This post describes a defensive detection methodology based on publicly documented fraud typologies. No institution-identifying details are included.
Before a money mule network moves fraud proceeds out of an account, it checks that the account still works. FIU-Nepal's Strategic Analysis Report 2024 on cyber-enabled frauds describes exactly how. Fraudsters fear that a bank or payment service provider has already identified the account and imposed a debit freeze, which would trap the proceeds. So they "carry out small value debit transactions to check if account is frozen so that they can change the destination of the funds if the account is frozen." In the report's words, "Debit of amount as low as Re. 1 is seen in these accounts," typically used for "loading wallet accounts or topping up few common mobile numbers."
The report's findings repeat the point: frequent debits as low as Re. 1 were observed in most of the accounts reported for cyber-enabled fraud, credited to wallet accounts opened from a few common mobile numbers.
That probe is the moment where detection has the highest leverage, and it's also the moment most institutions aren't specifically looking for.
Why the "Re. 1 ping" is a detectable signature
A single Re. 1 wallet load or mobile top-up is not, on its own, suspicious. Customers do small top-ups all the time. What distinguishes fraudulent probing is the pattern surrounding it, not the transaction itself:
- An account receives credits, often from victims with no prior relationship to it, and shortly afterwards makes a tiny outbound debit before any larger movement.
- The tiny debit goes to a wallet or mobile number that also receives tiny debits from other, otherwise unrelated accounts. FIU-Nepal's "few common mobile numbers" is the key observation.
- A larger outbound transfer follows soon after a successful probe, often split across several destinations.
Individually, none of these signals is conclusive. Correlated together, they form a detectable pre-fraud signature that exists before the proceeds leave — which is the only point in the fraud lifecycle where freezing an account actually prevents loss rather than just documenting it after the fact.
Building the detection rule
A practical SIEM or fraud-engine correlation approach for this pattern:
- Baseline normal micro-transaction behavior for your customer base — how often ordinary customers make sub-Rs. 10 wallet loads and top-ups, and to how many distinct destinations. Establish what that looks like before hunting for deviations from it.
- Correlate a tiny debit with recent inbound credits on the same account. A micro-debit within a short window after unusual inbound credits is a much stronger signal than either event alone.
- Flag shared probe destinations. A wallet or mobile number receiving tiny debits from many unrelated accounts is a strong indicator of a coordinated validation operation. Once one such destination is known, every account that has probed it deserves review.
- Route flagged accounts to a proactive freeze/review workflow — not a standard alert queue that gets triaged days later. The value of this detection collapses if the response time matches your normal SOC SLA rather than an accelerated one.
The institutions that catch mule account networks early aren't running more advanced fraud detection than everyone else. They're looking for the probing behavior instead of waiting for the transfer behavior — and those are different signals that require different rules.
Where this connects to compliance obligations
Detecting and freezing accounts at the probing stage — rather than after the proceeds have been layered onward — directly supports AML/CFT obligations and gives your compliance team a far stronger suspicious transaction report, because it documents the network's own validation behavior rather than an after-the-fact loss.
This is also precisely the kind of detection logic that a generic, out-of-the-box fraud monitoring configuration will not catch, because it depends on correlating low-value transactions that individually fall well below most default alerting thresholds.