question, which is what we did to the attacker’s return on investment. If a control merely forces a scammer to spend another five hundred rand on a replacement mule account, we have inconvenienced them and very little else. If it makes victims harder to convert, mule accounts unreliable, successful transactions unpredictable, criminal capital harder to recover and each individual failure progressively more expensive, then we have changed the economics, and when the economics stop working the scam eventually stops working too. And because every one of those controls works by stranding money rather than by chasing it after the fact, the same programme that makes the business unprofitable is the one that puts funds back in the hands of the people who lost them, which is the outcome I would want to be judged on.

Security has never been only a technical problem to be solved. It is a promise we make to fifteen million people every morning when they open the app, and keeping it means thinking a great deal less like an engineer defending a wall and a great deal more like a competitor determined to put a rival out of business.

Don’t just block the scam. Break the business model. And where the money is still there to be found, give it back.

Sources: Capitec’s AI defences block R699m in potential losses (Bizcommunity); Stay ahead of sophisticated fraud (Capitec); Stopping fraud before it happens (Capitec); Good news for people who bank with Capitec (MyBroadband); SABRIC Annual Crime Statistics 2025; Levchenko et al., Click Trajectories, IEEE Symposium on Security and Privacy, 2011; Herley and Florêncio, Nobody Sells Gold for the Price of Silver, 2009; Anderson et al., Measuring the Changing Cost of Cybercrime, WEIS 2019; Payment Systems Regulator, PS24/7, APP scams reimbursement requirement and maximum level of reimbursement