Check Fraud: The Comeback Nobody Expected

Check fraud is the chemical or digital alteration, counterfeiting, or theft of paper checks for fraudulent deposit. After years of decline, it surged again starting in 2020 as criminals combined mail theft with mobile deposit to scale up an old crime. The result: industry surveys now show check fraud is the most-reported payments fraud at U.S. organizations, ahead of ACH and wire.

The Washed Check

Maria Dominguez found out about the fraud when her landlord called to say the rent was late.

She'd mailed a $1,450 check on the first of the month, same as always. Dropped it in the blue USPS collection box on the corner at 7 AM on her way to work. She'd been mailing rent checks to the same address for two years without a problem.

The check never arrived. Or rather, a version of it arrived at a different destination.

Someone had fished her check out of the collection box using a bottle of rodent glue on a string. They used acetone (nail polish remover) to dissolve the ink on the payee line and the amount. Maria's signature, printed on the check with toner-based ink that resists solvents, survived the wash. So did the routing and account numbers at the bottom.

The criminal rewrote the check. New payee: a name they controlled. New amount: $8,900. Same signature, same account, same check number. They deposited it via mobile banking at a different institution. By the time the check cleared and the funds were withdrawn, Maria's account was short $8,900 instead of $1,450.

Her bank refunded the money after a fraud claim, but the process took three weeks. During those three weeks, other checks she'd written bounced. She accrued overdraft fees. Her auto-payment for car insurance failed. The cascading damage from one stolen check took months to fully resolve.

This story is fictional, but the patterns are real.

Why This Matters

In Payment Systems 101, you learned that different payment methods have different fraud profiles based on their reversibility, speed, and the information required to initiate a transaction. Checks sit in a peculiar spot on that spectrum. They're slow, paper-based, and feel anachronistic in an era of instant payments. And yet check fraud is surging.

This might seem counterintuitive. Why would criminals bother with paper checks when they can execute wire fraud or account takeover attacks digitally? The answer is that checks are uniquely vulnerable. They contain everything a criminal needs (account number, routing number, a signature) printed right on the face of the instrument. They travel through a physical mail system that has significant security gaps. And the verification processes that banks use to clear checks haven't kept pace with the tools criminals use to alter them.

Check fraud also hits victims in a distinctly painful way. Unlike credit card fraud, where the cardholder's liability is limited and chargebacks happen relatively quickly, check fraud can freeze a victim's primary bank account for weeks while the bank investigates. For people living paycheck to paycheck, that delay can be devastating.

How Check Fraud Works

What is check washing?

Maria's case is check washing: the chemical alteration of a legitimate check. The criminal starts with a real check, dissolves the variable information (payee and amount), and rewrites it for a larger amount payable to someone they control.

The chemistry is straightforward. Most consumer pen inks (gel and ballpoint) are soluble in common solvents: acetone, rubbing alcohol, or commercial products designed for stain removal. The ink dissolves, but the printed elements of the check (bank name, routing numbers, account numbers) are typically produced with toner or offset printing, which resists these solvents. The result is a check that looks legitimate because it is legitimate, just with different handwritten details.

Check washing works because of a fundamental design flaw: the variable, high-value information on a check (who gets paid and how much) is the least protected part of the document. The account numbers that identify where money comes from are machine-printed and chemically resistant. The payee name and dollar amount, which determine where the money goes and how much, are written by hand with easily removable ink.

Where do washed checks come from?

Washed checks need raw material. That raw material comes overwhelmingly from the mail.

Criminals target USPS collection boxes (the blue boxes on street corners), residential mailboxes (especially unlocked ones in rural and suburban areas), and in some cases, mail carriers themselves. Stolen USPS arrow keys, which open entire banks of cluster mailboxes at apartment complexes, have become prized tools in the check fraud ecosystem.

FinCEN issued an advisory (FIN-2023-Alert003) on February 27, 2023 specifically about mail theft-related check fraud, noting that SARs for check fraud increased 23% in 2021 and nearly doubled in 2022 to roughly 680,000 filings.^[1] A follow-up September 2024 Financial Trend Analysis covering February to August 2023 found financial institutions filed 15,417 BSA reports tied to mail theft-related check fraud, totaling more than $688 million in suspicious activity.^[2] The Postal Inspection Service has confirmed that mail theft is a growing problem, fueled in part by the resale value of stolen checks on criminal marketplaces.

The street-level theft often involves different people than the ones who wash and cash the checks. A stolen check might change hands two or three times before it's altered and deposited. Thieves sell raw stolen checks to washers, who sell finished checks to people who deposit them through mule accounts.

How do counterfeit checks get made?

Check washing starts with a real check. Counterfeiting creates one from scratch. Per FinCEN's analysis, in 26% of mail theft-related cases the stolen check was used as a template to produce a counterfeit one rather than washed.^[2]

With modern desktop publishing software and commercial check stock (available from office supply stores), producing a convincing counterfeit check is within reach of anyone with basic computer skills. The criminal needs only a bank's routing number, a victim's account number, and a check template that matches the bank's format.

Account and routing numbers are not secrets. They're printed on every check a person writes. Anyone who has ever received a check from someone has their banking information. These numbers also flow through ACH transactions, meaning compromised databases can provide the raw data for check counterfeiting at scale.

Counterfeit checks are used in several fraud schemes:

Overpayment scams. A "buyer" sends a counterfeit check for more than the purchase price and asks the seller to wire back the difference. The check bounces days later, but the wire is already gone.

Employment scams. A fake employer sends a counterfeit check as a "first paycheck" and asks the new "employee" to buy supplies and send back the receipt. The check bounces; the money spent on supplies is lost.

Lottery and prize scams. The victim receives a check for "winnings" and is told to deposit it and wire back taxes or fees. The check is counterfeit, but the wire is real.

These scams exploit the gap between provisional credit and final settlement. Regulation CC requires banks to make at least $275 of a deposit available by the next business day (raised from $225 in July 2025), with the remaining funds typically released over the next 2 to 5 business days. The check itself, however, can take weeks to fully clear. Victims spend or wire the provisionally credited funds, then discover the check was fake.

Why is mobile deposit a check-fraud accelerant?

Mobile deposit changed check fraud in a fundamental way. Previously, cashing a fraudulent check required physically visiting a bank or check-cashing business, which meant showing ID and being recorded on camera. Mobile deposit removed that friction.

With mobile deposit, a criminal can deposit a check from anywhere using a phone. They don't need to show their face. Multiple altered or counterfeit checks can be deposited across multiple accounts in minutes. The physical check itself might be deposited at one bank, photographed and deposited at a second bank, and photographed again for a third. This is called "double depositing" or "multi-depositing."

Banks have implemented duplicate detection systems that compare check images across deposits, but these systems aren't perfect. Image quality varies. Check numbers can be altered between deposits. And detection across different institutions requires information sharing that doesn't always happen in real time.

Why Check Fraud Is Surging

The AFP Payments Fraud and Control Survey now ranks check fraud as the most-reported payments fraud at U.S. organizations: 63% of respondents said their organization experienced check fraud in 2024, ahead of ACH and wire.^[3] Mailbox theft alone accounted for check fraud at 23% of organizations.^[3]

What changed during the pandemic?

Check fraud had been declining for years as electronic payments grew. Then several things changed at once.

During the pandemic, the federal government mailed millions of stimulus checks. This created both a target-rich environment (more checks in the mail) and a training ground for criminals who learned the check fraud playbook.

Bank branches reduced hours or closed temporarily, pushing more transactions to mobile channels. Mobile deposit adoption surged. Criminals who had previously been deterred by the need for in-person check cashing suddenly had a frictionless alternative.

At the same time, USPS experienced staffing shortages that affected mail security. Collection boxes were emptied less frequently. Delivery schedules became less predictable. Criminals had more time and opportunity to steal mail.

Why is check fraud so cheap to commit?

Check fraud remains attractive because the barrier to entry is low and the return per check can be high.

A stolen check costs almost nothing to acquire (break into a mailbox). Check washing supplies cost a few dollars. A successfully washed check might yield thousands. Even counterfeiting is cheap: check stock paper, toner, and software are all commercially available.

Compare this to more sophisticated fraud types. Business email compromise requires weeks of reconnaissance. Account takeover needs stolen credentials and technical infrastructure. Check fraud needs a bottle of acetone and a stolen envelope.

The criminal marketplace has also adapted. Stolen checks, washed checks, and check-making templates are bought and sold on the same platforms as stolen credit card numbers and identity documents. Specialization is common: some criminals steal mail, others wash checks, others provide mule accounts for deposits.

Why hasn't check verification kept up?

Check processing technology hasn't kept pace with the threat. The fundamental challenge is that checks were designed for a world of in-person banking where a teller could examine the physical check, compare signatures, and question unusual items.

Today's reality is different. Many checks are processed as images (converted to electronic format at the first bank), never physically examined by a human. Signature verification is often automated and relies on pattern matching that can be fooled. Positive Pay systems (where the account holder pre-registers expected checks) exist but aren't universally adopted. And the provisional credit rules mean banks must make funds available before they can fully verify the check.

The Victim's Experience

Check fraud hits victims harder than many other fraud types because of how checking accounts work.

When a washed or counterfeit check clears against your account, the bank debits the money from your balance. This can trigger a cascade:

• Other checks you've written bounce, generating overdraft fees
• Automatic payments fail, potentially affecting insurance, utilities, and credit
• Your available balance drops, potentially below zero
• The bank may restrict your account while investigating

Regulation CC governs how quickly banks must make deposited funds available, but it doesn't dictate how fast a fraud claim gets resolved. Banks investigate disputed check items under their own policies, and the process can stretch from days to several weeks. For someone who depends on their checking account for daily expenses, even a short hold can be a serious hardship.

This is fundamentally different from credit card fraud, where the cardholder is typically made whole quickly and isn't out of pocket during the investigation. Check fraud victims often bear the financial stress of the investigation period even when the bank ultimately refunds the loss. On the bank's side, suspected check fraud is one of the standard triggers for a Suspicious Activity Report under the BSA. The FinCEN advisory specifically asks institutions to flag mail theft-related cases with the keyword "FIN-2023-MAILTHEFT" in the SAR narrative.^[1] New-account check fraud is one of the reasons identity verification at account opening matters so much; the criminal who deposits the washed check usually opened the receiving account days earlier.

Key Takeaways

• Check fraud is resurging despite the shift to digital payments. FinCEN documented roughly 680,000 check fraud SAR filings in 2022 (nearly double 2021)^[1] and a follow-up report covering Feb-Aug 2023 reported $688 million in mail theft-related check fraud across 15,417 BSA filings.^[2]
• Checks contain all the information needed to commit fraud, printed right on the face. Account numbers, routing numbers, and signatures are visible to anyone who handles the check.
• Check washing exploits a design flaw. The most important information on a check (payee and amount) is the least protected, written in easily removable ink.
• Mobile deposit removed the biggest deterrent. Criminals no longer need to show their face to cash a fraudulent check, and the same check can potentially be deposited multiple times across institutions.
• Victims bear disproportionate pain. Unlike credit card fraud, check fraud can freeze a victim's primary bank account for weeks, causing cascading financial damage from bounced payments and overdraft fees.
• Check fraud sits inside a broader taxonomy of payment fraud. Washing, counterfeiting, and double-depositing are variants of the same root weakness: paper instruments carry the data needed to forge them.

What's next: The Wire Transfer & ACH Fraud article covers how criminals exploit electronic payment systems, where the stakes are higher and the money moves faster.

Key Terms

References

1. FinCEN Alert FIN-2023-Alert003 — Nationwide Surge in Mail Theft-Related Check Fraud Schemes (February 27, 2023)↗ — SARs for check fraud increased 23% in 2021 and nearly doubled in 2022 to roughly 680,000 filings; SARs filed for mail theft-related check fraud should use the keyword "FIN-2023-MAILTHEFT".

2. FinCEN Financial Trend Analysis — Mail Theft-Related Check Fraud (September 2024)↗ — Covering February 27 to August 31, 2023: 15,417 BSA reports from 841 institutions, more than $688 million in suspicious activity. 44% of cases involved an altered stolen check; 26% used a stolen check as a counterfeit template; 20% involved fraudulently signed checks.

3. 2025 AFP Payments Fraud and Control Survey Report — Key Highlights↗ (April 2025) — 63% of organizations experienced check fraud in 2024 (the most-reported payment method for fraud); 23% of organizations experienced check fraud due to mailbox theft.