Mule accounts can remain active for months despite being used to facilitate digital fraud, highlighting the difficulty of detecting illicit financial networks once stolen funds enter the system, according to a joint whitepaper by IDfy Philippines and CIBI Information, Inc.
The report, “Mule Hunting: Are We Chasing Ghosts?,” estimates that the Philippine economy risks losing PHP 603 billion annually to digital fraud without stronger safeguards, equivalent to nearly 3% of national GDP.
BSP data cited in the report shows that PESONet and InstaPay processed PHP 24.74 trillion in combined transaction flows in 2025.
The whitepaper estimates that PHP 1.088 trillion in transactions was at risk of digital fraud. Of this, 55.4% was directly dependent on authorized push payment (APP) scams and account takeovers (ATO), both of which require mule accounts to exfiltrate stolen cash.
One reason mule networks can remain difficult to disrupt is the limited reporting of fraud incidents. Official cybercrime reporting remains under 2%, while CICC data indicates that 34% of Filipinos have experienced financial scam losses.
The report notes that victims frequently do not file formal complaints because of small transaction values and legal complexity. This can leave weaponised mule accounts operational and apparently clean for months.
The supply of mule accounts also comes from multiple sources. The whitepaper estimates that 60% to 70% involve voluntary participation, while 30% to 40% are coerced.
NBI data cited in the report indicates that verified bank and e-wallet accounts are bulk-purchased for PHP 500 to PHP 5,000 through a “mule-for-hire” market.
Coerced participants may be drawn into these networks through sophisticated schemes such as romance-investment fraud and fake remote job scams.
The challenge has grown alongside the Philippines’ rapid adoption of digital payments. The country reached 52.8% retail payment digitalization in 2023, exceeding its 50% target three years early.
The report said transnational syndicates are actively exploiting the vulnerabilities created by this rapid digital expansion.
Regulation is simultaneously changing how financial institutions are expected to respond. AFASA and BSP Circular 1213 fundamentally shift fraud-loss liability from consumers to financial institutions.
Institutions that fail to deploy real-time fraud management systems face full, unlimited reimbursement liability for customer losses.
The circular also limits SMS and Email OTPs to initial account setups and prohibits them for high-risk actions, including fund transfers, payee additions, and credential changes.
The whitepaper calls for multiple layers of protection, including server-side biometrics, cryptographic device binding, and real-time AI behavioral risk scoring.
“Clinging to interceptable OTPs is no longer just legacy technology; under AFASA, it is a direct financial liability for institutions,” said Raghuraman Chandrashekhar, Country Head of IDfy Philippines. “No single institution can close this gap alone. What works is layering device intelligence, real-time AI transaction monitoring, and biometric verification into a unified defense stack.”
The report recommends bringing together Fraud Intelligence Data Sharing (FIDS), AI-driven transaction monitoring, and server-side facial authentication.
By operating these measures in combination and within the AFASA framework, financial institutions can establish an end-to-end defense mechanism designed to address mule networks across the financial system.
For the full version of the report, visit idfy.ph/mule-hunting-whitepaper-landing.