Fictional scenario. Synthetic data. Your notes stay on this browser; do not enter real customer information.
Five parts in, every scheme has had the same last chapter. Enumeration finds live cards; triangulation turns them into goods; refund fraud turns goodwill into card balances; a bust-out turns a settlement account into a withdrawal; a bonus ring turns an offer into a balance. In each there is a moment where value in a traceable form must become money held by a person, and that moment is the cash-out. OWASP files it as OAT-012, and public financial-crime guidance describes the people who make it possible as money mules.
A mule is a person whose account receives money that is not theirs and passes it on. Some are recruited knowingly, for a fee. Some by a story about a job or a favour. Some have had their account details used without being asked. The data does not distinguish the three, and the desk must not pretend it does.
What the scheme needs.
From the defender's view, a cash-out needs three things.
A place where one kind of value becomes another. A casino that takes card deposits and pays bank withdrawals. A broker that pays out to a bank. A marketplace that pays sellers. Lagoon Casino and Meridian FX, our fictional operators, both have this property, and it is what makes them useful to their honest customers.
A destination that is not the source. If money can only leave by the route it arrived, a stolen card's balance goes back to the stolen card, which is no use to anyone. The withdrawal-to-a-different-method request is the single most important event in this scheme, and the one most operators already review.
Enough mules. A destination account can receive only so much before its own bank asks questions, so a ring uses several. The number of distinct destinations across a set of accounts is both a signal and a measure of scale.
What it looks like in your data.
A synthetic illustration at Lagoon, drawn from the same six weeks as the Northbank dossier series.
- 38 accounts deposit by card, EUR 150 to EUR 480 each, total EUR 11,920.
- Wagering before withdrawal: median three per cent of the deposit. Honest players, in this illustration, wager many times their deposit over an account's life.
- 36 withdrawal requests, all to bank transfer, none to the depositing card.
- Six distinct bank references across 36 requests. One, first seen fourteen months earlier, belongs to a long-standing player and receives 14 requests, 13 from accounts that are not his.
- Device references: two across 35 of 38 registrations.
- No welcome bonus on 33 of 35 new accounts. A cash-out does not want a play-through requirement.
- First deposit to withdrawal request: median 31 hours.
The field that connects this scheme to the others is the destination. The bank references here are what the referral code was in part five and the agent reference in part three: the one thing many accounts share because the scheme cannot help sharing it.
What else looks like this.
A player who did not like the games. Deposited, played briefly, withdrew. Lawful, common, and single: one account, one device, their own bank account.
A group of friends. Several accounts, one evening, perhaps one device. Different bank accounts, and play that looks like people.
A real customer whose account has been taken over. The deposit and the withdrawal to a new bank account may look identical to a mule pattern, and the person is a victim. Three layers of a takeover is about telling the two apart, and the case SIM-swap trader is the forex version.
The long-standing player whose bank account appears on strangers' withdrawals. Lending the account, or having had the number used; a bank account number is not a secret. Write both readings and date them.
Where it is usually caught.
At withdrawal review, when the destination differs from the source, which most regulated operators already treat as a question. this is where most cash-out attempts meet a person, and what that person can see decides the outcome. One account alone is one lawful-looking withdrawal. Six destinations across 36 requests is the shape.
Earlier, at the PSP, when the same card is seen across merchants: the dossier's portfolio alert. Later, at the receiving bank, when a mule's account is frozen and the operator receives a recall it did not expect.
What follows the catch is not the desk's decision. Holding funds, closing accounts, filing with the operator's regulator, and what to do about the long-standing player are questions for compliance and counsel. The desk's job is the observation, both inferences, and a timeline somebody can audit.
A desk card.
- Treat withdrawal-to-a-different-method as the central event, reviewed with the account's neighbours visible.
- Count distinct destinations per group of linked accounts. Few destinations, many accounts, is the signal.
- Compare wagering to deposit before withdrawal, against your own baseline.
- For a long-standing account that appears as a destination, write both readings. Do not pick.
- Hand the decision to the people who own it, with the timeline attached.
Read next.
The money has to leave somewhere. is the full article. Try the case Deposit and withdraw at Lagoon and look up mule account. The whole series, assembled into one investigation with the costs attached, is The Northbank dossier, and it ends with a question this series does not answer either.
Edited 6 November 2026. Primary references are listed above; fictional scenarios are not claims about Antifrog customers or operating experience.
Fictional learning material. Any numerical examples are synthetic. Use only authorised, appropriately minimised records for workplace exercises; do not upload customer information to this learning site.