French Freelancer Fintech Accounts Exploited for Large-Scale Money Laundering Cybercriminals are increasingly hijacking French freelancer fintech accounts to launder stolen funds at high speed, often moving money within minutes before banks or victims detect the fraud. Platforms like Revolut, Wise, and N26 designed for fast onboarding, light-touch KYC, and instant SEPA transfers have become prime targets due to their business-level payment capabilities, despite being tied to individual users. In 2024, credit transfer fraud in the European Economic Area (EEA) reached €2.5 billion, with victims absorbing roughly 85% of losses. These accounts are more attractive to criminal networks than standard consumer accounts, as they enable cross-border transfers and payment processing under the guise of legitimate business activity. ### Industrial-Scale Mule Account Operations Fraudsters acquire verified freelancer accounts through a sophisticated, multi-stage process: - Identity Harvesting: Phishing sites and fake financial services (e.g., bogus mortgage portals) collect real French personal data. - SIM Farm Infrastructure: Criminals use SIM modem farms to generate French IP addresses and phone numbers, rotating connections to evade detection. - Social Engineering KYC: Victims are tricked into completing verification, making the process appear compliant to fintech platforms. - Account Handoff: Once verified, accounts are transferred to fraud rings via mobile apps, creating distinct device profiles in telemetry. Dark web markets, including the ASGARD network and actor @astarta_seller1, specialize in selling these accounts, with premium French freelancer profiles fetching $450–$700. France is the primary target, followed by Germany, Spain, Italy, Poland, and the UK. ### Detection Challenges & Broader Impact The fraud ecosystem exploits gaps in point-in-time checks, as each stage of the process sign-up, KYC, and login appears legitimate in isolation. Effective defense now requires linking signals across the full account lifecycle, including infrastructure, subnet continuity, and cross-account connections. The 2025 EBA/ECB Payment Fraud Report highlights the rapid growth of credit transfer fraud, driven by the abuse of instant payment rails. For risk and compliance teams, freelancer fintech accounts must be monitored as part of broader fraud networks, not just individual users.

Fraud Networks Exploit Fintech Platforms in France to Launder Stolen Funds Organized fraud networks in France are deploying a sophisticated scheme to launder stolen money through fake business accounts on freelancer fintech platforms like Revolut, Wise, and N26. These platforms, designed for fast account openings and seamless transactions, have become prime targets due to their business-grade payment infrastructure, including SEPA transfers and invoicing. The operation, tracked as "Bastardaseller" part of the larger ASGARD fraud network specializes in creating and selling verified European business accounts on dark web marketplaces for $200 to $1,000 each. These accounts, known as mule accounts, enable fraudsters to move funds rapidly via instant payment rails, often before detection. In France, nearly 1 in 5 sign-up users was identified as a mule account, with the true scale likely higher. The scheme operates in three phases: 1. Phishing for PII – Fraudsters run phishing campaigns, such as fake mortgage consultation services, to collect victims' personal data. 2. Account Registration – Stolen PII is used to open accounts, with operators masking their location using SIM modem farms to generate French IP addresses and phone numbers. 3. Operational Handover – Once KYC is completed, control shifts to the fraud network via mobile apps, with subnet continuity linking the new login to the original sign-up infrastructure. According to the EBA-ECB Joint Report on Payment Fraud, credit transfer fraud losses in the European Economic Area reached $2.5 billion in 2023, a 25% increase from the previous year, with mule accounts as the primary driver. Detection remains challenging, as the fraud only becomes visible when analyzing the full account lifecycle rather than isolated transactions. Fintech platforms are urged to monitor MVNO IP addresses, sign-up velocity patterns, and device downgrades between KYC and operational phases to disrupt these networks. The attack underscores the growing threat of structured fraud operations exploiting digital financial services.

Revolut suffered from a cyber attack incident that compromised the personal details of more than 50,000 people. An unauthorized third party had access to some of their information as a result, including contact and transactional details, card information, pin numbers, and passwords were not collected. Revolut advised affected customers to be extra cautious as there may be an increased risk of impersonation or fraud.