Why Does Perfect KYC Fail Against Mules?
Because the documents are genuine, they simply belong to someone paid a few thousand rupees a month to lend their identity, or to a synthetic person assembled from real components. Onboarding checks authenticate paper; mule networks industrialise authentic paper. The tell is never in the documents. It is in the behaviour that follows.
What Behavioural Signals Expose Mules?
The post-onboarding pattern set:
- Dormancy then sudden velocity, the account 'activates' when the network needs it
- Pass-through signatures: credits dispersed within minutes, balances hovering near zero
- Geography mismatch: login locations and device fingerprints unrelated to the KYC address
- Many-to-one-to-many flows characteristic of collection and layering hops
- Cluster births: batches of accounts sharing devices, IPs, nominees or referral chains
Where Does Investigation Extend Analytics?
Analytics flags; investigation attributes: field verification of account holders, finding the recruited student or the non-existent tenant; recruiter-chain mapping through the money and referral trails; linkage across cases connecting one network behind hundreds of accounts; and complaint-grade files for banks, cyber cells and the national reporting pipeline. Garuda supports lenders and platforms on exactly this handoff from alert to actionable network case.