Check fraud is forging, altering, counterfeiting, or washing checks, or depositing checks with no real funds behind them. Because checks clear slowly, money can be pulled out before the fraud is caught, and it is often paired with mail theft or account takeover.
What is check fraud, in plain English?
Check fraud is any scheme that turns the check system against itself. That covers forging a signature, altering the payee or amount on a real check, counterfeiting checks that were never issued, washing a genuine check to erase and rewrite its details, and depositing checks with no real funds behind them. Old as it is, check fraud has surged again, often fed by mail theft that supplies criminals with real checks to alter, and by account takeover that gives them a place to deposit.
The vulnerability that makes it work is float, the delay between when a check is deposited and when it truly clears. A bank may make funds available before it knows the check is bad. Fraudsters exploit that gap: deposit a worthless or altered check, withdraw the provisional funds fast, and vanish before the check bounces back unpaid.
For fraud teams, check fraud is a race against the clearing timeline. Detection has to happen in the window between deposit and settlement, using image and signature analysis, deposit behavior, and cross-bank checks, before the money is gone. Related schemes include check kiting, mobile deposit fraud, and check washing.
How check fraud gets pulled off
- Obtain — Get a check. Steal one from the mail, produce a counterfeit, or wash a genuine check to reuse it.
- Alter — Change the details. Forge the signature, or rewrite the payee and amount to redirect and inflate the payment.
- Deposit — Put it in an account. Deposit into a mule or taken-over account, often by mobile capture, and wait for provisional credit.
- Withdraw — Pull funds during float. Withdraw the money before the check clears, so it is gone when the item bounces back unpaid.
Common check-fraud methods
Method | What the fraudster does |
Forgery | Signs someone else's name or endorses a check they have no right to. |
Alteration | Changes the payee or amount on an otherwise genuine check. |
Counterfeiting | Prints fake checks using stolen account and routing numbers. |
Check washing | Uses chemicals to erase ink from a real check, then rewrites payee and amount. |
What it looks like in practice
In practice
A business mails a supplier a check for a modest amount. The envelope is stolen from a mailbox before it arrives. The thief washes the check, erasing the original payee and amount, then rewrites it to a new name for a much larger sum and deposits it by phone into a recently opened account.
The deposit does not fit the account's short, thin history, and the check image shows subtle signs of alteration around the payee and amount fields. Provisional funds are made available, and the fraudster immediately tries to withdraw them, hoping to beat the clearing window. Because the bank ran image and signature analysis and flagged the mismatch between the deposit and the account profile, it places a hold instead of releasing the cash. Days later the original check bounces as altered, and no money was lost.
Why it matters to operators
Check fraud is a timing problem. The slow clearing of checks means a bank can advance funds it will later discover were never real, and the fraudster's whole plan is to withdraw during that gap. If your controls only catch a bad check after it settles, you have already lost the money, so the entire discipline is about detecting problems before the float runs out.
The controls that work operate in that window: positive pay, where a business pre-registers issued checks so the bank can match and reject anything that does not fit; sensible hold periods on risky deposits; image and MICR analysis to spot alteration and counterfeiting; and cross-bank deposit checks to catch the same item deposited in multiple places. Because check fraud so often rides on mail theft and account takeover, it also pays to connect check alerts with new-account and takeover signals.
What to watch
- Altered fields. Payee or amount areas that show erasure, mismatched ink, or inconsistent fonts point to washing or alteration.
- Signature mismatch. Endorsements or maker signatures that do not match the account's known signatures.
- Out-of-pattern deposits. A check that does not fit the account's history in size, source, or timing, especially on new accounts.
- Fast withdrawal. Attempts to pull funds immediately after deposit, before the check has cleared.
- Mail-theft and takeover links. Check activity tied to accounts showing recent takeover signs or to areas hit by mail theft.
Quick questions
Why is check fraud still a problem?
Checks clear slowly and carry account and routing numbers in plain sight, and mail theft supplies a steady stream of real checks to alter. The float gap between deposit and clearing is the core weakness fraudsters exploit.
What is check washing?
Using chemicals to erase the ink on a genuine, often stolen, check so the payee and amount can be rewritten. The check stock and account details are real, which makes washed checks hard to spot.
How does positive pay help?
A business gives its bank a list of checks it has issued, with payees and amounts. The bank matches presented checks against that list and flags or rejects anything that does not match, catching alteration and counterfeits.
What is the role of float?
Float is the delay before a check truly clears. Banks may release funds provisionally during that window, and fraudsters withdraw before the item bounces, which is why detection must happen before settlement.
How is check fraud related to check kiting?
Kiting is a specific float-abuse scheme using circular deposits between accounts to fake a balance. It is a subset of the broader check-fraud family, which also includes forgery, alteration, and counterfeiting.
Does mobile deposit make it worse?
It adds risk, since a check can be captured remotely and even deposited at more than one bank. Cross-bank deposit checks and image analysis help counter mobile deposit fraud.
Go deeper
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.
- FBI IC3 ↗ — The FBI Internet Crime Complaint Center. Fraud reporting and annual trend reports.