The Resurgence of Check Fraud

By Kenny Kang CPA, CGMA, CFE

As a Certified Fraud Examiner, I keep tabs on the latest fraud trends. Recently, I came across the thread of an interesting discussion stating,

Austin, Texas area. A number of my client’s checks are being intercepted at their offices, and the checks are being redistributed to a network across the country. Bad actors are attempting to cash the checks by altering the payee and we know that at least five checks have been attempted to cash and two have been successful for $30,000 each.

A June 2023 AP article talks about how check fraud is back in the spotlight in a big way. Nine days later, CBS News reported “Avoid mailing your checks, experts warn. Here is what’s going on with the USPS.”  What is going on?

What is check fraud?

Check fraud is not new. Check fraud has happened since the date of invention for checks used as a financial negotiating instrument. Check fraud is known as “Check Tampering,” as classified by the Association of Certified Fraud Examiners. It is categorized under assets misappropriation/cash/fraudulent disbursements. See Figure 1. It usually takes the form of forged maker, forged endorsement, altered payee, concealed checks or authorized maker.

While ACFE’s Report to the Nations provides valuable statistics on occupational fraud and abuse, which is an insider threat, we can still glimpse insights, even as check fraud in the news is typically perpetrated by external threat actors.

 How does it work?

Check tampering involves the victim making and mailing a check, usually at an unsecured place, such as an unlocked mailbox. A bad actor would intercept the check after conducting casing around the victim’s neighborhood. Upon opening the intercepted check, the bad actor would tape up the signature section, then wash the check with acetone, such as nail polish remover.

After removing the ink, the check would be dried with a heat gun or hair dryer. When the check is still damp, it would be placed between pages of a book for pressing.  Now, the check is completely clean and ready for altering.

The bad actor would deposit the check via a mobile app at a bank account, and ultimately withdraw the cash via ATM machines. 

What is the trend in check tampering?

Let’s first look at the big picture. According to the 2022 ACFE Report to the Nations, the median loss for check and payment tampering was $100,000 with 10% of the total 2,046 cases reported. See Figure 2.

It further states, “The U.S. Postal Inspection Service reported roughly 300,000 complaints about mail theft in 2021, more than double the prior year's total. In some cases, criminals are attacking mail carriers and stealing their deliveries. In others, fraudsters are using arrow keys to gain access to postal boxes to take letters, checks and other valuables. A 2020 report from the postal service's Office of Inspector General found that the agency didn't know how many arrow keys were in circulation or how many had been stolen, raising concerns about the security of collection boxes.”

Stealing from the mailbox is not new, so let’s take a deeper dive.

First, the COVID pandemic. The World Health Organization and states and counties’ public health offices have effectively ended pandemic policies; however, with the current inflation and the end of the eviction moratorium, people are facing increasing financial pressure.

Secondly, there is the advent of encrypted messaging apps. Encrypted messaging apps, such as Signal and Telegram, enable bad actors to communicate and perform casing more effectively.

Thirdly, there is the wide use of remote or mobile deposits. The ability to take an image of the check prevents the tampered check from being closely examined by a trained bank teller for alteration or forgery.

Lastly, people wear masks while making ATM withdrawals. The bad actors may work in a group and may be using conspirators’ bank accounts to make ATM withdrawals. With the mask on, it would be difficult for investigators to review the videotape for the identities of the bad actors.

 How do you prevent this?

Like all types of fraud, it is difficult, if not impossible, to prevent check fraud from happening. However, there are ways to make it more difficult for bad actors to commit to this scheme. Here is a list of recommendations:

• Use non-washable ink, gel-ink, such as Uni-ball® 207™ Retractable Fraud Prevention Gel Pens, or utilize a laser printer when printing checks. 
• “XXXXXXXXX” out two and three lines above the payee to avoid alteration within the Positive Pay system. 
• Mail checks directly at your local USPS, not at any unsecured mail drop locations.
• Mail important checks via courier services or registered mail with tracking services. 
• Notify your counterparty (payee) that you are sending the check and expecting them to sign. 
• Track the actual delivery of the mail. 
• Have your counterparty (payee) call you upon depositing the check. 
• Use Positive Pay from your bank. Even better, Positive Pay Enhanced With Payee.
• Use your bank’s commercial lockbox services.
• Track the bank clearance of the check.
• Check for cashed checks that are significantly out of sequence (for example, check #101, then #1012) 
• Perform timely bank reconciliation. 

Of course, you can use ACH or other means of electronic fund transfers, which then brings in the issue of cybersecurity… How secure is your network and API (Application Program Interface)? This would be a whole other discussion.

In Conclusion

It is difficult, if not impossible, to prevent all incidents of fraud. Check fraud can be committed by an insider threat or an external bad actor, and the loss can be tremendous. The key is taking safety measures, whether it is storing the checks in a lockbox, mailing the check directly to your local USPS, or stopping the issuance of checks. If you become a victim of check fraud, you can also seek legal remedies as a consumer. Bad actors most often seek the low-hanging fruit. Let yours be high up on the tree.

About the Author

Kenny Kang is a Certified Public Accountant (CPA in California), Chartered Global Management Accountant (CGMA), and Certified Fraud Examiner (CFE). He is the owner of Kenny Kang CPA. Kenny has over 19 years of public and industry experience. He specializes in forensic accounting, fraud examination, and fraud prevention & detection. Kenny has a passion for cybersecurity and has been presenting cybersecurity-related topics since 2016. He received the Cybersecurity Fundamentals for Finance and Accounting Professionals Certificate (2018) and 2019-2020 Digital Mindset (2019) from the Association of International Certified Professional Accountants.

Kenny also provides consultation services in fraud risk assessment, internal control assessment, accounting processes review, cybersecurity policies & procedures documentation, and phishing awareness training. 

Disclaimer: This article does not constitute any professional advice, and the content is intended for general informational purposes only. Circumstances may differ from situation to situation. Kenny Kang CPA is not liable for any errors or omissions in this article nor any losses, injuries, or damages from the consumption or use of this information.