I just wanted to take a minute out and write about something I see far too often. Someone gets a message like: "You have a bank account? I pay €500 just to use your IBAN for a few days. Zero risk. 100% legit."
It is not easy money. It is money laundering, and the person whose name is on the account is the one who carries the risk.
We work on bank and EMI account opening and IBAN programs, so I see the other side of this. Banks spend real money verifying who you are. That is exactly why your verified account is worth so much to criminals.
What IBAN sharing actually means
IBAN sharing, also called account renting or "hesap kiralama" in Turkey, is letting someone else use your bank account to receive and move money that is not yours. Sometimes you only hand over the IBAN. More often you hand over everything: online banking login, debit card and PIN, the phone with the banking app, at times the SIM card too.
The person whose account gets used is a money mule. Europol is clear that money muling is a type of money laundering. Even if you never spoke to a victim, you are treated as an accomplice.
How it works, step by step
Recruitment. A recruiter, often called a herder, finds account holders and pays them a one-off fee, a monthly "rent" or a percentage of what passes through.
Handover. The account holder gives over the IBAN, or full control. In one Turkish case, recruiters activated banking apps on new phones and SIMs in the account holders' names, and then shipped the phones to Istanbul on intercity buses.
Receiving. Victims of fraud are told to pay into that IBAN. The payee looks like a real person, not a scammer.
Forwarding and layering. Within minutes or hours, the money moves on to other mule accounts, out as cash, or into crypto. The FATF's 2023 report on cyber-enabled fraud describes this pattern: pass-through accounts across banks and countries, with funds converted into e-money, prepaid cards or virtual assets.
The volumes can be large. In February 2025, Adana police broke up an illegal betting network that was renting other people's bank accounts for 15,000 TL a month and moving up to 2 million TL a day through them, and routing funds through crypto to hide the trail.
Who is behind it
Behind the recruiter there is usually one of these:
Fraud rings. Europol says more than 90% of money mule transactions identified through the European Money Mule Actions are linked to cybercrime: phishing, online shopping fraud, business email compromise and CEO fraud, romance scams and booking fraud. In the UK, authorised push payment (APP) fraud cost £450.7 million in 2024, and investment scams alone took £144.4 million.
Business email compromise crews. In April 2025 Eurojust described a Romania-based group that recruited hundreds of mules, sending some to the UK to open accounts, to launder at least €3 million from fake invoice emails.
Laundering-as-a-service. In a 2024 case, Europol described a crypto "rip deal" gang that handed its laundering to two separate mule-recruiting networks because it lacked the skills to clean over €10 million itself.
Ransomware and account takeover proceeds. In December 2025 US authorities took down E-Note, a service that, according to the FBI, moved more than $70 million from ransomware attacks and account takeovers through its exchange and an associated mule network.
Illegal betting. In Turkey, rented accounts are a core part of the illegal betting business. Akhisar police detained ten people aged 19 to 30 in May 2025 for collecting accounts with a "give your account, earn easy money" pitch and using them for betting and fraud.
Why criminals need your IBAN
So why your account? Because it solves four problems for them at once.
It breaks the money trail. Each hop through another person's account at another bank adds another investigation, and often another country.
It borrows a clean identity. Your account has passed KYC and has a normal history, so payments into it look normal. Lloyds Bank says criminals intentionally target previously law-abiding people who opened and used their accounts legitimately, precisely to avoid detection.
It gets past fraud controls. Payee name checks and risk scoring look better when the payee is a real person. The UK's National Crime Agency also noted, in its review of the EMMA 10 operation, that fintech accounts are an enabler because they are quick to open and popular with young people.
It shifts the blame. When police follow the money, the first name they find is yours.
Who gets targeted, and how
Europol lists the most targeted groups as newcomers to the country, unemployed people, students and people in financial hardship, mostly under 35, and warns that criminal groups have started recruiting people aged 12 to 21.
UK. Cifas recorded 34,476 suspected money mule cases in 2024, with people under 30 accounting for 61%. In 2025 a new filing category alone produced over 22,000 mule cases, while misuse-of-facility cases jumped 43% to more than 106,000.
Netherlands. Research by the Dutch Banking Association found that almost one in ten young people had been asked to lend out their bank card or account.
Turkey. In Batman alone, the local bar president told Sözcü that close to 20,000 case files had been opened in 18 months against people who let others use their accounts, and that recent high-school graduates and university applicants were the main targets.
Australia. The Australian Federal Police warned in November 2025 that departing international students were being offered AUD 200 to 500 for their bank accounts, plus around 10% commission on what passed through.
Cifas says herders set up fake profiles, join social media groups and post a luxury lifestyle to sell muling as low risk. Europol also flags fake job ads for "money transfer agents", direct messages on WhatsApp, Viber and Telegram, and approaches in person on the street.
Example one: the student and the €500 DM
This is a composite, illustrative scenario. It is not a real case.
Elif is 20, a university student short on rent. A guy she half-knows from a campus Instagram account messages her: "You have a bank account? I can pay you €500 to use your IBAN for one week. My cousin's crypto business hit its daily limit. Nothing illegal, everyone does it."
He moves the chat to Telegram and asks for her IBAN, then her online banking login "so you don't have to do anything", and then a photo of her ID. He pays €100 upfront to build trust.
Over five days, eleven payments land in her account from people she has never heard of: €1,200, €850, €3,400. Each is gone within the hour, sent on to other accounts or to a crypto exchange.
On day six the bank freezes the account. One payer was a pensioner caught in a fake investment scheme.
The Telegram account is deleted. Elif is left with a frozen account, a bank exit letter and a police interview. Every payment record shows her name, not his. In the UK, she can expect a Cifas marker. In Turkey, she faces a fraud investigation under TCK 158, possibly one per victim complaint.
Example two: the job seeker who became a "payment processor"
This is also a composite, illustrative scenario.
Daniel is 34, out of work and in debt. He sees a listing for a "Remote Financial Assistant / Payment Processing Agent" at a European logistics firm. €2,000 a month plus commission, no experience needed.
After a short video call, he gets a contract from a free webmail address. His job: "clients" will pay invoices into his personal account because the firm is "still opening its local bank account". He forwards each payment to a supplier abroad or buys USDT through a recommended app, and keeps 8%.
For three weeks it works. Then his bank calls. The payments came from business email compromise: companies had been sent fake invoices carrying his IBAN. The bank closes his account and reports him, and police interview him under caution.
Daniel genuinely thought it was a job. That helps, but he still received stolen funds, moved them on and kept a cut. In the UK, the BBC covered a real case where a young man's account was closed and he was told he couldn't have a bank account for up to six years. It took him three appeals to the Financial Ombudsman and ten months to get the marker removed.
From a banking point of view, I would simply ask: why would a real company need your personal account to receive its revenue?
What you face if you say yes
People tend to think the worst case is losing the account. It is usually much more than that.
Criminal charges. In the UK, letting someone use your account this way can carry up to 14 years in prison. In Germany, money laundering under §261 of the Criminal Code carries up to five years, up to ten in serious commercial or gang cases, and even reckless failure to realise the money was criminal carries up to two years. Berlin police warn specifically about "Finanzagent" job offers. In Spain, police in Elche arrested two men aged 20 and 21 for fraud and money laundering; one had been promised €50 and ended up with five accounts in his name linked to scams in five cities. In the US, money laundering conspiracy carries up to 20 years.
Turkey specifically. Account renting is usually prosecuted as participation in qualified fraud under TCK 158/1-f, which carries 4 to 10 years. Law No. 7589 (the 12th Judicial Package), published on 31 July 2026, added a new paragraph 158/4 that halves the sentence where someone's role was limited to handing over their IBAN, card or account access. As such, it is a reduction, not an amnesty, and it does not apply if you withdrew cash, moved the money on or recruited others. The law text is on Mevzuat.
Arrests at scale. Europol's EMMA 9 operation in 2023, run with 26 countries and 2,822 banks, identified 10,759 money mules and 474 recruiters, and led to 1,013 arrests. In the US, a three-month Justice Department campaign took over 4,000 actions against mules, from warning letters to prosecutions.
Debanking and fraud databases. Lloyds lists the consequences as being blocked from opening a bank account for up to six years, being listed on the Cifas National Fraud Database, and losing access to mortgages, loans and even phone contracts. Its mule-hunting team has found more than 160,000 mule accounts since 2018.
Repayment and civil liability. The Dutch Banking Association warns that mules can be held liable for the damage: "you think you'll make an easy 50 euros, but then you spend years paying back thousands."
Education and immigration. Cifas and UK Finance warn that students can lose their place at university. The AFP warns that international students risk criminal charges, visa cancellation and permanent bans from returning to Australia, where money laundering carries a maximum of life imprisonment.
Coercion. UK police note that criminals often want to repeat the process and may use intimidation if you refuse.
Red flags
Please be cognizant of these:
Anyone offering money to "use", "borrow" or "rent" your IBAN, card or account.
A job where the main task is receiving money and sending it on, or buying crypto with it.
A company that "can't open its own bank account yet".
Recruitment through DMs, Telegram or Snapchat, with interviews by chat only and a free webmail address.
Words like "zero risk", "legit", "100% guaranteed", "same day cash".
Requests for your login, PIN, ID photo, or a new SIM or phone in your name.
How to say no, and what to do if you are already involved
Saying no needs no long explanation: "Thank you, but I do not share my bank account with anyone. Please do not contact me about this again." Then report the profile.
If you are already involved, please act now. Europol and the US Justice Department give broadly the same advice on the first three steps:
Stop moving money. Do not forward anything still sitting in your account, even if they threaten you.
Call your bank's fraud line and tell them exactly what happened. Change your passwords and ask about a new card or account.
Report it to the police. In the UK that is now Report Fraud, which replaced Action Fraud in December 2025. Elsewhere, go to your national police. In Germany, §261(8) gives an exemption from punishment if you report voluntarily before the offence is discovered and help secure the funds.
Keep everything. Chats, usernames, screenshots, transfer receipts. In Turkish cases, lawyers stress that these records shape the very first statement and whether intent can be shown.
Get a lawyer before any police interview, and if you receive a fraud marker, challenge it through the database or the ombudsman.
An IBAN looks like a harmless string of letters and numbers. To a bank, a regulator or a prosecutor, it is your name. Please do not rent it out.
If you run a bank, EMI or payments business and wish to discuss mule controls, I remain available.