Criminal networks are successfully using Instagram to recruit individuals, with nearly one in four "quick-money" posts on the platform showing clear indicators of soliciting participants for criminal money mule schemes, a new analysis by AMLTRIX warns.
Company analysts reviewed over 2,300 posts across 23 high-risk hashtags associated with "quick-cash" offers (such as #moneyflipslegit and #paypalflips) and found that 23.98% were "likely recruitment" posts. These posts often mimic legitimate job offers but are designed to transform unsuspecting individuals into key components for laundering the proceeds of fraud and cybercrime.
The analysis, which was conducted on a fresh account with no prior history, also found that some hashtags are almost entirely controlled by criminals. "While some hashtags like #easymoney or #quickcash are relatively clean and contain only up to 5% of money mule recruitment content, others like #moneyflipslegit, #moneyflippers, or #paypalflips are filled with obvious money mule recruitment posts. In these hashtags, the share of such posts is over 80%," said Gabrielius Erikas Bilkštys, a compliance specialist and founder of AMLTRIX.
"The scale is staggering," Bilkštys added, "Traditional customer due diligence (CDD) and transaction monitoring systems are not designed to police Instagram. We are seeing the 'social engineering' component of money laundering scale at a rate that challenges existing controls”.
Bilkštys argues that platforms have been too slow to act against scam and mule recruitment content because fraudulent advertisers remain commercially significant, pointing to the Meta documents reported by Reuters that claim 10.1% of Meta's revenues in 2024 (or approximately $16 billion) likely came from advertising categories that included suspected scams and other prohibited content, with one document estimating around 15 billion ‘higher-risk’ ads shown per day. Meta has disputed this characterisation, saying the internal estimate was rough, overly inclusive and that the true share is lower.
Although the hashtags AMLTRIX has sampled are global and popular with both UK and US audiences, the prevalence of suspected recruitment content on Instagram aligns with growing concern among UK authorities about large-scale money mule exploitation. In August 2025, the UK's Financial Conduct Authority (FCA) revealed to the Financial Times that 37 of the country's largest banks and payment companies had closed 226,957 accounts belonging to individuals identified as money mules, a 23% increase from the 184,935 closed the previous year, and around 0.31% of the total number of personal bank accounts in the UK. This exploitation has been officially designated as one of the top nine "system priorities" for economic crime in July 2025 by the UK's National Crime Agency (NCA) and the FCA.
The recruitment mechanism
In its public awareness guides, Europol, the European Union's law enforcement agency, explicitly names "Facebook posts in closed groups, Instagram, Snapchat" and "instant messaging apps (e.g. WhatsApp, Telegram)" as common recruitment channels.
These "jobs" often carry titles like "money transfer agent" or "payment processor" and promise fast, easy cash for minimal effort. As a safeguarding concern, Europol notes the primary targets are often people in economic hardship, students, and newcomers to a country, with a recent focus on especially young demographics aged 12 to 21.
Recruits are directed to receive illicit funds into their personal bank accounts and then transfer them to another account, keeping a small commission. They become the first "layer" that separates high-volume predicate crimes, such as online fraud or romance scams, from the criminals who profit. Europol’s August 2025 data indicates that over 90% of money mule transactions are linked to a preceding cybercrime.
The mules in the machine: a look at the data
The nature of mule networks is evolving, presenting new AML typologies that challenge traditional bank monitoring. A detailed report from the Royal United Services Institute (RUSI), published in August 2025, used transaction data to analyse how these networks operate.
The findings from ‘Following the Fraud: The Role of Money Mules’ show that criminals are not just using new accounts, in fact, many are "seasoned" accounts, with the report finding "about 60%" were older than one year and "20% of known money mule accounts were older than five years".
This data highlights serious challenges for any risk-based approach transaction monitoring integration:
● Speed: The money moves with extreme velocity. The RUSI study found that "nearly 28% left the account within 15 minutes and a further 25% left within an hour" of arrival.
● Concentration: The funds are not just scattered; they are channelled. The RUSI report itself noted that "one PSP in the dataset accounted for 20% (by value) of onward Faster Payments".
Methodology:
AMLTRIX analysed Instagram search results for a curated list of hashtags associated with quick-cash offers and online recruitment. For each hashtag, we recorded the total number of posts visible at the time of collection (9-12 November 2025) and manually reviewed the first 100 results using a brand new account with no prior search, follow, or viewing history.
A post was coded as likely money mule recruitment if it contained at least one of the following:
1. Clear recruitment or “easy money / quick profit / flip” messaging;
2. Explicit offers to move, receive, or “multiply” funds via personal bank accounts, cards, or payment apps;
3. Directions to continue the conversation via encrypted or external channels (e.g. Telegram, WhatsApp, Signal) in the context of a financial offer.
Posts that were ambiguous, purely promotional, lacking these elements or related to other scams, were not classified as money mule recruitment. Hashtags with fewer than 500 posts at the time of sampling were excluded to focus on tags with meaningful reach. This review provides an indicative snapshot, not an exhaustive measurement of the full scale of activity.
Posts with the following hashtags were analysed: #moneyflip, #moneyflips, #moneyflippers, #moneyflipper, #moneyflipslegit, #legitmoneyflip, #flippingcash, #paypalflip, #paypalflips, #paypalflip💸💰💵🏦, #cashappflip, #cashappflipss, #cashappflips, #cashappflipmoney, #easymoney, #fastcash, #quickcash, #getpaidtoday, #doubleyourmoney, #realmoneytransfer, #banklogs, #fullz, #ukcashflip.
The full list of hashtags with numbers of posts, percentage of posts possibly related to money mule recruitment and the number of posts possibly related to money mule recruitment can be sent separately.