Fraudsters have always used mules to expand the reach and scale of their attacks. Whether they’re being leveraged to help provide a fraudster with anonymity, extend a fraudster’s reach beyond their natural geographical boundaries, or as outsourcing for mundane elements of fraud attacks, mules are an obvious way for fraudsters to increase their personal criminal ROI. 

Due to the pandemic and the normalization of working from home, and the ongoing economic uncertainty many people experience, the mule underground has taken off to become a far more mature and far larger ecosystem than was previously the case - what’s being called the gig economy of fraud. 

Adding to this trend is the fact that the manal-automation seesaw is swinging again for fraudsters. Having invested in bots, which handily increased the scale and speed of fraud attacks for a number of years, fraudsters are now starting to edge towards more manual methods once more. 

It’s a natural stage of the ongoing arms race between fraudsters and fraud fighters; the better bot detection becomes, the more likely fraudsters are to find manual workarounds. In the same way an uptick in phone order attacks and check fraud both mirror the fact that fraudsters are turning to old school methods to outsmart clever modern fraud fighting technology. Mules are a part of the same neverending battle. 

A Mule for Every Job

One of the most common roles for a mule is in “parcel mule” scams. Fraudsters employ people to receive stolen goods, repackage them, and send them off to an address owned by the fraudster. This can happen without the mule suspecting any foul play whatsoever (though more on that in a minute). It’s a great way to get around the challenge of billing/shipping address mismatch. 

There are, of course, legitimate jobs which sound just like this, which make the fraudulent job ads hard to spot. Repackaging items to create gift baskets might well be a real job. Or, it might be that a fraudster has targeted you to receive stolen items because your home address is close to the billing addresses of the stolen cards they’re using to make purchases. 

People who don’t work in fraud prevention aren’t naturally suspicious, and it can be hard for them to tell which is which. Sometimes, as with phishing scams, the fraudsters even use the ads as filters to identify people who are more vulnerable to being taken advantage of. (Or, alternatively, unscrupulous. That is sometimes a factor too.) After the stolen goods have been repackaged and sent off, there’s nothing to tie the crime to the criminal. The person on file as receiving stolen goods is the parcel mule. 

It doesn’t stop with parcel mules. Fraudsters look for freelance workers willing to take on a wide variety of tasks on their behalf. They might be picking up packages from curbside delivery, setting up new accounts or profiles on online sites and visiting them every so often (to build up a legitimate-looking, aged profile the fraudster can leverage later), running small-scale seller accounts on an online marketplace which can be misused for larger purposes later on, filing refund claims, or making online purchases. The setup is the same.

The gig worker victims might even be tricked into moving money through their account, becoming an accessory to money laundering. Money mules have no idea how catastrophic their actions can be, but the fact is that beyond the risk of arrest and prosecution, if the bank spots what’s happening,they may freeze the money - and leave the money mule owing a large amount to a criminal group determined to get it back one way or another. The FBI has clear advice for people tricked into becoming money mules, to avoid this spiral of disaster.  

Covid-19 Pandemic: Perfect Breeding Ground for Gig Economy Fraud 

During the Covid 19 pandemic, huge numbers of people needed jobs that could be done flexibly from home. Fraudsters were happy to oblige, and took advantage of thousands of unwitting gig-economy job-seekers. From the fraudster perspective, it was a gift - people all over the world who were too tired and stressed, and in some cases too desperate, to wonder whether an online job offer might be too good to be true. 

Often, mules have no idea what’s going on. If they do become suspicious, the fraudster turns up the pressure. One victim of a parcel mule scam, who wants to be known only by his Reddit pseudonym Styles_G_White, says that after sensing that something was wrong and pulling out of the “job” he experienced “calls and emails from my "supervisors" threatening legal action against me… They've said they'll press charges if I don't comply.”

That victim was strong enough to stand their ground, but sometimes, buckling under the pressure, the fear, and the need for a wage, the mule gives in. The consequences can be serious, whether stolen goods have been traced to the mule’s address or they’re complicit in money laundering.

The pandemic created the perfect circumstances for fraudsters to find new mule victims all over the world. Some of them, sucked into one form of crime or another, become willing accomplices, and in some cases even active partners in the scams. Effectively, what this does is increase the gig economy of fraud freelancers that full-time fraudsters can call on for odd jobs that are needed to make a fraudulent scheme run smoothly. 

Fueling the Online Criminal Ecosystem

Mules aren’t new in the criminal world, of course. The change that fraud fighters need to be aware of is the sheer size and scale of these operations - the development of a whole gig economy of fraud. Fraudsters can now find people they can trick into helping them all over the world, fitting a range of ages and profiles. 

That makes it harder for online fraud prevention systems to identify these users’ actions as fraudulent, because fraudsters rely on the mules' existing good reputation online. On top of that, fraudsters cleverly match the mule to the job - for instance, ensuring that the mule’s IP address or physical address (or both) are plausible for the rest of the story. 

The gig economy of fraud enables fraudsters to scale up their activities through outsourcing part of their work, and by creating more convincing attacks by using local individuals and sometimes local knowledge. 

Combat Organization with Collaboration

The online criminal world has become highly sophisticated, and well-organized - something which is both reflected in and expressed by the gig economy of fraud. Legitimate retailers, marketplaces and financial institutions are at a disadvantage, because they (rightly) move carefully and in compliance with the law. Fraudsters, by definition, do not. They’re creative, fast-moving, and unscrupulous. And they’ve just had a lot of practice becoming very successful at recruiting mules.

The nature of the gig economy of fraud makes the mules and the bad actors behind them more difficult to catch on an individual basis. A single transaction, or online action, may well look legitimate. It’s only when these actions are seen across the span of the sites and apps the mule has been used to attack that the pattern becomes clear. 

Fraud typically rises during times of economic uncertainty. If that’s where we’re headed now, it’s more important than ever that companies change their mindset of trying to identify fraud alone, and start breaking down silos and collaborating, directly and effectively, with other legitimate companies - retailers, marketplaces, financial institutions, networks. Is that shipping address usually associated with that credit card? Has that bank account or credit card been seen with that IP address and email address before? If not - you need to know more. If it has - make the journey smooth and seamless for the good customer.

While it’s neither sensible nor safe to share sensitive payment information, using one or another form of Privacy Enhancing Technology it is possible for organizations to leverage one another’s sensitive data without sharing or exposing any. Identiq’s network enables companies to leverage one another’s knowledge of their users without ever sharing any personal user information - not with any other company on the network, and not even with Identiq.

Fraudsters already work together. Until legitimate companies do the same, the gig economy of fraud will continue to grow - and more and more people will fall victim as mules. 

Webinar - Find Out More About the Gig Economy of Fraud

Want to learn more about the gig economy of fraud? Watch this insightful panel on demand: Marketplaces’ Hidden Risk: The Gig Economy of Fraud. 

Upwork’s Director of Trust & Safety Operations, Caitlyn McNerney, Fiverr’s Payments Risk Analyst, Daniel Barak, WAG’s Senior Manager of Trust and Safety Policy, Ronnie Gammage, and Identiq’s VP Product, Uri Arad discussed the impact that the gig economy of fraud has had on marketplaces and their users, how the subtle signs of this activity can be spotted, and what to do about it. Watch it now.

‍