Understanding Check Fraud

Defining Check Fraud, Check Fraud Types, and Tactics - While Identifying Current and Future Trends

What is Check Fraud?

Check fraud is a form of financial crime that involves the illegal use of checks, or images of checks, to make unauthorized purchases or withdrawals through deceptive means. The methods used for check fraud are varied and sophisticated, often involving the manipulation of information on existing checks or by fabricating or creating a new counterfeit check with various tools available to fraudsters.

Due to the limitations of certain check fraud systems in the market, as well as expedited funds availability practices by financial institutions, check fraud perpetrators have refocused into check fraud since 2018. The scope of check fraud has evolved from individual and casual fraudsters to large sophisticated organized crime rings which extract funds by recruiting money mules. In addition to individuals, organized crime even penetrated the United States Postal Service employee base as another way to steal mail. Checks stolen from the mail are often sold via the dark web or social media.

Check Fraud Categories

There are a variety of ways to describe check fraud. Many financial institution's group check fraud into two primary categories; On-Us and Deposit fraud. Why? These categories reflect the distinct ways fraud occurs in the check processing cycle, allowing institutions to better identify, track, and mitigate risks. Another way to classify check fraud by secondary category; first party fraud versus third party fraud. (Described below)

By classifying check fraud into primary and secondary categories, financial institutions can tailor their detection strategies, allocate resources effectively, and implement targeted controls to address the specific vulnerabilities associated with more detailed types described later.

On-Us Check Fraud

On-Us check fraud or, " inclearing check fraud", occurs when a paying bank processes a fraudulent check that has been initially deposited at another financial institution; known as the bank of first deposit or BoFD. In this scenario, the fraudulent check is presented to the paying bank during the check clearing process; a standard workflow which banks use to clear checks for payment. When the data and image of the check arrive at the paying bank, the paying bank is expected to validate the transaction and debits funds from the customer account equal to that of the check amount. If the check is fraudulent, the customer may experience a loss of these funds. However, banks are typically liable for check fraud losses as part of their deposit agreement to protect clients from check fraud on their accounts. On-Us check fraud exploits electronic check imaging coupled with image exchange, which quickly clears a check. For paying banks with only traditional check fraud detection systems in place without image forensics, many times fraud is not detected.

business professional looking at a fraud review platform on a computer screen that contains a business check

Check Deposit Fraud

Check deposit fraud is a financial crime where an individual or business deposits a fraudulent check at a financial institution, referred to as BoFD. These checks are drawn on accounts from other banks and credit unions, making it challenging for the BoFD to detect the fraud immediately. The fraudster could actually be the account holder, or the account holder was unknowingly given a fraudulent check. Typically, the fraudster employs tactics such as creating counterfeit checks or stealing legitimate checks to carry out various deposit fraud schemes. Once the check is deposited, the funds appear in the account within 1-2 business days (depending on the BoFD Funds Availability Policy ) Then the perpetrator will gain access to the funds directly or via the victim. In many cases, the money is transferred out to another account or accessed via tellers or ATMs in the form of cash. Check deposit fraud of fake checks has never been easier due to many factors including; mobile remote deposit capture and ATMs, which do not require any bank personnel interaction and digital image editing software.

a paper check being deposited into an ATM

First Party Fraud

First-party fraud occurs when individuals deliberately exploit their own identity or accounts to engage in fraudulent activities, often driven by a desire for personal gain. first-party fraud is perpetrated by the individual themselves, typically utilizing their legitimate credentials to manipulate systems for illicit advantages.

In the context of check fraud, this involves the account holder deliberately issuing bad checks (e.g., checks with insufficient funds) or manipulating checks to deceive a bank or payee. Examples include: Writing a check knowing there are insufficient funds in the account. Altering a legitimate check (e.g., changing the amount or payee) to benefit the account holder. Opening an account with false information to issue fraudulent checks.

Third Party Fraud

Third-party fraud is a type of financial crime that occurs when an external entity exploits stolen or falsified information to perpetrate fraudulent activities. Typically, the account holder remains unaware that their personal or financial details have been compromised.

In check fraud, this typically involves a fraudster impersonating the account holder or using stolen checks to withdraw money or make unauthorized payments.

Examples include: Stealing checks and forging the account holder’s signature. Creating counterfeit checks using stolen account details. Using stolen identity information to open fraudulent accounts and issue checks.

Check Fraud Types & Definitions

There are many scenarios or use cases where fraudsters try to gain access to funds illegally. It is understood in the market, that there are four common types of check fraud Each type can be attempted with unique tactics which are also covered below.

1. Counterfeit Checks

Counterfeit checks are fraudulent documents that appear to be legitimately issued check. They are intentionally created to deceive recipients and financial institutions. Most counterfeit checks are created with software, either from a template, or by scanning a check, creating a digital copy, and editing the image. These fake checks often mimic real checks in design, logos, and bank account details, making them difficult to detect at first glance. They may include altered fields. Once digitally created, a counterfeit is typically printed and either deposited by the fraudster and/or money mule, or given to another party for either the exchange of goods, or as part of a check scam.

Counterfeit checks can also represent a significant threat to financial institutions, as many fraudsters target bank-issued cashiers checks. The intricacies of these counterfeit checks include accurate reproductions of logos, design features, and bank account details. This is particularly problematic when a BoFD provides immediate funds availability, and the check isn't cleared until the next day.

2. Altered Checks

An altered check is an originally legitimate check that has been changed or modified with the intent to deceive and commit financial fraud. Common alterations include changes to the amount, courtesy amount, or changing the name of the payee via washing. Fraudsters are able to alter checks through various means, including utilizing chemicals to remove ink or simply using white out and depositing the check. Once the check is scanned and binarized, a "whited-out" field is virtually undetectable, except for advanced image forensics.

Unlike counterfeit checks, which are entirely fabricated and lack authenticity from the outset, altered checks are genuine instruments that have been manipulated to serve illicit purposes.

3. Forged Checks

A forged check is a form of financial fraud where an individual unlawfully steals a check, then replicates the signature of the account holder(s) without proper authorization. This illicit act is designed to facilitate unauthorized withdrawals or transfers of funds from the victim's bank account. A forgery can occur when a blank check is stolen from an individual or a business and the perpetrator signs the check. Another example is when checks are stolen in the mail. The perpetrator then washes the signature from the check and re-signs the check.

To a forensic expert, there are three main types of forgeries:

Unskilled forgery: Also known as blind forgery or simple forgery, the forger doesn't have access to the genuine signature and simply tries to write the name in their own handwriting. This type of forgery is often easily detectable as it lacks the characteristic features of the true signature.
Semiskilled Forgery: This involves attempting to replicate the signature with some level of effort, often by tracing over the genuine signature. While it may look similar at first glance, skilled analysts and verification tools can often identify inconsistencies in pen strokes, pressure, and fluidity.
Skilled Forgery: This is the most difficult type to detect, as the forger has dedicated time and effort to practice and replicate the signature with a high degree of accuracy and fluency. These forgeries may require specialized forensic analysis or advanced signature verification tools that assess dynamic features like speed and pressure to distinguish them from authentic signatures. Additionally, they may include an overlay of a previous signature.

4. Check Kiting

Check kiting is a deceptive financial crime that exploits the time delay in the clearing process of checks and electronic payments , allowing individuals or companies to create an illusion of available funds in their bank accounts. In this scheme, a perpetrator typically writes or prints a check from an account that has insufficient funds and deposits it into another account. This initial deposit gives the appearance that there are sufficient funds available, even though the issuing account cannot cover the check amount.

The fraudster then manipulates this window of time—often several days—by withdrawing or transferring the deposited funds to other accounts, effectively accessing money that does not exist. Once the check is deposited, the fraudulent checks often remain undetected during the grace period between the deposit and the actual clearing of the check against the issuing account.

This type of check fraud occurs less frequently than in years past. Today's same day or next day check clearing processes have made kiting a more difficult type of fraud to execute. However, sophisticated fraudsters can still game the system now that other electronic payments are more easily accessible. For example, a same day ACH, or Real-time payment, could supplement this process in addition to checks.

Check Fraud Tactics & Schemes

Check Washing

Check washing is a sophisticated and widespread form of financial fraud involving the use of chemicals, such as acetone (found in nail polish remover), rubbing alcohol, or bleach, to erase ink from specific fields on a check. Once the ink is removed, fraudsters can alter critical details, including the payee name, amount, date, or even the signature, to redirect funds for illicit gain. Skilled perpetrators can execute check washing with minimal visible damage to the check, making the tampering difficult to detect. This technique, which has been used for over three decades, exploits vulnerabilities in traditional check fraud detection systems, enabling fraudsters to bypass legacy security measures.

Check Cooking/Baking

Check cooking/baking is a sophisticated form of check fraud that has become increasingly prevalent in recent years. This fraudulent practice involves the use of advanced photo image editing software by criminals to meticulously recreate authentic checks. By taking various elements from legitimate checks—such as the bank logo, signature, and account numbers—fraudsters assemble what appears to be a genuine check but is ultimately a deceptive replication aimed at financial gain. Fraudsters are able to print these cooked checks with a desktop printer on standard check stock available for purchase at many retailers and online vendors. As the check appears to be legitimate, the fraudster is able to present the check for deposit in any channel including teller (bypassing check fraud prevention training), mobile remote deposit capture, and ATM as the check appears legitimate.

Account Takeover

Fraudsters gain access to a victim’s bank account to issue or cash unauthorized checks. Using stolen credentials (e.g., through phishing or data breaches), fraudsters obtain blank checks or account details to create and cash fraudulent checks. Primarily On-Us fraud, account takeover involves checks drawn on the victim’s account at the issuing bank leading to significant unauthorized withdrawals before the account holder notices.

New Account Fraud

Fraudsters open bank accounts using stolen or synthetic identities to deposit or cash fraudulent checks. After opening an account with false credentials, fraudsters deposit counterfeit or altered checks, then quickly withdraw funds before the fraud is detected. Primarily Deposit fraud, it involves depositing fraudulent checks into newly opened accounts by exploiting lax identity verification during account opening, leading to rapid financial losses.

Forged Endorsements

Forged endorsement is a tactic within check fraud that occurs when an individual unlawfully signs a check that is made out to another person or entity, effectively bypassing the rightful payee's authorization. In many cases, the forger may gain access to the check through theft, deception, or exploitation of personal relationships. Once the check is endorsed with a fraudulent signature, the forger is then able to cash or deposit it, thereby illegally obtaining funds that were never intended for them.

Mobile Check Fraud

Mobile check fraud is a growing concern in the realm of digital banking, primarily involving fraudulent activities that utilize mobile banking applications or remote check deposits. With the convenience of depositing checks remotely, scammers have seized the opportunity to exploit weaknesses in the system. Fraudsters are able to deposit counterfeits, forgeries, and alterations into a bank account without the physical inspection by bank personnel. This type of fraud can occur rapidly, as offenders often aim to withdraw funds before financial institutions can detect any discrepancies or halt the transactions.

Duplicate Presentment

Duplicate presentment is a form of check fraud that occurs when an individual attempts to exploit the system by depositing the same check at multiple locations to access additional funds. This fraudulent act typically involves a scheme in which a perpetrator utilizes mobile remote deposit capture offered by financial institutions. By taking advantage of technology that allows users to deposit checks via smartphone applications, the fraudster first submits the check through one bank's app, then either deposit the same check again at another bank’s mobile/digital banking application, ATM, or teller, or even attempt to cash it at a retail establishment that offers check-cashing services.

For more fraud terminology, check out our blog post, Learn the Lingo: The Fraudster Glossary featuring the lingo of those involved in this area.

Check Fraud Market Trends: Yesterday, Today, and Tomorrow

Based on the chart below, check fraud attempts in 2025 are projected to have surged by nearly 600% since 2014 with a CAGR of 19.1%. Annual attempts change per year, but even experts reported an increase of 300 to 400 percent. Although the number of checks are declining at a rate of 5-7% per year.

The rise in check fraud can largely be attributed to the technological advancements that have made it easier for criminals to exploit vulnerabilities. With the proliferation of sophisticated printing techniques, high-resolution imaging, and the availability of personal information online, fraudsters can easily replicate checks and divert funds without detection. Moreover, the shift in tactics, including the use of phishing schemes and social engineering, further complicates the issue, as individuals are often unaware of the risks associated with old-fashioned payment methods.

Research by OrboGraph illustrates that a massive rise in check fraud attempts started in 2015 with the introduction of the EMV Chip. This innovation, while reducing credit card fraud, forced fraudsters to shift to a more vulnerable channel: paper checks.

Fast forward to 2025, fraudsters continue to have a wide range of tools and tactics at their disposal including: innovative new scams, mail carrier and mailbox robberies, online sale of stolen checks through dark web distribution and encrypted messaging apps like Telegram, expanded organized crime rings.

What's next? Based on feedback from industry leaders, banks, credit unions, and service bureaus, we'll continue to see an increase in attempts for the next several years.

Recent Check Fraud Trends

New accounts are seeing 17X higher fraud rates -- 2024 NICE Actimize Fraud Insights Report
75% of banks and credit unions indicated check fraud as a top concern -- Jack Henry & Associates’ 2024 Strategy Benchmark Report
90% of community bankers reporting higher levels of fraudulent check-writing -- IntraFi Executive Business Outlook Service Report
63% of respondents reporting that their organizations faced check fraud in 2024 -- 2025 AFP® Payments Fraud and Control Survey
Check Fraud SARs eclipse 650,000 for the past three years -- The Financial Crimes Enforcement Network reported by Thomas Reuters

Check out our OrboIntelligence Check Fraud Resources Hub for the latest news, data, and reports.

Mail Theft and Mail Carrier Robberies

The United State Postal Services (USPS) have struggled to combat the rise in mail theft -- a major source of stolen checks. This includes mail theft/mail carrier robberies and recruiting USPS employees into their organized crime rings. Here are several alarming facts related to statistics involving stolen mail:

Estimates vary, but according to a 2023 report by Security.org, 1.7 million packages are lost or stolen in the United States every day [1], and over 620 million packages disappear annually.
89% of all reported mail thefts happened within these 5 cities (Washington, New York, Los Angeles, Houston & Chicago)
Robberies of postal carriers climbed 30% in 2023 according to reporting by AP News.

Mitigating Internal Mail Theft Report provides a comprehensive analysis of new activities by the post office.

While the USPS responded with initiatives including Project Safe Delivery, critics says that the USPS and US Government is not doing enough.

AI Innovation