The Job Was Fake. The Bank Accounts Were Real: Inside Singapore’s Work-Permit Mule Scheme

A valid identity does not always mean legitimate intent. A genuine work permit does not guarantee a genuine job, and an account opened by a real customer can still become part of a criminal network.

That is the central lesson from a recent Singapore case involving a Sarawak-based syndicate that allegedly used work permits to bring 27 money mules into Singapore, enabling them to open local bank accounts that were later handed over for illegal use.

The middleman facilitating the arrangement was sentenced to six years and one month in jail and fined S$6,000. He helped the mules open 107 accounts across six Singapore banks. More than S$1.84 million eventually flowed through those accounts, with around S$20,300 traced to scam reports.

For financial institutions, the case exposes an important gap between identity verification and customer intent. The people and documents could appear legitimate at onboarding, while the real purpose was allegedly to create bank accounts for a criminal network.

That is why financial crime controls cannot stop once identity has been verified. They also need to assess whether customer behaviour after onboarding matches the stated purpose of the relationship.

How the Work-Permit Mule Scheme Worked

According to court documents, a member of the syndicate approached middleman Ong Toon Nong in May 2024 looking for Singapore companies that could apply for work permits for Malaysians.

Ong knew the individuals had no intention of working in Singapore. The permits were allegedly obtained so they could enter the country and open local bank accounts.

He acted as an intermediary between the syndicate and a Singapore-based person involved in submitting the work-permit applications. Passport photographs, medical records and instructions on which banks the mules should approach passed through him.

Once the accounts were opened and handed over, instructions were given to cancel the work permits.

The arrangement effectively turned a legitimate administrative process into an account-acquisition pipeline.

Ong received S$1,800 for each successful work-permit application, passing S$1,600 to the person submitting it and retaining S$200. He earned between S$5,000 and S$6,000 during the four months he participated in the scheme.

The accounts were intended for illegal purposes, including online casinos and online gambling, while some were ultimately linked to scam proceeds.

When Legitimate Onboarding Creates Illegitimate Accounts

What makes the case particularly relevant to banks is that the mule accounts were not necessarily created using stolen identities or fabricated documents.

A customer could present a genuine passport and a valid work permit and successfully complete conventional identity checks.

The risk emerged from what happened around and after onboarding: the purpose for entering Singapore, the opening of multiple accounts, the surrender of those accounts and the subsequent transaction behaviour.

This is why KYC should not be treated as a one-time verification exercise.

A genuine customer can still be recruited specifically to provide financial access to someone else. Once an account is handed over, the person controlling it may bear little resemblance to the customer profile established during onboarding.

Financial institutions therefore need to ask not only whether the applicant is genuine, but whether subsequent account behaviour remains consistent with the customer's stated employment, income and purpose for opening the account.

How Mule Networks Can Hide Across Multiple Banks

Twenty-seven individuals allegedly helped create 107 bank accounts across six banks, averaging almost four accounts per mule.

That scale matters because a syndicate can distribute activity across multiple institutions. Each bank may see only one customer or a small number of accounts, while the criminal network sees a much larger pool available for receiving and moving funds.

Connections between customers therefore become critical.

Several individuals may share similar immigration circumstances, employers, introducers, addresses, contact details, devices or beneficiaries. Accounts may become active within similar periods, receive payments from unrelated third parties or move money in ways inconsistent with the customer's stated employment profile.

Any one of these signals may appear weak in isolation. Together, they may point to an organised mule-account network.

Red Flags Banks Should Watch

Work-permit-linked mule schemes can create warning signs during onboarding and after accounts become active.

Financial institutions should pay closer attention when recently arrived customers open several accounts within a short period, particularly where expected salary, employment details and subsequent banking activity do not align.

Post-onboarding behaviour can provide stronger signals. Accounts receiving funds from numerous unrelated parties, followed by rapid withdrawals or onward transfers, may warrant further investigation. A lack of normal salary credits or everyday spending despite an account being opened by an apparent employee can also create inconsistencies.

Other relevant indicators include shared employers, introducers, addresses, devices or contact details across customers; similar transaction patterns across multiple accounts; unusual beneficiary relationships; abrupt changes in account usage; and connections to scam reports, gambling activity or known mule networks.

The strongest signal rarely comes from one indicator. It emerges when institutions connect onboarding information, customer behaviour, transaction activity and network relationships over time.

From Emerging Mule Typology to Financial Crime Control

This case illustrates why financial crime is a network problem.

One institution may see a valid work permit and a new customer. Another may see the same person opening an additional account. Suspicious transaction activity may only emerge later. Without broader intelligence, each institution can be left seeing only one part of the pattern.

Tookitaki is the intelligence ecosystem. The AFC Ecosystem brings together typology intelligence, risk patterns and emerging threat insights from the financial crime community, helping institutions widen their view beyond threats already encountered inside their own environment.

A typology such as work-permit-enabled mule recruitment can therefore inform how institutions assess onboarding behaviour, related customers, account-opening patterns and subsequent transaction activity.

FinCense turns that intelligence into control, helping teams translate emerging typologies into deployable controls and adapt them as threats evolve.

The outcome is straightforward: identify threats sooner, adapt controls faster and respond with greater confidence.

The Bigger Lesson: Identity Verification Is Only the Beginning

The Singapore case highlights a risk that traditional onboarding checks alone may not capture.

A genuine person can hold genuine documents and open a legitimate bank account. But if that account is created with the intention of handing control to a criminal syndicate, identity verification has solved only part of the problem.

Financial institutions also need to understand whether customer behaviour matches the purpose declared at onboarding, whether apparently unrelated customers are connected and whether transaction activity suggests that account control has changed.

In this case, 27 mules allegedly helped create 107 accounts across six banks. That scale becomes visible only when individual accounts are viewed as part of the same network.

The customer may be real and the documents genuine. The financial crime risk emerges when institutions connect the intent, behaviour and network behind the account.