What Control Means in a Mule Charge

What does “control” mean in a mule charge?

For a mule account charge under Sections 424A and 424B of the Penal Code, the prosecution must prove “control”. ^[f1] Control means being able to use the account: logging in, making transactions, withdrawing money or changing settings.

Control is not the same as owning the account. With someone’s login, you can control an account that is not yours; if someone changed your password, you own an account you no longer control.

The law looks at who could use the account, not whose name is on it.

Our guide to Section 424A covers the whole offence. This page looks only at control.

How is control proved?

The prosecution does not need you to admit anything. Several kinds of evidence can show you were able to use an account.

Holding the card or login details. A bank card, a security token or a written note of login details in your hands is direct evidence of control. ^[f4] Even if you never used the card, holding it may show you could have.

Sharing access. If you gave someone your PIN, online banking password or e-wallet login, that shows they had control. ^[f2] If someone gave you theirs, it shows you had control of their account.

Digital records. Login records, IP addresses, device details and OTP logs show who opened the account and when. ^[f3] If your phone received the OTP codes for an account’s transactions, that can be strong evidence you had control.

What indirect evidence can show control?

Not every case has a clear paper trail. The prosecution can also build control from indirect evidence. ^[f3]

If the account’s activity matches your daily routine, that suggests you were the one using it. Examples are ATM withdrawals near your home or workplace, at hours when you are usually out and about.

Chats can be important evidence. WhatsApp, Telegram or social media messages where you talk about the account, send balance screenshots or arrange transfers can show both control and awareness.

Call and message records between you and the account owner around the time of the transfers give prosecutors a timeline. They use it to argue you were working together.

How is control different from knowledge?

Control and knowledge are separate questions. Control asks: could you use the account? What you knew about how it would be used, and why you gave it or held it, matter separately to your defence.

Under Section 424A, the question is whether you held another person’s payment card or account access without lawful authority. Control is central here, because holding it means you could use it.

Under Section 424B, the question is whether you gave control of your own account to someone else without lawful authority or a lawful purpose. Control passes from you to them, and the prosecution must show that happened.

The knowledge element has its own guide. A defence may challenge both.

How can the control element be challenged?

There are specific ways to challenge the claim that you had control. ^[f5]

You did not give control willingly. If you were tricked, the element may not be met. For example, someone posing as a bank officer got your login, or a scammer got into your account through a phishing link.

You were threatened or forced. If you handed over your details because of threats, fear or pressure, duress is a recognised defence. This covers physical threats, blackmail, or someone using their power over you to make you cooperate.

The evidence is not strong enough. The prosecution must prove control beyond reasonable doubt. If its evidence is weak, indirect or has another explanation, a lawyer can challenge it. For instance, an IP address shared by several people does not prove who was using the account.

You could not actually use the account. If you had the card but not the PIN, or a login whose password had been changed, you may not have had real control. What counts is whether you could operate the account.

Is simply holding a card enough?

It may be. Holding someone’s card or token may be enough to show control. ^[f4] The prosecution can argue control even if you never used the account.

If police find another person’s bank card in your wallet, the prosecution may say that alone shows you could use their account. The same goes for their security token, TAC device, or login details saved on your phone.

This is why a mule account defence often turns on how you came to hold the item.

Who gave it to you, and did you take it willingly? Did you know whose account it was? Your answers shape the defence.

What should you do if control is part of your case?

If the investigation or charge involves control, take these steps.

Keep all evidence. Do not delete messages, reset your phone or throw away anything linked to the account. That includes cards, tokens, screenshots and chats. Destroying evidence can lead to more charges and weakens your position.

Write down what happened. Note exactly how you came to have the account details or the card.

Record when it happened, who was involved and what you were told. A note made now helps your lawyer set out the facts of your defence.

Speak to a lawyer before giving a statement. If JSJK (the police commercial crime unit) or the police call you for a statement, what you say about control matters a great deal. A lawyer can prepare you to answer accurately without accidentally helping the prosecution prove control.

Collect evidence that helps you. Useful items include messages showing you were deceived and records showing you did not make the transfers. Proof of threats, and statements from people who saw what happened, can also help.

Sources

1. Penal Code (Amendment) Act 2024, Sections 424A, 424B, element of “control”
2. Low & Partners, “Keldai Accounts: When Helping a Friend Becomes a Criminal Offence” (2024)
3. Criminal Procedure Code, evidentiary standards for circumstantial evidence
4. Federal Constitution of Malaysia, Article 5(1), rights of the accused