Predict the scam. Classify the mule. Before a transaction is initiated.
Every scam leaves two accounts behind: the victim emptied and the mule filled. Acoru scores both continuously, your customers and their counterparties. So you see the victim being turned and the mule waiting, before a transaction is initiated.
It reads every event around a customer's account and the entities behind it. As those signals line up into a pattern, the classification shifts from Regular to Victim before the payment screen. An event, not a transaction, moves the score, and the change cascades: it re-scores that account and every account linked to it, across the accounts you hold (Level 1) and their external counterparties (Level 2).
“
At its foundation, nearly every fraud affects a bank account or is tied to a payment that involves a bank account.
Michelle W. Bowman, Vice Chair for Supervision, Federal Reserve Board (May 2026)
The problem
The scam started weeks ago. Your stack only looks at the last five seconds.
Victims and mules are two halves of one crime. Stopping it means understanding their relationship before a transaction is initiated.
In APP fraud, victims send the money themselves. The warning signs sit across the account’s lifecycle: a limit-change inquiry, a new payee, a test transfer. On the receiving end, mule accounts move the proceeds within minutes.
Traditional fraud stacks only see the last several seconds before a payment. In that window, everything checks out: the customer authorizes the transfer, authentication passes, and the device is recognized. By the time transaction monitoring spots a pattern, the money is gone.
Point solutions evaluate individual events and rarely share context. Acoru turns their signals into account-level risk and adds its own: behavioral drift, counterparty and mule-network links, and preparation steps. That includes mule testing, new payees, and raised limits before the cash-out. You keep your stack and see the scam forming, the victim being turned, and the mule waiting.
02
Visibility into the window before the payment
Acoru continuously classifies every account as Regular, Victim, Mule, or Laundering, and separates mule accounts into complicit, witting, and unwitting. It also separates genuine victims from first-party fraud. Laundering accounts move or mix illicit funds. Honeypot accounts are deliberately exposed to gather intelligence on attackers. By the time a customer reaches the payment screen, the risk context is already in place. Low-friction controls fire automatically, and the calls that need a human reach your analysts already backed by evidence.
03
Push and pull at every decision point
Your existing stack queries Acoru across key moments: onboarding, authentication, contact updates, payee creation, product requests, and payment execution.
Acoru also pushes continuously: when an account classification shifts, real-time alerts flow directly to your control systems, so you can intervene before the customer initiates a transfer. That is scam detection and prevention before a transaction is initiated.
04
AI assistance that changes the analyst’s day
Everyone promises fewer false positives. Acoru changes the analyst’s day. Answers no longer wait on a data team: ask in natural language, and the platform builds the dashboard, explains why an account was flagged with links to the evidence, and drafts detection rules with simulation and backtesting. The platform prepares the case. Your analysts make the call.
05
Every decision is explainable
Every intervention carries reason codes and decision logic, captured at the moment of action. The record exists before anyone asks for it. A held payment is defensible, and every decision is documented for governance and ready for internal and supervisory oversight.
Scam Prediction and Mule Classification capabilities
01 / 04
Pre-fraud signal intelligence
Scams leave traces long before the payment: a coached contact change, an unusual login, a device tied to a mule network. Transaction monitoring sees none of it. Acoru flags victim accounts while the scam is being staged, so your team intervenes before a transaction is initiated.
02 / 04
Omnichannel orchestration
Scams cross channels: a fake bank call, a new-device login, a new payee, an instant transfer. Each control sees only its own piece. Acoru resolves activity from every channel to one account, so the risk shows at payee setup, before a transaction is initiated.
03 / 04
Continuous account classification
Every account and counterparty carries a live classification (Regular, Victim, or Mule), updated at onboarding, login, payee setup, and payment. Mules are separated into complicit, witting, and unwitting, because each calls for a different response. Mule-linked destinations at other banks surface from your own data.
04 / 04
AI built for the fraud analyst
Acoru reads each account’s lifecycle as one sequence, so small changes form a scam narrative. AI Workforce runs investigation workflows inside your guardrails. AI Assistant explains every flag in plain language, links the evidence, and drafts new detection rules. An analyst approves each one before it goes live.
01 — 04
Data privacy and residency
Acoru runs on-premises, in your private cloud, or in a hybrid environment.
Single- or multi-tenant: the institution decides where Acoru runs and who operates it. Shared intelligence follows data minimization: only what each purpose needs, within what each jurisdiction allows.
Analyst recognition
Recognised in the Datos Insights Fraud & AML Fintech Spotlight
Selected for our account-centric approach, which identifies risk before payment and supports both fraud and AML decisioning.
New regulation and payment-scheme rule books are moving fraud accountability earlier, to before a transaction is initiated. They are also spreading it across sending and receiving banks.
United Kingdom
Since 7 October 2024, the Payment Systems Regulator's reimbursement requirement has obliged payment service providers to refund victims of authorised push payment (APP) scams on Faster Payments and CHAPS, up to £85,000 per claim, unless the customer acted with gross negligence. The sending and the receiving Payment Service Provider (PSP) split the cost 50:50. Confirmation of Payee checks the name on the account; it cannot tell you the account is a mule.
“Now that both parties in the payment journey (the sending PSP and the receiving PSP) share the cost of reimbursing victims, there is a much stronger incentive for all PSPs to prevent APP scams from occurring in the first place.”
European Union
Since 9 October 2025, the Instant Payments Regulation (IPR) has required Verification of Payee (VoP) on euro credit transfers. A money mule account opened in the right name passes cleanly. Once they apply, the EU Payment Services Regulation and PSD3 will require fraud monitoring, fraud-data sharing, and refunds for consumers deceived by bank impersonators. The mule account is becoming the receiving bank’s problem.
“Mandatory fraud preventive measures will be applied and lead to less payment fraud. Banks have to share more of the burden if they fail to do their part.”
United States
Nacha’s Operating Rules are private-sector rules that bind every Automated Clearing House (ACH) participant by contract. The largest participants have been covered since March 20, 2026, and all others since June 19, 2026. The rules require risk-based monitoring of ACH credits initiated due to fraud, including those made under false pretenses. For a receiving bank, that means watching the credits that land in its customers’ accounts.
“These rules require fraud monitoring by Originators, Third-Party Service Providers, Third-Party Senders and ODFIs to identify ACH credit entries initiated due to fraud, including transactions authorized under false pretenses.”
Which solution is right for you
Holistic Fraud Prevention
If you are replacing legacy tools, consolidating or establishing a fraud stack baseline
When scams or money mules are your biggest challenge, add decisions span the full account lifecycle, with mule and victim subtypes and orchestration built in.
Consortium Manager
Share fraud intelligence with other institutions and see risk beyond the accounts you hold.
Does Acoru replace our transaction monitoring or fraud tools?
That depends on where your stack stands. Scam Prediction and Mule Classification works alongside the transaction monitoring and fraud tools you already run and connects the signals they produce. Holistic Fraud Prevention can replace the components you plan to retire, or provide a modern fraud stack from the start. Either way, you gain insight into the whole account lifecycle, from onboarding to the last transaction, not just the moment a payment is made. Integration adds to your existing detection logic and requires no re-architecture.
Do we need the consortium to get value from Acoru?
No. Your own accounts and their external counterparties deliver value from your own data. The consortium is the upgrade, the accounts with no relationship to any of your customers. Consortium Manager is an optional add-on when you want to share fraud intelligence with other institutions.
How does Acoru get our data?
In whatever form it already exists. Acoru takes structured and unstructured data in any format or schema, and normalizes it on ingestion. You can push data to Acoru through APIs, streams, or queues, or Acoru can pull it from your systems through plug-in connectors. Data can arrive in real time or in batches, as a full snapshot or just what changed. No migration project is needed.
How do our systems get results from Acoru?
Two ways, and you can combine them.
Pull: your systems query Acoru's API endpoints on demand. For example, your payment flow can check a new payee before releasing the payment.
Push: you provide the endpoint, and Acoru sends results to it as they change. This works for your SIEM, transaction monitoring system, core banking system, or case management. Results include scores, classifications, alerts, and executed policies, delivered through queues or standard connectors.
With push, risk changes reach you without waiting for a query. When a re-score cascades across linked accounts, each update arrives as it happens.
What data does Acoru need, and how do we provide it?
Three types: account data, transaction data, and session data.
Account data describes each account and its holder, such as opening date, product, status, and KYC attributes.
Transaction data covers payments in and out, with amount, channel, payment rail, and counterparty.
Session data captures digital activity: logins, device and network attributes, and events such as payee setup or limit changes.
Recent historical data lets the models learn your baseline, so Acoru is useful from day one. Extra sources such as onboarding, device intelligence, or case outcomes sharpen the picture, but you don't need them to start. None of this data leaves your environment. If you join a consortium, only the intelligence you choose to share reaches other members.
How is Acoru deployed?
On-premises, in your private cloud, or in a hybrid environment, single- or multi-tenant. Your institution decides where Acoru runs and who operates the infrastructure. Consortium Manager: each member connects through its own node, with no intermediate storage and no shared database.
![Benefits of Continuous Account Monitoring [A 2026 Guide] cover](/hubfs/acoru-2026/blog/benefits-of-continuous-account-monitoring.webp)
![Cross-Border Banking Regulatory Challenges [+Solutions] cover](/hubfs/acoru-2026/blog/cross-border-banking-regulatory-challenges.webp)
