Instagram posts fuel surge in money mule recruitment schemes

Criminal networks are using Instagram as a significant channel to recruit individuals as money mules, with nearly one in four posts tagged as "quick-money" offers displaying clear signs of illicit activity, according to an analysis by the compliance firm AMLTRIX.

Instagram recruitment

The review covered over 2,300 posts from 23 high-risk hashtags, such as #moneyflipslegit and #paypalflips. It found that 23.98% of these posts likely served to recruit people to move criminal proceeds. Analysts observed that some hashtags were almost entirely used for money mule recruitment, with more than 80% of posts in certain tags fitting this profile.

Gabrielius Erikas Bilkštys, Compliance Specialist and Founder of AMLTRIX, described the shift:

"While some hashtags like #easymoney or #quickcash are relatively clean and contain only up to 5% of money mule recruitment content, others like #moneyflipslegit, #moneyflippers, or #paypalflips are filled with obvious money mule recruitment posts. In these hashtags, the share of such posts is over 80%," said Gabrielius Erikas Bilkštys, Compliance Specialist and Founder, AMLTRIX.

Systemic challenges

Bilkštys noted that the scale of money mule recruitment on Instagram is mounting beyond the reach of existing anti-money laundering controls. "The scale is staggering. Traditional customer due diligence (CDD) and transaction monitoring systems are not designed to police Instagram. We are seeing the 'social engineering' component of money laundering scale at a rate that challenges existing controls", said Bilkštys.

Bilkštys also raised concerns about social media platforms' approach to this issue, referencing internal Meta documents. According to these, an estimated 10.1% of the company's 2024 revenues-or roughly USD $16 billion-may have originated from advertising categories that include suspected scam and prohibited content. "Platforms have been too slow to act against scam and mule recruitment content because fraudulent advertisers remain commercially significant," said Bilkštys. Meta has disputed the figures, describing their internal estimate as rough and overly inclusive.

Law enforcement concerns

These findings coincide with growing concern among UK authorities. In August 2025, the Financial Conduct Authority (FCA) reported that 226,957 bank accounts linked to suspected money mules were closed by 37 of the country's largest banks and payment companies in the past year. This represented a 23% increase year on year and corresponded to around 0.31% of all personal bank accounts in the UK. Tackling money mule exploitation has since become a top economic crime priority for both the FCA and the National Crime Agency (NCA).

Europol, the European Union's law enforcement agency, has identified Instagram, alongside Facebook, Snapchat, and encrypted messaging apps, as common channels for money mule recruitment. Many of these job offers are advertised as positions such as "money transfer agent" or "payment processor," often targeting financially vulnerable groups, students, and young people aged 12 to 21. Victims are recruited to receive illicit funds and transfer them onward, retaining a small commission and becoming the first step in laundering the proceeds of fraud and cybercrime.

Shifting tactics

Data from the Royal United Services Institute (RUSI) reveals that criminal networks are increasingly utilising seasoned accounts, rather than newly opened ones, to conduct these activities. According to their August 2025 report, about 60% of identified mule accounts were older than one year, and 20% were more than five years old. The same study found that nearly 28% of money moved through these accounts left within 15 minutes, while an additional 25% departed within an hour.

Funds are also concentrated through specific channels. "One PSP in the dataset accounted for 20% (by value) of onward Faster Payments," according to the RUSI report, highlighting how illicit transfers can cluster around particular payment service providers.

Global exposure

The hashtags identified by AMLTRIX are widely used by both UK and US audiences, indicating the global scale of this activity. The prevalence of suspected recruitment content suggests that platforms face ongoing challenges in both detection and removal, while law enforcement and regulatory bodies must respond to shifting tactics and higher transaction speeds.

"We are seeing the 'social engineering' component of money laundering scale at a rate that challenges existing controls," said Bilkštys.