Grey Banking Intelligence
We track

Know the mule accounts
before the money lands

Under the UK's mandatory APP-scam rules you now share the cost of every mule account you host. Confirmation of Payee confirms the name matches the account — we tell you the account is a mule, with the evidence behind every flag.

See how it works
Scroll to explore
Sample intel — illustrative synthetic
50%
Your share of every APP reimbursement on a mule you host // UK PSR
£85k
Reimbursement cap per claim // FPS & CHAPS
37%
Of offboarded mule accounts reported to the NFD // FCA
194k
Mule accounts UK firms offboarded in 21 months // FCA
// the maths One prevented APP claim — up to £85,000 you don't reimburse — and a mule network you've mapped for next time.
The blind spot

Blocking one account doesn't stop the mule

Anti-fraud stacks run on internal signals — device, behaviour, IP. The FCA found firms over-rely on outbound monitoring while inbound mule funds go unchecked — and that the same operator is a mule across other banks you can't see.

Close the account in one bank and the operator simply opens another somewhere else. The intelligence has to follow the entity, not the account.

01
Mule opens an account at Bank A
You.Grey surfaces it from upstream supply
02
Bank A blocks the account
03
Same operator opens at Bank B
Already flagged — the entity is known
Two ways to deploy

One feed. Two decisions

Plug into the moment that matters — screening an outbound payment, or sweeping the mule accounts already living inside your bank.

01 — Beneficiary screening

Stop the outbound payment

Confirmation of Payee confirms the name matches the account. It can't tell you the verified account is a mule. A point lookup against our base does — in real time, even when the account sits at another bank — returning a verdict and its evidence.

  • Real-time, in the payment flow
  • Covers beneficiaries at any institution
  • Privacy-safe: query a requisite, not browse the base
02 — Mule account screening

Catch the mules inside your bank

Check account holders against our base — at onboarding, before you open the account, and continuously across your existing customers. If anyone you bank is flagged as a mule anywhere, you know in real time — before a victim pays or a reimbursement claim lands.

  • At onboarding: is this applicant a known mule?
  • Across your book: existing customers re-checked in real time
  • Scoped to your institution · evidence with every record
Why we see it first

Collected upstream, not chased downstream

Others message a scammer and wait for a payment requisite — always a step behind. We collect at the source of supply, where the accounts come from.

/ 01

Upstream by design

Scammers don't open accounts in their own name. They source them from grey exchangers, P2P desks and drop markets — that's where we are.

/ 02

Entity, not account

Scammers run accounts across many banks. We resolve the operator behind them — so a mule blocked at one institution is already known at the next.

/ 03

One feed, every rail

Bank accounts, wallets, payment apps, URLs and phones — correlated by campaign into a single multi-rail feed.

Inside an indicator

Every flag, opened up

No black box. Each record arrives with the evidence behind it — so your team and your auditors can see why it's flagged, and clear the evidential bar to file an NFD marker.

indicator · bank account · redacted scam
identifier23-14-•• · ••••5544
institutionRevolut · GBP · Faster Payments
sourceinvestment platform · tradex•••.io
typologyinvestment scam (APP)
linked operator#A1F · 14 accounts in 3 banks
evidencedeposit page + payee · screenshot
first seen2026-06-19 14:08 UTC
last seen2026-06-21 09:42 UTC
illustrative record · fields masked · real evidence shown under NDA
Coverage

Every rail a mule receives on

Complete coverage across the payment methods mules actually receive on — each indicator mapped automatically to the issuing institution.

Bank transferInstant paymentsE-money / EMI CardCardPayment appsCrypto wallets
Sourced & corroborated

Breadth upstream,
confirmation downstream

Candidate accounts are surfaced early and confirmed against independent signals before they reach your feed. Every indicator carries a label you can filter and act on:

low · watch grey · mule scam · block

// collection methodology disclosed under NDA

Built for regulated buyers

No black-box accusations

We publish intelligence indicators with a basis — never a verdict on a person. Each flag is reviewed for precision before delivery, controlling false positives and defamation risk.

Data handling by design

Built to UK & EU GDPR. Processed on a legitimate-interests basis for fraud prevention, scoped to your institution, minimised by default.

Drop-in delivery

A real-time API and a scoped batch feed that drop into your existing transaction-monitoring and case-management — no re-platforming. Webhook, CSV/JSON; STIX/TAXII on request.

Design partner programme

Onboarding a small number of UK banks

Shape the feed against your own rails and decisioning, and get first access before general availability.

Apply as a design partner →
Request access

See your bank's exposure

Book a working session — we'll show the intelligence surfacing against every rail your mules use, live.

Contact Sales