Incognia has published data showing that 81% of financial institutions have reported a rise in mule account handover fraud.
The company, which provides cross-device risk intelligence, said the findings point to a broader industrialisation of fraud, with organised networks increasingly using legitimate financial accounts to move money across borders. According to Incognia, so-called ‘scam cities’ operating across Southeast Asia are functioning more like commercial enterprises than traditional criminal groups, deploying teams that manage hundreds or thousands of devices to run scams, including sextortion, so-called pig-butchering schemes, and other forms of financial fraud.
Mule accounts and cross-border handovers
Rather than stealing identities outright, the networks described by Incognia recruit so-called money mules to open accounts that pass standard identity verification checks. Those accounts are later handed over to operators based in other countries, who can then use them without needing to falsify an identity. Incognia’s report, titled ‘State of Mule Account Handovers 2026’, found that 64% of financial institutions have suspected or confirmed cross-border mule account handovers, indicating that some institutions may unknowingly host accounts controlled by overseas fraud operations.
Incognia said investigators have also documented the physical infrastructure supporting these networks, including large compounds where workers operate clusters of devices and accounts from shared locations. These patterns, the company noted, can be difficult to detect when individual accounts are assessed in isolation rather than as part of a broader network.
Erin West, founder of Operation Shamrock, a group that works with law enforcement on these cases and has visited fraud compounds in Cambodia, said the operations combine people, technology, and infrastructure to target victims globally, and that understanding conditions on the ground clarifies the role played by the financial system.
Detecting patterns across devices and behaviour
André Ferraz, CEO and co-founder of Incognia, said fraud networks have adapted to make individual accounts appear legitimate, but that assessing device, location, and behavioural signals across multiple accounts can reveal connections that are not visible when accounts are reviewed individually. A cluster of devices linked to a single location, he said, can indicate patterns distinct from those of a single account viewed on its own.
Incognia noted that fraud farms using large numbers of devices to open accounts, generate fake activity, or facilitate bonus abuse are not new, but that the scale of these operations and their integration with the financial system have expanded. At the same time, the company said this shift presents a challenge for financial institutions, as fraud may originate not from a fraudulent identity, but from a legitimate account later absorbed into a larger, coordinated operation elsewhere in the world.
