Check washing is a fraud method that uses chemicals to remove or blur the original ink on a check so details can be rewritten. Criminals then change the payee name or amount and deposit the altered instrument. It turns a legitimate payment document into a reusable fraud vehicle.
What Check Washing Is Used For
Check washing is a payment fraud technique that turns an ordinary paper check into a reusable instrument. By removing or disguising the original ink, the fraudster creates space to rewrite the payee or amount and cash or deposit the altered item.
The method matters because it exploits the continued trust placed in paper-based payment documents. A check can appear legitimate at first glance even after alteration, so the attack is often discovered only when the account holder, bank, or payee notices an unexpected withdrawal or a missing payment.
How Check Washing Works
The core mechanism is chemical alteration of the check surface. Criminals use solvents or other agents to lift the original writing while trying to preserve the paper, border, and other visible features that make the document look authentic enough to pass casual inspection.
Once the ink is weakened or removed, the check can be rewritten with a different beneficiary or amount. That makes the fraud especially effective when the original check was already properly issued, because the altered version inherits the appearance of a valid payment instruction.
Why Check Washing Succeeds
Check washing succeeds when the original controls around mail handling, document protection, and payment verification are weak. A check left exposed to theft, moisture, or tampering can be modified before the rightful recipient ever sees it.
The technique also benefits from the gap between visual inspection and authentic verification. Even when a check looks believable, the real issue is whether the payment instruction has been physically altered after issuance. That is why paper checks are more vulnerable than payment methods with stronger cryptographic or system-based integrity checks.
What Makes It a Security Concern
Check washing is not just document tampering, it is a financial fraud path that can redirect funds with very little technical sophistication. The loss can fall on individuals, businesses, or financial institutions depending on detection timing, account terms, and dispute handling.
It also creates downstream trust problems in payment operations. Once altered checks enter the workflow, organizations may face delayed reconciliation, customer disputes, and additional review burden for transactions that should have been settled normally.
Risk and Threat Considerations
Check washing creates a direct integrity and loss risk because the attacker is changing a real payment instrument rather than forging one from scratch. The main exposure is that a legitimate check can be intercepted, altered, and negotiated before the fraud is detected.
Failure mechanism: Chemical removal of ink weakens the original instruction while leaving the paper document sufficiently intact to accept rewritten payee or amount details, which allows the altered check to circulate as if it were valid.
Impact: Funds can be diverted to the attacker, legitimate payments can fail or be delayed, and the account holder may face reimbursement disputes, reconciliation problems, and administrative friction after the fraud is discovered.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | PE-3 — Physical Access Control | Protects paper checks from interception and tampering during handling and transit. |
| AU-6 — Audit Review, Analysis, and Reporting | Supports detection of altered-payment anomalies and unusual deposit activity. | |
| Recommendation — Restrict physical access to outgoing checks and secure mail handling points. Review payment exceptions and reconcile unexpected payee or amount changes promptly. | ||
| CIS Controls v8 | CIS-3 — Data Protection | Addresses protection of sensitive payment instruments from unauthorized alteration or disclosure. |
| CIS-8 — Audit Log Management | Helps preserve transaction evidence when altered checks are investigated. | |
| Recommendation — Protect check stock and outgoing payments with tamper-resistant handling procedures. Retain transaction and exception records needed to investigate suspected check fraud. | ||
Practitioner Guidance
What to watch for: Treat paper-check handling as a tamper-exposed process, especially when checks move through mail or third parties. Any sign of smudging, faint original text, unusual paper disturbance, or unexpected payee changes should trigger verification before deposit or settlement.
Common misunderstanding: The risk is not limited to counterfeit checks. A genuine check can be the fraud vehicle if its original ink is chemically removed and rewritten, so process controls around mailing, issuance, and payment review matter as much as the check itself.
Related resources from NHI Mgmt Group
- Why do attackers often check model availability before trying to generate content?
- What should security teams check before using chat to build provisioning workflows?
- What should organisations check before rolling out zero standing privilege at scale?
- What should organisations check before standardising on adaptive MFA?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
