Understanding Check Fraud

Defining Check Fraud, Check Fraud Types, and Tactics - While Identifying Current and Future Trends

What is Check Fraud?

Check fraudis a form of financial crimethat involves the illegal use of checks, or images of checks, to make unauthorized purchases or withdrawals through deceptive means. The methods used for check fraudare varied and sophisticated, often involving the manipulation of information on existing checksor by fabricating or creating a new counterfeit check with various tools available to fraudsters.

Due to the limitations of certain check fraud systems in the market, as well as expedited funds availability practices by financial institutions, check fraud perpetratorshave refocused into check fraud since 2018. The scope of check fraud has evolved from individual and casual fraudsterstolarge sophisticated organized crime ringswhich extract funds by recruiting money mules. In addition to individuals, organized crime even penetrated the United States Postal Service employeebase as another way to steal mail. Checks stolen from the mail are often sold via the dark web or social media.

Hand in blue glove pointing at a partially submerged check, illustrating check fraud detection techniques relevant to financial institutions.

Check Fraud Categories

There are a variety of ways to describe check fraud. Many financial institution's group check fraud into two primary categories; On-Us and Deposit fraud. Why? These categories reflect the distinct ways fraud occurs in the check processing cycle, allowing institutions to better identify, track, and mitigate risks. Another way to classify check fraud by secondary category; first party fraud versus third party fraud. (Described below)

By classifying check fraud into primary and secondary categories, financial institutions can tailor their detection strategies, allocate resources effectively, and implement targeted controls to address the specific vulnerabilities associated with more detailed types described later.

On-Us Check Fraud

On-Us check fraud or, " inclearing check fraud",occurs when a paying bank processes a fraudulent checkthat has been initially deposited at another financial institution; known as the bank of first deposit or BoFD. In this scenario, the fraudulent checkis presented to the paying bank during the check clearing process; a standard workflow which banks use to clear checks for payment. When the data and image of the checkarrive at the paying bank, the paying bank is expected to validate the transaction and debits funds from the customer account equal to that of the check amount. If the check is fraudulent, the customer may experience a loss of these funds. However, banks are typically liable for check fraud losses as part of their deposit agreement to protect clients from check fraud on their accounts. On-Us check fraudexploits electronic checkimaging coupled with image exchange, which quickly clears a check. For paying banks with only traditional check fraud detection systems in place without image forensics, many times fraud is not detected.

Woman reviewing check transaction on computer screen, highlighting check fraud detection in banking context, with visible check details and digital interface.

Check Deposit Fraud

Check deposit fraudis a financial crimewhere an individual or business deposits a fraudulent checkat a financial institution, referred to as BoFD. These checksare drawn on accounts from other banks and credit unions, making it challenging for the BoFD to detect the fraudimmediately. The fraudster could actually be the account holder, or the account holder was unknowingly given a fraudulent check. Typically, the fraudster employs tactics such as creating counterfeit checksor stealing legitimate checksto carry out various deposit fraud schemes. Once the checkis deposited, the funds appear in the account within 1-2 business days (depending on the BoFD Funds Availability Policy) Then the perpetrator will gain access to the funds directly or via the victim. In many cases, the money is transferred out to another account or accessed via tellers or ATMs in the form of cash. Check deposit fraud of fake checks has never been easier due to many factors including; mobile remote deposit capture and ATMs, which do not require any bank personnel interaction and digital image editing software.

Person depositing a check into an ATM, illustrating the ease of check deposit and potential for fraud in banking transactions.

First Party Fraud

First-party fraud occurs when individuals deliberately exploit their own identity or accounts to engage in fraudulent activities, often driven by a desire for personal gain. first-party fraud is perpetrated by the individual themselves, typically utilizing their legitimate credentials to manipulate systems for illicit advantages.

In the context of check fraud, this involves the account holder deliberately issuing bad checks (e.g., checks with insufficient funds) or manipulating checks to deceive a bank or payee. Examples include: Writing a check knowing there are insufficient funds in the account. Altering a legitimate check (e.g., changing the amount or payee) to benefit the account holder. Opening an account with false information to issue fraudulent checks.

Close-up of a pen writing on a check, highlighting the dollar sign and the amount, illustrating first-party fraud in check manipulation.

Third Party Fraud

Third-party fraud is a type of financial crime that occurs when an external entity exploits stolen or falsified information to perpetrate fraudulent activities. Typically, the account holder remains unaware that their personal or financial details have been compromised.

In check fraud, this typically involves a fraudster impersonating the account holder or using stolen checks to withdraw money or make unauthorized payments.

Examples include: Stealing checks and forging the account holder’s signature. Creating counterfeit checks using stolen account details. Using stolen identity information to open fraudulent accounts and issue checks.

Person writing a check for charity, illustrating the potential for check fraud involving insufficient funds or altered amounts.

Check Fraud Types & Definitions

There are many scenarios or use cases where fraudsters try to gain access to funds illegally. It is understood in the market, that there are four common types of check fraud Each type can be attempted with unique tactics which are also covered below.

1. Counterfeit Checks

Counterfeit checksare fraudulent documents that appear to be legitimately issued check. They areintentionally created to deceive recipients and financial institutions. Most counterfeit checks are created with software, either from a template, or by scanning a check, creating a digital copy, and editing the image. These fake checksoften mimic real checksin design, logos, and bank accountdetails, making them difficult to detect at first glance. They may include altered fields. Once digitally created, a counterfeit is typically printed and either deposited by the fraudster and/or money mule, or given to another party for either the exchange of goods, or as part of a check scam.

Counterfeit checkscan also represent a significant threat to financial institutions, as many fraudsters target bank-issued cashiers checks. The intricacies of these counterfeit checksinclude accurate reproductions of logos, design features, and bank accountdetails. This is particularly problematic when a BoFD provides immediate funds availability, and the check isn't cleared until the next day.

2. Altered Checks

An altered checkis an originally legitimate checkthat has been changed or modified with the intent to deceive and commit financial fraud. Common alterations include changes to the amount, courtesy amount, or changing the name of the payee via washing. Fraudsters are able to alter checksthrough various means, including utilizing chemicals to remove ink or simply using white out and depositing the check. Once the check is scanned and binarized, a "whited-out" field is virtually undetectable, except for advanced image forensics.

Unlike counterfeit checks, which are entirely fabricated and lack authenticity from the outset, altered checksare genuine instruments that have been manipulated to serve illicit purposes.

3. Forged Checks

A forged check is a form of financial fraudwhere an individual unlawfully steals a check, thenreplicates the signature of the account holder(s) without proper authorization. This illicit act is designed to facilitate unauthorized withdrawals or transfers of funds from the victim's bank account. A forgery can occur when a blank check is stolen from an individual or a business and the perpetrator signs the check. Another example is when checks are stolen in the mail. The perpetrator then washes the signature from the check and re-signs the check.

To a forensic expert, there are three main types of forgeries:

Unskilled forgery: Also known as blind forgery or simple forgery, the forger doesn't have access to the genuine signature and simply tries to write the name in their own handwriting. This type of forgery is often easily detectable as it lacks the characteristic features of the true signature.
Semiskilled Forgery: This involves attempting to replicate the signature with some level of effort, often by tracing over the genuine signature. While it may look similar at first glance, skilled analysts and verification tools can often identify inconsistencies in pen strokes, pressure, and fluidity.
Skilled Forgery: This is the most difficult type to detect, as the forger has dedicated time and effort to practice and replicate the signature with a high degree of accuracy and fluency. These forgeries may require specialized forensic analysis or advanced signature verification tools that assess dynamic features like speed and pressure to distinguish them from authentic signatures.Additionally, they may include an overlay of a previous signature.

4. Check Kiting

Check kitingis a deceptive financial crimethat exploits the time delay in the clearing process of checks and electronic payments, allowing individuals or companies to create an illusion of available funds in their bank accounts. In this scheme, a perpetrator typically writes or prints a checkfrom an account that has insufficient funds and deposits it into another account. This initial deposit gives the appearance that there are sufficient funds available, even though the issuing account cannot cover the checkamount.

The fraudster then manipulates this window of time—often several days—by withdrawing or transferring the deposited funds to other accounts, effectively accessing money that does not exist. Once the checkis deposited, the fraudulent checksoften remain undetected during the grace period between the deposit and the actual clearing of the checkagainst the issuing account.

This type of check fraud occurs less frequently than in years past. Today's same day or next day check clearing processes have made kiting a more difficult type of fraud to execute. However, sophisticated fraudsters can still game the system now that other electronic payments are more easily accessible. For example, a same day ACH, or Real-time payment, could supplement this process in addition to checks.

Check Fraud Tactics & Schemes

Check Washing

Check washing is a sophisticated and widespread form of financial fraud involving the use of chemicals, such as acetone (found in nail polish remover), rubbing alcohol, or bleach, to erase ink from specific fields on a check. Once the ink is removed, fraudsters can alter critical details, including the payee name, amount, date, or even the signature, to redirect funds for illicit gain. Skilled perpetrators can execute check washing with minimal visible damage to the check, making the tampering difficult to detect. This technique, which has been used for over three decades, exploits vulnerabilities in traditional check fraud detection systems, enabling fraudsters to bypass legacy security measures.

Check Cooking/Baking

Check cooking/bakingis a sophisticated form of check fraudthat has become increasingly prevalent in recent years. This fraudulent practice involves the use of advanced photo image editing softwareby criminals to meticulously recreate authentic checks. By taking various elements from legitimate checks—such as the bank logo, signature, and account numbers—fraudsters assemble what appears to be a genuine checkbut is ultimately a deceptive replication aimed at financial gain. Fraudsters are able to print these cooked checkswith a desktop printer on standard checkstock available for purchase at many retailers and online vendors. As the checkappears to be legitimate, the fraudster is able to present the checkfor deposit in any channel including teller (bypassing check fraud preventiontraining), mobileremote deposit capture, and ATM as the checkappears legitimate.

Account Takeover

Fraudsters gain access to a victim’s bank account to issue or cash unauthorized checks. Using stolen credentials (e.g., through phishing or data breaches), fraudsters obtain blank checks or account details to create and cash fraudulent checks. Primarily On-Us fraud, account takeover involves checks drawn on the victim’s account at the issuing bank leading to significant unauthorized withdrawals before the account holder notices.

New Account Fraud

Fraudsters open bank accounts using stolen or synthetic identities to deposit or cash fraudulent checks. After opening an account with false credentials, fraudsters deposit counterfeit or altered checks, then quickly withdraw funds before the fraud is detected. Primarily Deposit fraud, it involves depositing fraudulent checks into newly opened accounts by exploiting lax identity verification during account opening, leading to rapid financial losses.

Forged Endorsements

Forged endorsementis a tactic within check fraudthat occurs when an individual unlawfully signs a checkthat is made out to another person or entity, effectively bypassing the rightful payee's authorization. In many cases, the forger may gain access to the checkthrough theft, deception, or exploitation of personal relationships. Once the checkis endorsed with a fraudulent signature, the forger is then able to cash or deposit it, thereby illegally obtaining funds that were never intended for them.

Mobile Check Fraud

Mobile check fraudis a growing concern in the realm of digital banking, primarily involving fraudulent activities that utilize mobile bankingapplications or remote checkdeposits. With the convenience of depositing checksremotely, scammers have seized the opportunity to exploit weaknesses in the system. Fraudsters are able to deposit counterfeits, forgeries, and alterations into a bank accountwithout the physical inspection by bank personnel. This type of fraudcan occur rapidly, as offenders often aim to withdraw funds before financial institutions can detect any discrepancies or halt the transactions.

Duplicate Presentment

Duplicate presentmentis a form of check fraudthat occurs when an individual attempts to exploit the system by depositing the same checkat multiple locations to access additional funds. This fraudulent act typically involves a scheme in which a perpetrator utilizes mobileremote deposit captureoffered by financial institutions. By taking advantage of technology that allows users to deposit checksvia smartphone applications, the fraudster first submits the checkthrough one bank's app, then either deposit the same checkagain at another bank’s mobile/digital bankingapplication, ATM, or teller, or even attempt to cash it at a retail establishment that offers check-cashing services.

For more fraud terminology, check out our blog post, Learn the Lingo: The Fraudster Glossary featuring the lingo of those involved in this area.

Check Fraud Market Trends: Yesterday, Today, and Tomorrow

Based on the chart below, check fraudattempts in 2025 are projected to have surged by nearly 600% since 2014 with a CAGR of 19.1%. Annual attempts change per year, but even experts reported an increase of 300 to 400 percent. Although the number of checks are declining at a rate of 5-7% per year.

The rise in check fraudcan largely be attributed to the technological advancements that have made it easier for criminals to exploit vulnerabilities. With the proliferation of sophisticated printing techniques, high-resolution imaging, and the availability of personal information online, fraudsters can easily replicate checksand divert funds without detection. Moreover, the shift in tactics, including the use of phishing schemes and social engineering, further complicates the issue, as individuals are often unaware of the risks associated with old-fashioned paymentmethods.

Research by OrboGraph illustrates that a massive rise in check fraudattempts started in 2015 with the introduction of the EMV Chip. This innovation, while reducing credit card fraud, forced fraudsters to shift to a more vulnerable channel: paper checks.

Fast forward to 2025, fraudsters continue to have a wide range of tools and tactics at their disposal including: innovative new scams, mail carrier and mailbox robberies, online sale of stolen checks through dark web distributionand encrypted messaging apps like Telegram, expanded organized crime rings.

What's next? Based on feedback from industry leaders, banks, credit unions, and service bureaus, we'll continue to see an increase in attempts for the next several years.

Check fraud trend graph illustrating increasing check fraud attempts from 2012 to 2026, highlighting factors like organized crime, dark web, and scams, alongside check volumes and EMV chip impact.

Recent Check Fraud Trends

New accounts are seeing 17X higher fraudrates -- 2024 NICE Actimize Fraud Insights Report
75% of banks and credit unions indicated check fraudas a top concern -- Jack Henry & Associates’ 2024 Strategy Benchmark Report
90% of community bankers reporting higher levels of fraudulent check-writing -- IntraFi Executive Business Outlook Service Report
63% of respondents reporting that their organizations faced check fraudin 2024 -- 2025 AFP® Payments Fraud and Control Survey
Check FraudSARs eclipse 650,000 for the past three years -- The Financial Crimes Enforcement Network reported by Thomas Reuters

Checkout our OrboIntelligence Check Fraud Resources Hubfor the latest news, data, and reports.

Mail Theft and Mail Carrier Robberies

The United State Postal Services (USPS) have struggled to combat the rise in mail theft-- a major source of stolen checks. This includes mail theft/mail carrier robberiesand recruiting USPS employees into their organized crime rings. Here are several alarming facts related to statistics involving stolen mail:

Estimates vary, but according to a 2023 report by Security.org, 1.7 million packages are lost or stolen in the United States every day [1], and over 620 million packages disappear annually.
89% of all reported mail thefts happened within these 5 cities (Washington, New York, Los Angeles, Houston & Chicago)
Robberies of postal carriers climbed 30% in 2023 according to reporting by AP News.

Mitigating Internal Mail Theft Report provides a comprehensive analysis of new activities by the post office.

While the USPS responded with initiatives including Project Safe Delivery, critics says that the USPS and US Government is not doing enough.

Hand with gloves reaching toward a large pile of scattered letters and documents on a wooden floor, illustrating the issue of mail theft and fraud in the context of OrboGraph's fraud detection solutions.

AI Innovation