Bank Drop
A bank drop is an account opened for the purpose of receiving fraudulent funds and then abandoned. It is the financial counterpart of a drop address: a disposable endpoint that separates the fraudster from the money. Unlike a compromised account, it was never legitimate — which means it is visible at opening and almost invisible afterwards.
| What it is | An account opened to receive fraud proceeds, then abandoned |
| Distinct from account takeover | The account was never a real customer’s |
| Distinct from a money mule | A mule is a real person’s real account, recruited or coerced |
| Opened with | Stolen identities, synthetic identities, or purchased ready-made |
| Typical lifespan | Days to weeks — long enough to receive and forward |
| Sold as a commodity | Advertised on criminal markets, priced by institution and limits |
| Preferred institutions | Whichever have the lightest onboarding at the time |
| Only reliable control point | Account opening |
Drop, mule, and takeover are three different things
These get used interchangeably and behave completely differently, which matters because each is caught somewhere else.
| Bank drop | Money mule | Account takeover | |
|---|---|---|---|
| Whose identity | Stolen, synthetic, or fabricated | A real person’s, truly theirs | A real customer’s |
| Is the accountholder real? | No | Yes | Yes — and they are a victim |
| Opened legitimately? | No | Yes | Yes |
| Where it is catchable | Account opening | Ongoing monitoring of flows | Login, step-up and recovery |
| What it looks like later | A normal account, briefly | A normal account, indefinitely | A normal account behaving oddly |
The mule is the hardest of the three to detect, because everything about the account and the person is genuine. The bank drop is the easiest — but only at one moment. Once opened, it behaves like any other new account until it starts receiving, and by then the funds are moving.
Why drops are bought rather than made
The economics are worth understanding because they explain why this is an industry rather than an individual activity.
Opening accounts at scale is work: identities must be assembled or stolen, applications completed, verification passed, and each institution behaves differently. Running a scam is different work. So the two separated, and bank drops are now advertised and sold as a commodity on criminal markets — priced by institution, by the limits the account carries, and by whether it comes with access to the associated phone number and email.
Two consequences follow. Sellers gravitate to whichever institutions have the lightest onboarding at any given moment, which means a bank’s verification standard determines its share of this traffic more directly than its fraud controls do. And because drops are inventory rather than one-offs, they are opened in batches — which leaves the shared attributes that entity resolution and fraud ring detection exist to surface.
Why this matters for identity verification
A bank drop is new account fraud where the account is the product rather than the objective. Nobody wants credit; they want a place for money to land.
That changes where the scrutiny should be, and usually is not. A deposit account application involves no lending decision, so it attracts less underwriting attention than a card or loan — while being the more useful thing for a fraudster to hold. The account does not need a limit. It needs to exist, receive, and not be traceable.
Database and bureau checks do not close it, for the familiar reason: a synthetic identity built around a real identification number validates correctly, and a stolen identity validates because every data point is accurate. What they cannot do is establish that the person applying is the person the data describes. An authenticated document bound to a live face answers that, which is why identity document verification at opening is the only control positioned to see a drop before it is used, and why synthetic and stolen identity defenses target the population these accounts are built from.
What controls can’t do
Transaction monitoring sees it late. By the time the flows look wrong, the account has already received and forwarded.
Closing the account does not recover the money. Funds are moved out within hours, often through several further accounts.
Blocking one institution displaces the traffic. Sellers move to whichever bank is currently easiest, so a single institution tightening its standards exports the problem rather than ending it.
Tightening opening excludes real customers. Deposit accounts are the entry point to the financial system, and raising the evidence bar falls hardest on people with the fewest documents.
Frequently asked questions
What is a bank drop?
An account opened specifically to receive fraudulent funds and then abandoned. It is opened using a stolen or fabricated identity rather than belonging to a real customer, and it typically operates for days or weeks before being discarded.
What is the difference between a bank drop and a money mule?
A bank drop is an account that was never legitimate — nobody real is behind it. A money mule is a real person using their own genuine account, recruited or coerced into moving someone else’s criminal funds. The drop is catchable at opening; the mule is not, because everything about it is genuine.
Why are bank drops sold rather than created by the fraudster?
Because opening accounts at scale and running scams are different kinds of work, so the activities separated. Drops are advertised on criminal markets priced by institution, account limits, and whether associated phone and email access is included.
How are bank drops detected?
Reliably, only at account opening — by verifying that a real, correctly identified person is applying. Afterwards they look like ordinary new accounts until funds start arriving. Because they are opened in batches, shared attributes across applications are the other useful signal.
Related reading
- Money mule — the genuine-account version, and why it is harder to see
- Drop address — the physical counterpart, for goods rather than funds
- New account fraud — the wider category, where the account is usually the objective
- DDA fraud — why deposit accounts attract less scrutiny than they warrant
