Cybera Money Mule Intelligence Lands on Mastercard's Recorded Future
AI personas pose as victims to capture the accounts scammers use to cash out, as reimbursement rules shift fraud liability onto banks.
Banks can now screen outgoing payments against a live register of the accounts criminals use to collect the proceeds of scams. Cybera, a New York fraud-intelligence startup, has made its money mule intelligence available through Recorded Future, the threat-intelligence company Mastercard acquired for $2.65bn in 2024. The product flags accounts confirmed to belong to fraudsters, so a fraud team can halt a transfer before the victim's money reaches the account that will launder it.
The approach targets the weakest point in most scam-prevention systems. By the time a victim reports a loss, the money has usually moved and gone cold. Cybera works the other end of the chain, identifying where the money is heading before it arrives.
What does Cybera actually sell to banks?
Cybera supplies confirmed, evidence-backed data on criminal accounts rather than a probability score. To gather it, the company runs AI personas that pose as plausible victims, engage scammers in conversation, and play along until the fraudster shares the account details for payment. Those accounts can then be flagged while they are still in use, ahead of the point at which a victim files a report.
According to Cybera's half-year mule intelligence report, the company logged more than 16,000 confirmed mule accounts across 72 countries in the second half of 2025, and found that 28% of observed accounts stayed active for 30 days or more after they were first identified. That persistence is the commercial opening: an account caught early can be blocked across several banks before it finishes moving funds.
Cybera co-founder and chief revenue officer Claudio Staub says the aim is a smaller number of high-confidence alerts rather than a flood of false alarms, with each flagged account carrying the evidence a bank needs to justify stopping a payment to its customer. In one case cited by Mastercard, a European private bank held a customer's approved €60,000 transfer after the receiving account matched Cybera's list of confirmed criminal accounts.
Why do money mules sit at the centre of the scam economy?
Because every scam that moves money ends in a payment, and the mule account is where that payment lands. Authorised push payment fraud, the category Cybera targets, does not involve hacking: the criminal persuades the victim to authorise the transfer themselves, through a fake investment, a romance, or a bogus job offer. Once the money reaches a mule account it is withdrawn as cash or converted into cryptocurrency, often relayed through further accounts to lengthen the trail.
The losses are large and climbing. Deloitte estimates that US authorised push payment fraud losses will reach $14.9bn by 2028, up from $8.3bn in 2024. The damage is not only financial: a 2025 survey by the Global Anti-Scam Alliance and Feedzai found that close to seven in ten victims reported stress from the experience, and 14% said it caused tension within their families.
Mule networks are also harder to spot than they once were. So-called mule herders can run hundreds of accounts at once and use AI to mimic ordinary behaviour, such as grocery purchases and subscription payments, so the accounts blend in with legitimate customers.
Why are banks suddenly willing to pay for this?
Regulation has changed the economics. Since 7 October 2024, the UK's Payment Systems Regulator has required banks to reimburse victims of authorised push payment fraud, with the cost split 50:50 between the sending and receiving institutions and a cap of £85,000 per claim. For the first time, the bank that holds the fraudster's account carries part of the bill. Other markets are introducing or weighing similar liability and compensation rules.
That shift gives receiving banks a direct reason to find mule accounts inside their own customer base before they are used. Cybera says its intelligence supports this too, helping institutions identify suspect accounts they already hold, with applications beyond scams in account takeover and money laundering.
How does this fit Mastercard's fraud strategy?
It extends a stack Mastercard has been assembling through acquisition and partnership. Cybera's data is sold as an add-on to Recorded Future's Payment Fraud Intelligence, and sits alongside Mastercard's existing tools, including Consumer Fraud Risk, which scores account-to-account payments for both sending and receiving banks, and Decision Intelligence Pro, which applies AI to cardholder behaviour to assess transaction risk.
The partnership also brought Cybera into Mastercard Start Path, the company's startup engagement programme, joining its security solutions cohort in February 2026 as the first Recorded Future partner to do so. For a company that has raised modestly by the standards of the sector, distribution through Mastercard's network is the prize.
Why this matters to FinanceX readers
The reimbursement rules have turned fraud prevention into a balance-sheet issue rather than a service feature. With liability now shared between sending and receiving banks, the institution holding a mule account has a measurable cost attached to missing it, which is what makes confirmed account-level intelligence commercially valuable.
For banks and payment providers, the live question is where verified mule data fits against existing risk scoring, and whether it lowers both losses and false declines at the same time.
For investors, the pattern worth tracking is Mastercard's steady absorption of fraud-intelligence capability around the $2.65bn Recorded Future deal, and how much of the emerging market for scam-prevention data it ends up owning.
