Count the mule accounts you opened, not only the scams you stopped

A bank that opens accounts through an app in a few minutes should report to its board, every quarter, how many of those accounts were used to receive stolen money and how quickly it stopped that money leaving. I hold that the measure belongs to the chief information officer as much as to the head of fraud, because the onboarding flow that produced those accounts is a technology product. When it is defective, this is the number that shows it first.

Most public discussion of scams in Philippine banking concerns the sending side: warnings in the app, confirmation screens, cooling-off periods for new payees. That work matters, and a customer who is stopped before sending loses nothing. But an instant transfer settles in seconds, and when someone at another bank is persuaded to send ₱38,000 to a stranger, the money arrives in an account somewhere. Very often that account was opened a few days earlier, by a real person with a genuine ID, and it is emptied within minutes. In 2023 the median interval between a scam credit reaching a Talampas account and its onward transfer or withdrawal was twenty-six minutes.

Where the stolen money lands

We launched account opening in our app in March 2022. A customer photographed a government ID, took a selfie, passed a liveness check and could use the account within minutes. By the middle of 2023 we were opening about 64,000 accounts a month that way, and our digital team was proud of the completion rate. So was I. I had approved the dashboards, and they measured the funnel: starts, completions, minutes to open.

None of those measures told us that we had become a convenient place to put stolen money. Our fraud operations team did. In the first half of 2023 they traced ₱412 million of reported scam proceeds credited to Talampas accounts, 71% of it to accounts less than thirty days old. When they investigated, they confirmed 8.3 mule accounts for every thousand digital openings.

The pattern in those files explains why identity checks alone cannot solve the problem. Students, jobseekers and people in debt are offered a few thousand pesos to open an account and hand over the login, or to let someone else's phone receive the one-time passwords. The identity is real and the purpose is not. Our onboarding had verified exactly what it was designed to verify. What it could not see was intent, and intent shows itself in behaviour during an account's first days: an unfamiliar device, a burst of credits from unrelated senders, money leaving within minutes of arriving.

The law has moved in the same direction. The anti-scam legislation passed in 2024 made acting as a money mule an offence and gave banks a clearer basis to hold suspicious funds temporarily while they verify a transaction. That power is useful only if a bank notices in time. A hold placed after the twenty-sixth minute protects nobody.

A measure the board can hold us to

Since 2024 our board risk oversight committee has received two figures each quarter. The first is confirmed mule accounts per thousand digital openings. The second is the share of flagged inbound funds frozen before they left the bank. In the first half of 2023 they stood at 8.3 and 6%. By the second quarter of 2025 they were 1.6 and 41%.

I chose two measures because a bank can improve one at the expense of the other. Tighter onboarding keeps new mules out, and criminals respond by buying or renting older accounts from genuine customers. We saw exactly that: accounts more than ninety days old rose from 12% of confirmed mule cases in 2024 to 29% in 2025. So the committee now also sees how old each confirmed mule account was, and the frozen-funds figure tells it whether our monitoring catches older accounts as well as new ones.

There are fair objections to reporting these numbers, and I have heard every one of them inside our own bank. Confirmed mule counts depend on how hard a bank looks, so a bank that investigates less will report fewer. Definitions differ between banks, so comparisons mislead. A rising figure in one quarter can alarm a board that is otherwise well informed. I accept each point. The answer to the first is to report investigation volumes beside the count, because a falling mule rate with falling investigations means nothing. The answer to the second is to compare a bank with itself over time rather than with its competitors. The answer to the third is to show the measure before it is needed, so that a bad quarter arrives with its context already understood.

Friction that expires

Our controls went live in January 2024. For forty-eight hours after opening, or until the customer completes a short video call, a new digital account can send no more than ₱10,000 a day by instant transfer, and large credits from unrelated senders are scored before the money can move. Each account is bound to one device, and every inbound credit is scored within seconds against the account's age, device and history. The friction is deliberate, and it is designed to expire: as an account behaves normally, the limits lift without the customer having to ask.

The cost was visible. Completed openings fell 17% in the first quarter. Our head of digital banking had argued that genuine customers would open e-wallets instead, and some did. About 2,300 customers complained. Our worst mistake was holding the first wages of 3,400 factory workers whose employer paid them by instant transfer from another bank, because our rules had treated the payroll provider as an unrelated sender. We corrected that within a week, and I telephoned the employer's finance director myself. By December 2024 openings had recovered to 91% of their earlier level, and scam proceeds received in the first half of 2025 were ₱97 million, under a quarter of the 2023 figure, while our instant-transfer volume had roughly doubled.

One bank cannot solve this alone. Mules move between institutions, and a device or behaviour pattern seen at one bank is useful to another within minutes, not weeks. Faster sharing between banks, within what the Data Privacy Act allows, would do more than any single bank's model. I would also welcome supervisors asking every bank for the same receiving-side measures, although that is their decision, not mine.

My request to other banks' boards is modest. If your bank opens accounts in minutes, ask how many of last year's openings were confirmed as mules, how old those accounts were when they were used and how much flagged money left before anyone stopped it. If nobody can answer, the onboarding product has a defect that its dashboards were never designed to show.