Bank Account Marked as a “Mule Account”? What It Means and What You Can Do

You try to make a payment from your bank account and suddenly discover that transactions have been blocked. When you contact the bank, you are told that the account has been “marked as a mule account,” “suspected mule account,” “debit frozen,” or “under AML review.”

For many genuine customers, this can be alarming. A business account may stop functioning overnight. Salaries, vendor payments or EMIs may get affected. In some cases, the bank may provide very little information about why the restriction has been imposed.

The important point is this: an account being flagged or marked as a suspected mule account does not, by itself, establish that the account holder has committed a crime. Banks increasingly use transaction-monitoring systems, information received through the cybercrime ecosystem and AI-based fraud-detection tools to identify potentially suspicious accounts. These systems can identify genuine criminal networks, but the Indian Banks’ Association's draft framework itself recognises that rule-based monitoring systems can generate a significant number of false positives.

This article explains what a mule account is, why a genuine bank account may be marked as one, and what an account holder can do about it.

What is a mule account?

A money mule account is broadly a bank account used for receiving, transferring or layering money derived from fraud or other unlawful activities.

The Reserve Bank of India has long recognised the concept of money mules. RBI explains that criminals may recruit third parties to receive funds into their bank accounts and thereafter transfer those funds onwards, sometimes after retaining a commission. RBI has also specifically recognised that some such account holders may be innocent, while others may knowingly participate in the fraud. 

A simple example would be:

A fraudster cheats a victim of ₹2 lakh. Instead of receiving the ₹2 lakh directly into the fraudster's own account, the money is first transferred into Account A. Account A transfers it to Accounts B and C, which may then transfer it further or convert it into cash or virtual assets.

Account A, and potentially Accounts B and C, may therefore be identified as mule accounts forming part of the fund trail.

The Indian Banks’ Association's draft framework describes money mule accounts as accounts that may be used by persons knowingly or unknowingly to facilitate movement of money obtained through fraud, hacking and other unlawful activity.

Why are banks increasingly identifying mule accounts?

Cyber fraud investigations today are highly transaction-driven.

When a victim reports a cyber fraud, investigators attempt to trace the movement of the money through different bank accounts. At the same time, banks themselves monitor accounts for patterns that may indicate laundering or cybercrime.

The scale of this system has increased considerably. The Government stated in July 2026 that I4C's Suspect Registry had received more than 30.48 lakh suspect identifiers from banks and that information relating to 32.08 lakh Layer-1 mule accounts had been shared with participating entities as of June 30, 2026.

RBI has also developed MuleHunter.ai, through the Reserve Bank Innovation Hub, to assist banks in identifying mule accounts using AI and machine-learning models. In March 2026, the Government stated that MuleHunter.ai was already live in 26 banks and was being scaled further.

In May 2026, I4C and RBIH entered into an arrangement for sharing mule-account intelligence and suspect identifiers from the I4C Suspect Registry to strengthen systems such as MuleHunter.ai.

The result is that banks are no longer dependent only upon a specific police notice before scrutinising an account. An account may also be identified because of the bank's own transaction-monitoring or fraud-risk systems.

Why can a genuine bank account be marked as a mule account?

This is where the problem becomes more complicated.

Banks do not necessarily know the underlying commercial explanation for every transaction when an alert is generated. Their systems primarily examine patterns.

The IBA's draft framework identifies several patterns commonly associated with potential mule accounts, including unusually high transaction volumes, rapid transfers, sudden activation of dormant accounts, frequent changes in mobile numbers, multiple transactions involving different counterparties and activity inconsistent with the customer's declared occupation or income.  

Its suggested monitoring triggers include:

• large or rapid inflows followed by immediate outflows;

• transactions inconsistent with the customer's normal profile;

• frequent small transactions involving several recipients;

• abnormal transaction volumes;

• high-velocity movement of funds;

• large activity in an account that was previously inactive; and

• transactions associated with high-risk locations or unusual IP addresses.  

Many legitimate businesses can display some of these characteristics.

An online seller may receive hundreds of small UPI payments. A payment intermediary may receive and settle money rapidly. A travel agent may receive payments from several unrelated customers and remit them onwards. A new business may suddenly experience a substantial increase in turnover. A trader may receive money from someone who, unknown to him, is already part of a cybercrime transaction trail.

An alert therefore needs to be distinguished from a finding of criminal involvement.

Indeed, the IBA draft framework specifically contemplates that after an account is flagged, the bank should conduct a contextual review, examine the customer's historical transactions and undertake Enhanced Due Diligence, including obtaining additional documents from the customer.

Does being marked as a mule account mean that there is a cybercrime complaint against you?

Not necessarily.

There are broadly two different situations.

The first is where a cybercrime complaint has been registered and the investigating agency has traced some part of the disputed money into your account. The police or cybercrime authority may then issue a requisition to the bank for a lien, hold or debit freeze.

The second is where the bank itself considers the account suspicious, based on AML monitoring, transaction behaviour, information available through fraud databases or systems such as the Suspect Registry.

The distinction is important because the procedure for resolving the restriction may differ considerably.

The IBA draft framework notes that banks may place a debit freeze on reported fraud amounts pursuant to instructions arising from cybercrime complaints. It separately contemplates monitoring and identification of suspected mule accounts through internal banking systems.

What happens after an account is identified as a suspected mule account?

Depending on the circumstances and the bank's internal systems, several things may happen.

The account may be debit-frozen, digital banking may be restricted, transactions may be subjected to additional verification or the matter may be escalated internally to the bank's fraud or AML team.

The IBA's draft framework contemplates escalation of suspected mule accounts to law-enforcement agencies, creation of an internal negative registry and filing of a Suspicious Transaction Report where appropriate.

Importantly, this document is an IBA draft framework, and should not be treated as though every provision is independently binding law. It nevertheless gives a useful picture of the detection and compliance architecture that banks are being encouraged to adopt.

RBI's KYC framework also requires banks to undertake careful monitoring to identify money-mule accounts and take appropriate action, including reporting suspicious transactions to FIU-IND.

What should you do if your bank account has been marked as a mule account?

If the bank has restricted your account, simply visiting the branch repeatedly may not resolve the problem. You should first identify why the account has been restricted.

A practical approach is the following:

1. Ask the bank for the precise reason for the restriction. Ask whether the account has been restricted because of an external cybercrime/police requisition or because of an internal AML or mule-account flag.

2. Ask for the details of the suspicious transactions. If there is a police requisition, ask for the complaint/FIR/NCRP reference, police station or investigating agency, date of the requisition and the amount for which the lien or freeze has been requested.

3. Obtain your bank statement and identify the transactions in question. Trace the source and purpose of every disputed credit and subsequent transfer.

4. Prepare documentary evidence explaining the transactions. Depending on the account, this could include invoices, GST records, purchase orders, contracts, salary records, loan documents, proof of sale, customer correspondence, payment-gateway settlement reports or other business records.

5. Submit a written representation to the bank. Do not restrict the communication to telephone calls or branch visits. Ask for review by the bank's fraud/AML/nodal team and retain acknowledgment of the representation.

6. Where the restriction originates from a cybercrime complaint, approach the investigating agency as well. Provide the transaction trail and explain why the receipt was legitimate. If the disputed amount represents only a small part of the money in the account, specifically request that the restriction be confined to that amount.

7. Escalate the matter if there is no meaningful response. Depending upon the facts, remedies may include escalation to the bank's grievance mechanism, the RBI Integrated Ombudsman framework where maintainable, representation before the investigating authority, proceedings before the jurisdictional criminal court or appropriate proceedings before the High Court.

The exact remedy will depend upon whether the restriction has been imposed by the bank itself or pursuant to police instructions.

What documents should you send to the bank?

A useful representation should normally contain more than a statement saying, “I have done nothing wrong.”

You should try to establish the commercial explanation for the transactions.

For a business account, this may include GST registration, incorporation or proprietorship documents, invoices relating to the questioned payments, corresponding purchase orders, bank statements demonstrating the usual pattern of business, income-tax records where relevant, customer/vendor communications and documents explaining onward transfers.

The objective is to demonstrate that the apparently unusual transaction is consistent with a genuine economic activity.

This becomes particularly important because mule-detection systems compare transaction activity with the customer's known profile. The IBA framework, for example, treats substantial transaction activity inconsistent with declared income, occupation or business turnover as a risk indicator.

Can the bank freeze your account merely because it suspects it to be a mule account?

This issue has already reached the courts.

The Kerala High Court considered restrictions imposed by banks themselves on accounts suspected of mule activity, without an independent police requisition. The Court laid down an interim procedural framework under which a bank entertaining a genuine suspicion could initially impose a debit freeze, but should communicate the reasons for its suspicion to the account holder and permit the customer to submit an explanation. The bank was then required to consider the explanation and, if satisfied, de-freeze the account. Subsequent Kerala High Court decisions have continued to apply those directions.

For example, in March 2026, the Kerala High Court directed the bank to provide details of the suspicious transactions to the customer so that an explanation could be submitted.

More recently, the Kerala High Court has reiterated that where a bank itself freezes an account based on suspicion, the account holder must have an opportunity to explain the transactions, and the bank must take a reasoned decision on that explanation.

These decisions are particularly significant because they recognise a basic problem with automated fraud detection: a suspicious pattern may justify investigation, but it cannot eliminate the need to examine the customer's explanation.

The legal position may nevertheless differ depending on the jurisdiction and the precise source of the restriction.

What if only ₹5,000 or ₹10,000 of disputed money came into my account but the entire account has been frozen?

This frequently arises in cybercrime matters.

For example, a business account containing several lakhs of rupees may be frozen because ₹10,000 received from one customer forms part of a cybercrime complaint.

The account holder should immediately ascertain:

• the precise disputed amount;

• whether the police requested a lien for that amount or a complete debit freeze;

• which transaction generated the complaint; and

• whether there are multiple complaints/requisitions against the account.

Indian courts have increasingly examined whether restrictions on bank accounts should remain proportionate to the amount actually under investigation. In several Kerala High Court decisions dealing with cybercrime freezes, banks have been directed to permit operation of the account while limiting the lien to the amount identified in the police requisition, subject to the circumstances of the case.

However, this cannot automatically be applied to every case. Where the bank has independent material indicating that the account itself is being systematically used as a mule account, the situation may be treated differently.

Can my account be marked as a mule account even if I never knowingly participated in fraud?

Yes.

RBI itself has historically acknowledged that some money mules may be innocent while others may be complicit.

There are several situations in which an innocent person may become part of the transaction chain.

A merchant may receive payment from a fraudulent source without knowing it. A freelancer may receive payment for genuine work. A business may receive an order from someone using fraud proceeds. A person may sell goods through an online marketplace and later discover that the purchaser's money was linked to cybercrime.

That does not mean that every recipient is automatically immune from investigation. But receipt of suspicious money and knowing participation in a laundering or fraud arrangement are not the same factual proposition.

This is precisely why documentary evidence explaining the underlying transaction becomes critical.

What if you gave your bank account to someone else to use?

That situation is much more serious.

I4C has specifically warned citizens not to sell or rent bank accounts, company registrations or Udyam registrations to other persons. Investigations have found bank accounts recruited through social-media platforms and subsequently controlled remotely for use in illegal payment gateways and cybercrime networks. The Government has warned that illicit funds passing through such accounts can expose the account holder to legal consequences, including arrest.

If you knowingly allowed another person to operate your account, gave them your SIM card, banking credentials, UPI access or received a commission for routing transactions, you should obtain legal advice immediately before making statements to investigating authorities.

Can a mule-account tag affect your other bank accounts?

Potentially, yes.

India's anti-fraud system is increasingly based upon information sharing between banks and government platforms.

The IBA framework contemplates banks participating in I4C's Suspect Registry, sharing information regarding potential mule accounts, maintaining internal suspect registries and using external fraud intelligence during onboarding and monitoring.

The May 2026 I4C-RBIH initiative also specifically contemplates use of suspect identifiers from I4C's Suspect Registry to strengthen AI-driven fraud detection across banks.

Therefore, resolving an erroneous mule-account classification can be more important than merely obtaining temporary access to one frozen account.

Can you ask the bank to remove the “mule account” classification?

Yes, you can seek a review of the classification.

Your representation should specifically request:

(a) disclosure of the transactions which triggered the mule-account suspicion;

(b) clarification whether the restriction arises from the bank's internal monitoring or an LEA/NCRP requisition;

(c) reconsideration of the mule-account classification based upon the documents supplied;

(d) restoration of banking facilities if the explanation is found satisfactory; and

(e) appropriate correction of internal adverse markers or negative classifications if the mule suspicion is found to be incorrect.

This last request can be important because the IBA framework itself contemplates creation of internal negative registries once an account is identified as a suspected mule/mule account.

What if the bank does not tell you why the account has been blocked?

Ask in writing.

Your email or letter should request at least:

“Please confirm whether the restriction has been imposed pursuant to any law-enforcement/cybercrime requisition or as a result of the Bank's internal fraud/AML monitoring. Please also identify the transaction(s) which have resulted in classification of the account as a suspected mule account and provide sufficient particulars to enable the account holder to submit an explanation.”

Where a complete disclosure cannot be made because of an investigation or regulatory restrictions, the bank may not necessarily provide every internal record. However, the Kerala High Court's recent mule-account decisions strongly support the proposition that a person whose account has been restricted on the bank's own suspicion should at least be given sufficient information to explain the questioned transactions.

Do not confuse a “mule-account flag” with a conviction

This distinction is increasingly important as India's fraud-detection systems become more automated.

A transaction-monitoring alert is essentially a risk signal.

The IBA's own draft framework acknowledges both high false positives in conventional rule-based systems and the need for contextual review before determining whether flagged transactions are legitimate.  

It also expressly states, while discussing integration of cyber-fraud and banking data, that the system should ensure that genuine customers are not adversely affected while tackling money mules. 

That principle should remain central to any response to mule-account fraud.

Fraudulent accounts need to be identified quickly. But genuine businesses and individuals should also have an effective mechanism to demonstrate the legitimacy of their transactions and seek removal of an incorrect classification.

Frequently Asked Questions

My bank says my account is a mule account. Am I accused of cybercrime?

Not necessarily. The account may have been flagged by the bank's internal monitoring system or linked to a transaction reported through the cybercrime system. You should first determine the source of the flag.

Does “mule account” mean “fraud account”?

Not automatically. It means the account is suspected or identified as being used for routing potentially unlawful funds. Whether the account holder knowingly participated is a separate question requiring examination of the facts.

How do I unfreeze a mule account?

First obtain the reason for the restriction and details of the questioned transactions. Submit a detailed explanation with supporting documents to the bank. Where there is a police/cybercrime requisition, parallel representation to the investigating agency may be required. Court intervention may be necessary where the restriction continues without adequate justification.

Can the bank remove the mule-account tag itself?

Where the restriction originates from the bank's own suspicion, the bank can review the transactions and the customer's explanation. Recent Kerala High Court decisions have specifically contemplated de-freezing where the bank is satisfied with the explanation provided.

Can I withdraw the undisputed money in my account?

It depends upon the nature of the restriction. Where a police requisition relates only to a particular amount, there may be grounds for seeking restriction of the lien to that amount. Where the bank independently considers the entire account to be involved in mule activity, further review may be required.

Will filing a complaint with RBI automatically unfreeze the account?

No. The correct remedy depends upon who imposed the restriction and why. An RBI grievance mechanism cannot simply override a lawful police or court direction. You should first obtain the underlying details of the restriction.

Is the IBA money-mule framework binding on every bank?

The document discussed in this article is a draft framework prepared by an Indian Banks’ Association Working Group, not a statute or court order.  It is nevertheless useful because it explains the risk indicators, transaction-monitoring systems, enhanced due-diligence processes and proposed responses being considered by the banking industry.

The takeaway

If your bank account has been marked as a mule account, do not ignore the issue and do not assume that merely completing KYC again will necessarily solve it.

Find out who triggered the restriction, which transaction triggered it and what amount is actually under suspicion.

Then create a documentary transaction trail demonstrating why the receipt and subsequent use of the money were legitimate.

Where the mule classification is based only upon automated or internal bank monitoring, specifically seek a review of the classification. Where it originates from a cybercrime complaint, the investigating authority may also have to be approached. And where an indefinite or disproportionate restriction continues despite a satisfactory explanation, appropriate legal proceedings may be considered.

As banking fraud detection becomes increasingly dependent upon AI, shared fraud databases and transaction analytics, false positives are inevitable. The challenge for the system is therefore not merely to detect suspicious accounts quickly, but also to ensure that genuine customers have an equally effective mechanism for clearing their accounts when the suspicion is wrong.