Method, device, and system of detecting mule accounts and accounts used for money laundering

A non-transitory storage medium having stored thereon instructions that, when executed by a machine, cause the machine to perform a method comprising:

• (a) monitoring multiple interactions of a particular user that utilizes an electronic device to access a particular bank account;
• (b) performing an analysis that is based on at least one of:
• (b1) data of transactions submitted for execution in said particular bank account,
• (b2) user-specific behavioral data indicating a behavioral manner in which said particular user utilizes said electronic device, extracted from monitored interactions and monitored gestures of said particular user,
• (b3) data about one or more operational properties of said electronic device,
• (b4) one or more signals captured from a communication channel between said electronic device and a server associated with said particular bank account;
• (c) based on said analysis, generating a notification alert that said online bank account is used as a mule bank account or as a money laundering bank account or as a terror-funding bank account;
• and
• wherein the analysis of step (b) comprises:
• (A) detecting that a first amount of money was transferred from a first account to a second account;
• (B) detecting that a second amount of money, which is at least 50 percent of the first amount of money, was transferred from the second account to a third account;
• (C) detecting that the second account was accessed via a Remote Access channel;
• (D) based cumulatively on the detecting of step (A) and the detecting of step (B) and the detecting of step (C), determining that said second account is used as a mule bank account or as a money laundering bank account or as a terror-funding bank account.

A system comprising:

• one or more hardware processors, configured to execute code;
• one or more memory units, configured to store code;
• wherein the one or more hardware processors are configured to perform a process comprising:
• (a) monitoring multiple interactions of a particular user that utilizes an electronic device to access a particular bank account;
• (b) performing an analysis that is based on at least one of:
• (b1) data of transactions submitted for execution in said particular bank account,
• (b2) user-specific behavioral data indicating a behavioral manner in which said particular user utilizes said electronic device, extracted from monitored interactions and monitored gestures of said particular user,
• (b3) data about one or more operational properties of said electronic device,
• (b4) one or more signals captured from a communication channel between said electronic device and a server associated with said particular bank account;
• (c) based on said analysis, generating a notification alert that said online bank account is used as a mule bank account or as a money laundering bank account or as a terror-funding bank account;
• and
• wherein the analysis of step (b) comprises:
• (A) detecting that a first amount of money was transferred from a first account to a second account;
• (B) detecting that a second amount of money, which is at least 50 percent of the first amount of money, was transferred from the second account to a third account;
• (C) detecting that the second account was accessed via a Remote Access channel;
• (D) based cumulatively on the detecting of step (A) and the detecting of step (B) and the detecting of step (C), determining that said second account is used as a mule bank account or as a money laundering bank account or as a terror-funding bank account.