In some operations, long and legitimate-looking employment contracts are sent to the mules during the "recruited process", again to mask the truth by appearing legitimate. The most sophisticated mule recruitment operations, though, have full-fledged CRM systems used to keep track and manage the "employees" and the status of their work. These incredibly sophisticated systems allow the mule herders to go over the details of individuals who replied back, track items or funds sent to the mules and communicate with them through a messaging service. Operations with this level of sophistication are more common than you'd think. So common, that some underground vendors make their living exclusively by offering this type of platform to their nefarious buyers.
If at the beginning only "traditional" mule roles, accepting items bought with stolen credit cards or money sent through a wire transfer, were recruited online - over time fraudsters learned and still learn how to recruit mules for other ventures. "In-store carding" mules, for example. These mules, who were traditionally accomplices of the fraudster, walk into brick-and-mortar merchants with fake plastic cards encoded with stolen credit card information. They purchase high-value items, re-encode the data of another stolen card and then go "hit" other merchants.
'Mystery shopping' position
Today, unwitting mules are recruited specifically for that task, believing they scored a "mystery shopping" position in a company evaluating retailer employees. They go into retail stores with a fake card that was sent to them by the mule herder and purchase an item they were told in advance to purchase. As "mystery shoppers" don't get to keep the items they bought for evaluation, they of course must send the merchandise and the credit card back to their employer (the mule herder), with the promise that their expenses will be added to a promised paycheck.
To completely pull the wool over the mule's eyes, he or she is then requested to complete a detailed survey of the shopping experience at the retailer. The charade continues for an entire month, during which time the mule receives different fake cards for every purchase. Then, when it's time to receive the paycheck for his/her hard work, the boss suddenly stops replying to any e-mails and disappears. The mule herder has already moved on to another mule.
Today, almost all mule jobs have been filled by unwitting victims and it's only a matter of time that fraudsters learn how to recruit them for the rest. Legitimate sites give us a glimpse of what the future holds. Multiple legitimate service providers offer individuals on their websites to apply for a job and perform it from home, much like the mule recruitment scams. Some of them offer positions that would fit well into the fraud ecosystem, such as an over-the-phone "mystery shopper" service.
Sign up for Computerworld eNewsletters.