Selling, «renting out» or handing over your bank card, account or banking app access for money makes you a money mule (in Ukraine, a «drop»): fraudsters will push stolen money through your card, and you will be the one held responsible. On 28 October 2026, Ukraine's parliament passed law No. 16013: handing over your own card for fraud carries a fine of UAH 5,100 to 17,000, buying or selling other people's cards up to 4 years in prison, and repeat or group offences up to 6 years. The bank will react even before the police: it will block the account and end the relationship, and victims can sue you for the full amount that went through your card.
Oleksandr Suhak
13 min read
A money mule (in Ukrainian slang, a «drop») is the owner of a card or account used to move other people's illegal money. The mule usually deceives no one: they simply hand over their card, receive transfers and send them on or withdraw cash. But most schemes cannot work without them.
A fraudster who has tricked someone out of money with a fake «bank security service» call, an OLX listing or an «investment project» needs somewhere to receive it. They will not use their own card: it would be blocked quickly and the trail would lead to them. So the money goes to mule cards, then splits into small amounts across dozens of other cards, gets converted into cryptocurrency or withdrawn in cash. Illegal casinos take bets through the same cards, and dealers use them to collect payment for forged driving licences and entries in state registers.
The scale is huge. According to the National Bank of Ukraine, about UAH 200 billion passes through mule cards every year. In 2024 alone, Ukrainian banks ended their relationship with more than 80,000 clients for taking part in such schemes.
Mules are most often young people, students and school pupils, internally displaced people and people without a stable income. Pensioners are a separate group: they get asked to «receive a transfer for a grandson». Many genuinely do not understand what they are part of: «I didn't steal anything, I just gave my card». That is exactly what recruiters count on.
Ads never use the word «mule». The offer is always disguised as a side job, a favour for a friend or a bank bonus. This is how it usually sounds and what is behind it.
| How the offer sounds | What it really is |
|---|---|
| «Rent out your card: UAH 1,000 a week, nothing to do» | Fraudsters use your card. Every transaction is recorded in your name. |
| «Open a card at a new bank, send us a photo and login details, we pay UAH 500» | Buying a ready-made account that will fill up with stolen money within days. |
| «Sell your app access together with your SIM card» | Fraudsters get full control of the account and every confirmation code sent to your number. |
| «Remote job: financial manager, payment operator. Receive transfers, send them on, keep 3%» | A classic mule job. The «clients» sending the money are victims. |
| «Withdraw cash at an ATM and give it to a courier» | The last stage of the scheme: the cash can no longer be traced, but the ATM cameras recorded you. |
| «Receive a transfer for my grandson (friend, relative abroad), he has hit his limit» | The same request from an «acquaintance». Their account may have been hacked. |
| «Register as a sole proprietor and open an account, we pay the taxes» | An account for converting or laundering money. The tax and criminal consequences fall on you. |
The main sign is simple: you are offered money for the card, the account or the transfer itself. Legitimate work does not work that way. An employer never needs access to your banking app, and a real sign-up bonus is paid to you by the bank, which never asks you to hand the card to anyone.
Recruiters work in Telegram channels about «side jobs», in social media comments, on job sites and in school and student chats. Teenagers get personal messages, often from someone posing as a peer. How to talk to your child about this is covered in the money mule section of our article on kids' bank cards.
On 28 October 2026, the Verkhovna Rada passed law No. 16013, submitted by the President, with 270 votes. The law amends the Criminal Code and the Code of Criminal Procedure and adds Article 200-1 to the Criminal Code on illegal actions with payment instruments and account access. This brings Ukraine in line with EU Directive 2019/713 on combating fraud involving non-cash means of payment.
The key change is this. Previously, to punish a mule, investigators had to prove they were an accomplice in a specific fraud or money laundering case. Now handing over, buying, selling or storing payment instruments, login credentials or access to an account or e-wallet is a crime in itself if the purpose is fraud or another crime.
| What the person did | Penalty |
|---|---|
| Handed over their own card, account, login details or account access for fraud or another crime | A fine of 300 to 1,000 tax-free minimum incomes, that is UAH 5,100 to 17,000 |
| Received, bought, stored, sold or passed on other people's payment instruments (buying up and reselling cards) | A fine of UAH 51,000 to 85,000, or restriction of liberty for up to 3 years, or 2 to 4 years in prison |
| The same as a repeat offence or as part of an organised group | A fine of UAH 85,000 to 170,000 or 4 to 6 years in prison |
Fines in Ukraine's Criminal Code are counted in tax-free minimum incomes, and for this purpose one minimum equals UAH 17. So 300 minimums is UAH 5,100 and 10,000 minimums is UAH 170,000.
The law separates the roles. The mildest penalty is for someone who handed over their own card. Much harsher ones apply to those who buy up cards, keep them «in batches» and resell them: recruiters, «handlers» and organisers. The law also widens the grounds for criminal-law measures against companies and sets out who investigates the new offences.
The law takes effect the day after its official publication, and before that the President has to sign it. As of 13 November 2026, legal media had not confirmed that it had been published, so check the status of law No. 16013 on the Verkhovna Rada website zakon.rada.gov.ua.
Waiting for the date is a bad idea, though. Mules were prosecuted before this law too: as accomplices in fraud or money laundering, where penalties are much harsher. If the money went to finance terrorism, the consequences are even more serious. The banking consequences described below apply regardless of the Criminal Code.
Criminal liability in Ukraine generally starts at 16 (Article 22 of the Criminal Code). So a 16 or 17-year-old who «rented out» their card is liable personally. A younger child cannot be punished under this article, but the bank will block the account all the same. The money still has to be returned to victims: under the Civil Code, parents compensate damage caused by a child under 14, and for a teenager aged 14 to 18 without their own money or earnings, parents are additionally liable.
Under the financial monitoring law, banks track unusual activity, and mule cards stand out: transfers suddenly pour in from dozens of strangers, the money leaves immediately, the app is opened from a new phone in another city. The bank responds like this:
After a story like this, opening an account at another bank will not be easy either: you will face closer questions about your sources of income. What to do if your account has already been blocked is covered in the article the bank blocked my card or account.
There is also a risk few people think about. Someone who gave recruiters a photo of their passport, tax number, SIM card or app login has handed over everything needed to take out a loan in their name. How to check this and what to do is explained in the article a loan taken in your name.
Besides a fine and a blocked account, there is civil liability. A person whose money was stolen can see which card it went to. They can sue for the return of unjustly acquired funds (Article 1212 of the Civil Code): whoever received money without a legal basis must return it. For the time someone else's money was used, the court may also award interest (Articles 536 and 1214).
The defendant in such a lawsuit is the card owner, that is, the mule. The court does not care that the money went straight on and you kept only «your» 3%: the full amount arrived on your card. If you do not have the money, an enforcement officer executes the judgment: other accounts are frozen, deductions are made from your salary, your property is listed.
Article 200-1 punishes handing over a card for fraud or another crime. If your mother pays with your card in a shop with your permission, that is not a crime. But there are three caveats.
There are safer options for family. You can open an additional card on your account in a relative's name, get your child their own card with limits, or simply transfer the money. If someone asks you to «receive a transfer and send it on» because someone has «hit a limit», call that person and check. How banks treat transit transfers and when they block cards is explained in the article on card-to-card transfer limits.
You can become a mule without handing anything to anyone. The scheme goes like this: a few thousand hryvnias arrive on your card from a stranger, and a minute later the «sender» writes or calls: «I used the wrong card, please send it back, but to this other card, the first one is blocked». The person honestly returns the money to the card given and becomes a link in the chain: the money was stolen, and the bank sees the transfer to a third card as your transit.
The right way to act:
By law, money received without a legal basis must be returned, so keeping it is not an option either. What matters is returning it through the bank and to the person who actually sent it.
You need to act fast: every day new money from victims can pass through your card.
This article is for information only and is not legal advice. The provisions of law No. 16013 are described from reports by the Verkhovna Rada and legal media as of 13 November 2026. If your card has already been used in a scheme, talk to a lawyer or contact Ukraine's free legal aid system.
Spotted a mistake or an outdated figure? Let us know and we will check it against the primary source and fix it.
Write to redaktsiia@wm2.com.ua: what is wrong and, if possible, a source with the correct information. In Gmail or your mail app the page address will already be in the message.
Fraud schemes, free checks in the NBU Credit Register and credit bureaus, five steps if a loan has already been taken out, and the status of the self-ban.
Step by step: blocking the card, reporting to the bank and police, NBU rules and the Supreme Court position on when a bank must return the money.
Six types of blocks and how to lift each: documents for financial monitoring, suspension periods, debt arrests and two minimum wages a month, automatic lifting, complaints.