Check references on incoming payments for mule signs

Fields

• Payment reference as received
• Payer name as received
• Receiving account: type, how long it has been open, and the use declared at opening

Questions

1. Is there enough in the payment reference to tell what the payer says the payment is for? Yes / No

   A few words are enough when they name a purpose. Yes: The reference says what the payment is for, even briefly, such as "iphone 15" or "deposit flat 2". No: The reference is empty, a name, a number on its own, or a word like "payment" or "thanks".

2. Which scam story, if any, does the payment reference most resemble? Choice

   Pick the one scam story named in the context that the reference most resembles. A few words can fit a story: "deposit flat 2" fits a purchase from a stranger. Choose No scam story when the reference describes an ordinary payment such as a share of a bill, a gift or wages.

   • No scam story An ordinary payment such as rent, a bill, a purchase from a known seller or money to family, with nothing that fits a scam story.
   • Bank or police impersonation Someone claiming to be from the bank, the police or another authority says the payer's money is at risk and must be moved to keep it safe.
   • Other impersonation Someone claiming to be from a tax office, a utility, a delivery firm or a phone company asks for payment of a bill, a fine or a fee.
   • Investment Crypto, a trading platform or an opportunity promising high or guaranteed returns, usually found online or through a new contact.
   • Romance or friendship Money for someone the payer knows only online or has never met in person, often for travel, a medical bill or an emergency.
   • Purchase from a stranger Goods, a pet, tickets, a vehicle or a rental deposit paid by bank transfer to a seller found online, usually before seeing the item.
   • Invoice or bank detail change A supplier, builder, solicitor or landlord has sent new bank details for a payment the payer expected to make.
   • Advance fee A fee paid to release a loan, a prize, an inheritance, a parcel or a refund.
   • Job or task scam Paying to unlock earnings, commission or a job that comes from online tasks, reviews or orders.
   • Relative on a new number A message claiming to be from a child or another relative with a new phone number asks for money urgently.

3. Does the payment reference show someone else telling the payer what to do or write for this payment? Yes / No

   Count "as instructed", "as advised", "per agent", "as agreed with the adviser", "safe account" and "for release", and a reference that repeats a phrase the payer was plainly given. Yes: The reference shows the payer was told to make the payment or what to write. No: The reference reads as the payer's own words about their own payment.

4. Does the payment reference describe payment for goods, services, an invoice or an investment, arriving in a personal account? Yes / No

   Use the account type in the account profile. Count an invoice or order number, a booking, a trading or investment top-up, and goods described as bought. One sale of a personal item, such as "for the bike", counts too; code looks at how many such payments arrive. Yes: The reference describes paying for goods, services, an invoice or an investment, and the account is a personal one. No: The reference describes a personal payment, such as a gift or a share of a bill, or the account is a business account.

5. Does the payment the reference describes fit the use declared for the receiving account? Choice

   Compare what the reference says the payment is for with the use the customer declared when opening the account, as the account profile gives it.

   • Fits the declared use The payment is the kind the declared use would bring in, such as wages into a wages account or a customer invoice into a business account.
   • Does not fit The payment is a kind the declared use would not bring in, such as investment top-ups or goods sales into an account opened for wages and everyday spending.
   • No declared use given The account profile gives no declared use, so there is nothing to compare.

6. Does the payment reference suggest the money is being passed on for someone else, or is a fee for passing money on? Yes / No

   Count "for transfer", "send on", "pass to", "your cut", "commission", "for using your account", and a reference naming a third person the money is for. A payment that only seems out of place for the account is the declared use question. Yes: The reference suggests the money is to be moved on for someone else, or pays for doing so. No: The reference says nothing of this kind.

7. Does the payment reference accuse the recipient of a scam or theft, or demand money back? Yes / No

   Count "scammer", "thief", "you stole", "return my money", "refund now" and similar words written to the recipient. Yes: The reference accuses the recipient or demands the money back. No: The reference does neither.

8. How strongly does the payment reference suggest the money comes from a scam or is being moved through the account? Scale

   Rate the reference, the payer name and the account profile together. Rate the words, not the people and not the amount.

   • None An ordinary payment that fits the account. Nothing points to a scam or a mule.
   • Faint One weak sign, such as a sale of a personal item or a vague reference, with no scam story behind it.
   • Clear A recognisable scam story in the reference, or a payment that plainly does not fit the account, or several signs pointing the same way.
   • Strong A scam story together with instructions to the payer, an accusation, or signs that the money is being passed on.

9. What should the financial crime team do with this payment's receiving account? Choice

   Suggest a step for the team. A scam story, or a payment that plainly does not fit the account, is Send to an analyst, even from one reference. None of these steps freezes an account, returns a payment or makes a report; an analyst decides that.

   • No action Nothing in the payment calls for more than the usual monitoring.
   • Add to monitoring A weak sign: the answers go on the account's monitoring profile, for code to weigh with the account's other payments.
   • Send to an analyst now A scam story, a payment that plainly does not fit the account, or signs of money being passed on: an analyst reviews the account while the money may still be in it.

Lens columns

enough_information, enough_information_probability, scam_story, scam_story_probability, someone_directing, someone_directing_probability, trading_into_personal, trading_into_personal_probability, fits_account_use, fits_account_use_probability, mule_signals, mule_signals_probability, accuses_recipient, accuses_recipient_probability, signal_strength, signal_strength_average, suggested_step, suggested_step_probability