Paper cheques are an old payment method, but mail theft, chemical washing and cheap image-based deposit channels have made cheque fraud one of the fastest growing fraud types that US banks report. FinCEN's February 2023 alert recorded more than 680,000 check fraud Suspicious Activity Reports in 2022, nearly double the 2021 total. This guide explains how the main schemes work at the level a defender needs, the red flags regulators have published, and the controls that stop losses for paying banks, depositary banks and businesses that still issue cheques: positive pay, deposit holds, mule account detection, mailing practices and reporting. It is written for fraud operations, AML and payments teams and for finance teams that issue cheques. The spelling "cheque" is used throughout; US sources and regulations use "check".
Key takeaways
- Stolen mail is a major source. FinCEN's financial trend analysis of reports filed between 27 February and 31 August 2023 under its mail theft key term covered 15,417 reports and more than $688 million in transactions, including attempts.
- Altered cheques dominate. In the same analysis about 44% of reports involved altering and depositing stolen cheques, about 26% counterfeits made from stolen cheques, and about 20% fraudulently signed cheques.
- Criminals avoid bank staff. FinCEN found perpetrators preferred ATM deposits and remote deposit capture, so deposit channel controls matter as much as paying bank controls.
- Positive pay helps issuers, not consumers. The Federal Reserve's FedPayments Reporter note says fraud against consumer accounts bypasses most positive pay services, and basic positive pay may not catch a changed payee or false endorsement.
- Mule accounts are the exit. Washed cheques are deposited into new or recruited accounts and drained quickly; detecting the mule account is often the last chance to recover funds.
How cheque fraud schemes work
FinCEN Alert FIN-2023-Alert003 (27 February 2023) describes three core methods. Understanding them tells you where each control acts. The same alert records more than 350,000 check fraud SARs in 2021, a 23% increase on 2020, rising to over 680,000 in 2022; FinCEN notes these counts cover all check fraud, not only cases linked to mail theft. Banks filed 88% of the reports in FinCEN's later trend analysis, so most visibility of the problem sits with depository institutions.
| Scheme | What happens | Where it is caught |
|---|---|---|
| Washing | Chemicals remove ink so the payee, and often the amount, can be rewritten; washed cheques may be copied for later use or sold | Payee positive pay, image analysis of ink and handwriting anomalies, customer reports of non-receipt |
| Altering | The payee is changed to a fraudster, a synthetic identity or a controlled business account, and the amount is often raised by hundreds or thousands of dollars | Payee and amount matching against issue files, velocity checks on the depositing account |
| Counterfeiting | New cheques are printed using the routing and account numbers from a stolen original | Positive pay (unissued serial number), cheque stock and MICR checks, image comparison with known good items |
| Forged signature | A stolen blank or signed cheque is signed or endorsed fraudulently | Signature and endorsement review, payee checks |
| Deposit fraud with mule accounts | Fraudulent items are deposited through ATM or remote deposit capture into new or recruited accounts and withdrawn before return | Account opening controls, deposit holds, mule behaviour models. See the Money Mule Detection Guide |
FinCEN's trend analysis describes two mule patterns: victims of romance and employment scams who deposit cheques and forward the funds, and new account fraud where a mule opens an account online. Both connect cheque fraud to identity fraud and social engineering, which is why fraud and cyber teams should share data. See the Fraud and Cyber Convergence Guide.
Red flags regulators have published
The FinCEN alert lists ten red flag indicators and stresses that no single indicator is conclusive. They make a good starting rule set for depositary and paying banks.
| Red flag (FinCEN, paraphrased) | Detection idea | Owner |
|---|---|---|
| Unusually large cheque withdrawals to a new payee | Payee first-seen flag combined with amount deviation from history | Paying bank |
| Customer reports a stolen cheque deposited into an unknown account | Fast claim intake linked to item image and depositing bank | Paying bank |
| Customer reports a mailed cheque never arrived | Stop payment workflow plus watch on the serial number | Paying bank and issuer |
| Cheque stock differs from the bank's stock and from known good items | Image comparison against prior cleared items for the account | Paying bank |
| Sudden cheque deposits on an account with no history, followed by withdrawals or transfers | Behaviour change score, deposit-to-outflow timing | Depositary bank |
| Abnormal, sudden deposits, often electronic, followed by rapid withdrawal | Remote deposit velocity limits and holds | Depositary bank |
| Faded handwriting beneath darker overwriting | Image inspection queue for high-value items | Both |
| Other suspicious activity on the account | Cross-product risk view | Both |
| New account used mainly for cheque deposits then frequent withdrawals | New account monitoring for the first 30 to 90 days | Depositary bank |
| A non-customer cashing large cheques in person with a suspicious explanation | Teller escalation script and mule awareness training | Paying bank branches |
Controls for organisations that issue cheques
- Positive pay: send the bank an issue file (serial number, amount, date) and review exceptions each day; the bank returns items that do not match. Issuers own the daily decision deadline.
- Payee positive pay: adds the payee name to the match. The Federal Reserve note warns that basic positive pay may not alert on a changed payee or amount alteration that matches, so payee matching closes a real gap.
- Reduce cheque volume: move suppliers and payroll to electronic payments, with bank detail changes verified out of band. See the Invoice Redirection and Supplier Bank Detail Fraud Guide.
- Mail handling: post cheques inside the post office or hand them to a carrier rather than leaving them in an unsecured box, and ask payees to confirm receipt for large amounts. USPIS advises contacting the sender promptly when an expected cheque does not arrive.
- Cheque stock security: keep stock locked with dual control and reconciled serial ranges; use stock with security features and pens with ink that resists washing.
- Segregation of duties: different people prepare, approve and reconcile cheques, and positive pay exceptions are not decided by the person who issued the payment.
- Account structure: a separate, low-balance account used only for cheques limits exposure if an account number is copied.
Controls for paying and depositary banks
Paying bank
- Positive pay take-up: offer payee positive pay to business customers and measure adoption among high-volume issuers.
- Consumer protection: because most positive pay does not cover consumers, review the highest-value consumer items before the return deadline. The Federal Reserve describes reports such as the Check Advanced Notice Payor Report for this purpose.
- Image analytics: compare presented items against prior cleared images for stock, signature and handwriting consistency.
- Return discipline: fraudulent items returned within deadlines are the cheapest recovery; the Federal Reserve calls timely return the most efficient way to handle fraudulent checks.
Depositary bank
- Account opening: stronger identity proofing for online applications, device and behaviour signals, and checks for synthetic identities. See the Identity Proofing and KYC Guide.
- Remote deposit and ATM limits: per-item and daily limits that start low for new accounts and rise with history; duplicate presentment checks across channels.
- Holds under Regulation CC: 12 CFR 229.13 allows exception holds, including for new accounts (the first 30 calendar days), large deposits over $6,725 on one banking day, redeposited cheques, repeated overdrafts and reasonable cause to doubt collectibility. Reasonable cause must rest on facts about the item, not the class of depositor, and the bank must give written notice with the reason and keep a record.
- Mule monitoring: deposits followed by rapid outbound transfers, cash withdrawals or crypto purchases; new accounts receiving cheques from many unrelated payers.
- Interbank claims: fast, documented warranty claims between banks, with images retained.
Choosing controls: decision guidance
| Situation | Priority controls | Trade-off |
|---|---|---|
| Small business issuing a few cheques a month | Payee positive pay, mail at the post office, move regular payees to electronic payments | Small fee and a daily exception check |
| Large issuer (payroll, insurance claims, refunds) | Automated issue file feeds, payee positive pay, separate disbursement accounts, reconciliation alerts | Integration work with the treasury system |
| Community bank or credit union | New account holds, remote deposit limits, high-value consumer item review, information sharing with peers | Customer friction on legitimate new members |
| Large bank | Image analytics, mule models across products, consortium data, structured claims handling | Model tuning and false positive cost |
Reporting, information sharing and customer response
- File the SAR correctly: FinCEN asks filers to include the key term "FIN-2023-MAILTHEFT" in SAR field 2 and the narrative and to select check fraud, field 34(d). Joint SARs are an option where institutions share the activity.
- Share under 314(b): FinCEN strongly encourages voluntary information sharing between financial institutions under the USA PATRIOT Act Section 314(b) safe harbour. See the Fraud Data Sharing and Consortium Intelligence Guide.
- Refer victims: point customers to the US Postal Inspection Service at uspis.gov/report or 1-877-876-2455 and to its mail theft prevention tips.
- Escalate urgent cases: FinCEN's alert gives a 24/7 Financial Institutions Hotline and asks that imminent threats go to local law enforcement.
- Keep records: retain SARs and supporting documentation for five years and verify the identity of anyone who requests that documentation.
- Close the loop with the customer: stop payment on outstanding serial numbers, reissue electronically where possible and consider a new account number if the original has been copied.
How to implement a cheque fraud programme
The order below works for a bank and, with the bank-only steps removed, for a business that issues cheques. Each phase should be measured before the next starts so that friction is justified by losses avoided.
- Baseline (weeks 1 to 4): pull 12 months of cheque fraud claims and returns, split by scheme (altered, counterfeit, forged, deposit fraud), channel (branch, ATM, remote deposit), account age and value band. This tells you whether your problem is on the paying side, the deposit side or both.
- Quick wins (weeks 2 to 8): enable payee positive pay for the largest issuers, set default exception decisions to return, publish the USPIS reporting route to customers and staff, and add the FinCEN key term to the SAR template.
- Deposit controls in shadow mode (weeks 6 to 12): run new tiered remote deposit limits and mule rules in monitor-only mode, record what they would have held, and compare against confirmed fraud. This is the equivalent of audit mode for fraud rules.
- Pilot (one region or product): switch the rules to enforcing for a pilot population, with a fast override path for branch and contact centre staff and a daily review of false holds.
- Roll out and tune: extend to all channels, retune thresholds monthly against loss and false hold rates, and add image analytics for high-value consumer items.
- Rollback plan: keep each new rule behind a switch with a named owner; if false holds or complaints breach an agreed threshold, revert to monitor mode while the rule is retuned, and log the decision.
Where identity fits
Cheque fraud increasingly runs through digital identity: accounts opened online with synthetic or stolen identities, account takeover used to change a postal address or order a cheque book, and remote deposit sessions from devices never seen before. Identity proofing at account opening, step-up authentication before address and cheque book changes, and device signals on remote deposit sessions all reduce cheque losses. See the Identity Fraud Prevention Guide.
Detection and measurement
| Metric | What it shows | Target direction |
|---|---|---|
| Cheque fraud loss per $1,000 of cheque volume | Net loss rate independent of volume changes | Down |
| Share of fraudulent items returned within deadline | Speed of detection on the paying side | Up |
| Positive pay coverage of business cheque volume | How much issuer volume is protected | Up |
| Losses on accounts under 90 days old | Account opening and mule control effectiveness | Down |
| Hold rate and false hold rate on new account deposits | Balance between protection and customer friction | Stable and justified |
| Days from customer claim to interbank recovery request | Claims process speed | Down |
For how these fit a wider measurement programme, see the Fraud Metrics and KPIs Guide.
Common failure patterns
- Positive pay without payee matching: serial number and amount match, but the payee was washed and rewritten.
- Exceptions approved by default: issuers set the default decision to pay and miss the daily review.
- Same limits for every account: new accounts get full remote deposit limits on day one, which is exactly what mule networks exploit.
- Siloed teams: fraud, AML and branch staff each see part of the pattern; the SAR is filed but the mule account stays open.
- Consumers left uncovered: controls built only for business positive pay, while most mail theft victims are individuals.
- Slow claims: missing return deadlines turns a recoverable item into a loss.
- Mule victims treated only as suspects: many mules are romance or job scam victims; closing the account without explaining the scam leaves them open to recruitment by the next network.
Framework mapping
| Area | Reference | How it applies |
|---|---|---|
| Suspicious activity reporting | FinCEN FIN-2023-Alert003 | Key term, SAR field 34(d), red flags |
| Funds availability and holds | Regulation CC, 12 CFR 229.13 | Exception holds and notice requirements |
| Account opening | Identity proofing and KYC programmes | Mule and synthetic identity prevention |
| Monitoring | NIST CSF 2.0 DE.CM Continuous Monitoring, DE.AE Adverse Event Analysis | Transaction and deposit monitoring as a detection capability |
| Wider fraud programme | Organisation fraud risk assessment | See the Fraud Prevention Guide for Digital Businesses |
Practitioner checklist
- Map where your organisation issues, deposits or pays cheques and who owns each control.
- Turn on payee positive pay for every account that issues cheques and review exceptions daily with a default of return.
- Move recurring payments to electronic methods with verified bank details.
- Set tiered remote deposit and ATM limits for new accounts and apply Regulation CC exception holds with proper notices.
- Build rules from the ten FinCEN red flags and tune them against your own losses.
- Use the FIN-2023-MAILTHEFT key term and field 34(d) on relevant SARs and share under 314(b).
- Give staff and customers the USPIS reporting route and mail theft tips.
- Track loss rate, timely return rate and new account losses monthly.
Standards and references
- FinCEN: Alert on Nationwide Surge in Mail Theft-Related Check Fraud Schemes (FIN-2023-Alert003)
- FinCEN: Mail Theft-Related Check Fraud, Threat Pattern and Trend Information, February to August 2023
- eCFR: 12 CFR 229.13 Exceptions (Regulation CC)
- US Postal Inspection Service: Mail Theft
- Federal Reserve Financial Services: Reduce check fraud with FedPayments Reporter
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Fraud Prevention Guide for Digital Businesses · Money Mule Detection Guide · Payment Fraud Guide · Elder Financial Abuse and Scam Prevention for Banks and Care Providers Guide