Check Fraud Detection: Identifying Counterfeit, Forged, and Altered Checks

Check volume has fallen for two decades and check fraud losses have not. The explanation is straightforward: the checks still in circulation are disproportionately high-value business and government payments, and mail theft has created a reliable supply of stolen items for anyone willing to alter them.

This guide covers the three fraud types, how each one presents, and where the loss lands.

The Three Types

Counterfeit

The check was never issued by the accountholder. It is manufactured — printed on stock the fraudster produced, using a real routing and account number obtained from a stolen check, a discarded statement, or a data breach.

Counterfeits have improved enormously. The tells are physical rather than logical: paper weight and finish that differ from the issuer's genuine stock, missing or non-responsive security features, a perforated edge that is too clean or absent entirely, and toner that sits on the surface rather than bonding into the paper.

Forged

The check is genuine but the signature is not — either a forged maker signature on a stolen blank, or a forged endorsement on a check stolen after issue.

Endorsement forgery is the more common of the two and the one most often missed, because the check itself is completely legitimate and everything on the front is correct. The fraud is on the back.

Altered

The check is genuine and properly signed, but something on it was changed after issue. Almost always the payee, sometimes the amount.

This is now the dominant pattern, and the reason is mail theft. A check stolen from a mailbox is "washed" — the ink removed chemically — and rewritten to a different payee, frequently for a different amount. The signature is real, the stock is real, the account is real. Only the payee line is false, and no visual inspection of the signature will reveal it.

Detection at the Counter

Physical examination of the item:

• Paper that feels wrong — too thin, too glossy, or wrong finish for the purported issuer
• Security features absent or not responding as described on the check itself
• Edges too smooth on all four sides, indicating it was cut rather than perforated
• Ink that smears, or areas where the surface texture differs — a washing indicator
• Font inconsistencies between the payee line and the rest of the check
• Handwriting that changes character mid-check
• A MICR line that looks printed rather than magnetically encoded, or that is misaligned
• Missing or altered address and phone information for the issuer

Transactional indicators:

• A large item presented by a non-customer, or by a new customer with a thin relationship
• An item drawn on an out-of-area institution with no explanation
• A check dated well in the past, or post-dated
• An amount that is inconsistent with the presenter's account history
• Multiple items from unrelated issuers presented by the same person
• A payee name that does not match the presenter's identification, or an unusual second endorsement

Behavioral indicators — the ones a system cannot see:

• Urgency, particularly pressure applied at a busy time or near closing
• Nervousness, or watching staff rather than the transaction
• A rehearsed-sounding explanation offered before it was requested
• Willingness to accept a partial amount, or to leave and return to a different branch
• Someone waiting outside, or accompanying the presenter but not participating

Detection in Operations

Counter detection catches a minority of items. Most check fraud is found — or missed — in operations.

Positive pay is the single most effective control available. The business customer transmits an issue file of check numbers, amounts, and ideally payees; presented items are matched against it and exceptions are reported for decision. Payee match is the component that addresses washing, and a positive pay service without payee match does not stop the dominant fraud type.

Reverse positive pay — where the customer reviews all presented items rather than the bank matching against a file — is weaker, because it depends on the customer looking every day.

Signature verification thresholds, applied by dollar amount, with genuine review rather than a cursory glance.

Duplicate detection for items presented more than once, which catches both fraud and processing errors.

Velocity and anomaly rules on deposit behavior — a customer who has deposited a few hundred dollars a month for two years depositing a $14,000 item is worth a look regardless of how good the item appears.

Return deadlines. The bank's rights depend on returning items within the applicable midnight deadline. A fraudulent item discovered after the deadline may leave the bank holding the loss even where the fraud is undisputed, which is why exception queues must be worked daily without exception.

Who Bears the Loss

Check loss allocation is governed by the UCC and turns on a small number of principles.

Ordinary care. Both the bank and the customer owe it. A bank that failed to examine an item it should have examined, or a customer whose procedures made the alteration possible, may bear or share the loss.

Comparative fault. Where both parties failed, loss can be allocated between them.

The customer's duty to examine statements and report unauthorized items promptly. A customer who does not review statements and reports a forgery months later may have lost the claim, and repeated items by the same wrongdoer are treated harshly — the first one is the bank's problem, the tenth is the customer's.

Warranties flow with the item through the collection chain: the depositary bank warrants the endorsement, which is why an item returned for forged endorsement travels back to where it was deposited.

The negligence rule. A customer whose own negligence substantially contributed to the fraud — leaving signed blank checks accessible, failing to reconcile, using a facsimile signature carelessly — may be barred from recovery.

For business customers, offering positive pay and documenting their acceptance or refusal materially changes the analysis. A customer who declined the control, in writing, after being told what it protects against, is in a different position from one who was never offered it.

What to Tell Business Customers

The conversation that prevents most commercial check fraud is short and rarely had:

• Use positive pay with payee match. Not just positive pay.
• Do not mail checks from an unsecured mailbox. Use the post office counter, or move the payment to ACH.
• Reconcile daily, not monthly. The return deadlines run in days.
• Restrict who has access to check stock, and store it as if it were cash, because it functionally is.
• Consider eliminating checks for recurring payments. The most effective check fraud control is not writing checks.

Structured coverage is available through our bank fraud prevention training, the Certificate in Fraud Prevention, and Financial Crimes Red Flags Training.

Training the Front Line Realistically

Check fraud training frequently fails because it teaches identification of features that tellers cannot practically check during a transaction. A teller with a queue of six people is not going to hold a check to the light and inventory its security features.

What works is narrower and more useful. Teach two or three tells that take one second — the feel of the paper, whether the perforated edge is present, and whether anything on the check looks like it was written by a different hand or a different printer. Those three checks are performable at speed.

Give staff explicit permission to slow down. The most valuable thing a teller can do with a suspicious item is take longer — step away to a supervisor, verify with the issuing institution, or ask for a second form of identification. Institutions where slowing down is treated as poor service get fast transactions and higher losses, and staff take the cue from how supervisors respond the first time someone escalates.

Never confront. The teller's job is to complete or decline the transaction safely and escalate afterward. Accusation creates a safety issue and destroys any chance of a controlled response.

Close the loop. Tell staff what happened to the items they flagged. A teller who stopped a $9,000 counterfeit and never heard about it will not stop the next one with the same care.

Why Check Fraud Is Rising While Check Volume Falls

The apparent paradox resolves once you look at which checks remain and who is stealing them.

The surviving check population is high value. Consumer bill payment moved to cards and ACH years ago, so what still travels by check is disproportionately business-to-business payment, insurance settlements, government disbursements, tax refunds, and real estate proceeds. A thief who intercepts one item now expects a far larger average value than a decade ago.

Mail theft industrialized. Stolen arrow keys, mailbox fishing, and theft from collection boxes and carrier routes supply a steady volume of items, and stolen checks are traded openly. The economics are attractive because the input cost is low and the yield per item is high.

Washing is low technology. Removing ink from a genuine check requires household chemicals and produces an item with real stock, a real account, and a genuine signature. No security feature on the check addresses it, because nothing about the check is counterfeit.

Detection got harder, not easier. Image exchange under Check 21 means most items are never physically examined by anyone. The tactile and paper-quality signals that identified counterfeits are unavailable when the item arrives as an image, which shifts detection almost entirely onto data — positive pay matching, velocity rules, and anomaly detection.

Three implications for an institution. First, positive pay with payee match is not an upsell, it is the control, and business customers who decline it should do so in writing. Second, the deposit side deserves as much attention as the payment side — a fraudulent item has to be deposited somewhere, and institutions that monitor deposit behavior catch items that the paying bank's controls missed. Third, the fastest reduction available to any business customer is to stop writing checks, and a treasury conversation that moves recurring payments to ACH eliminates the exposure entirely rather than managing it.

Frequently Asked Questions

What is the most common type of check fraud today?

Alteration — specifically payee alteration on genuine checks stolen from the mail and chemically washed. The check stock, the account, and the signature are all authentic, so signature verification does not detect it. Only payee-match positive pay reliably catches it before payment.

What is positive pay, and what is payee match?

Positive pay is a service where a business transmits an issue file of check numbers and amounts, and the bank matches presented items against it, reporting exceptions for the customer to decide. Payee match extends the comparison to the payee name, which is the component that addresses check washing. Positive pay without payee match misses the dominant fraud type.

How can a teller spot a counterfeit check quickly?

By feel and edge rather than by detailed inspection. Counterfeit stock frequently differs in weight or finish from genuine stock, and manufactured checks often lack the perforated edge that genuine business checks carry. Font or handwriting that changes character across the check is a third fast indicator.

Who is liable for a forged or altered check?

It depends on ordinary care by both parties, comparative fault, the customer's duty to examine statements and report promptly, and warranties running back through the collection chain. A customer whose own negligence substantially contributed — unsecured check stock, no reconciliation — may be barred from recovery, and a customer who declined positive pay in writing is in a weaker position.

Why do return deadlines matter so much in check fraud?

Because a bank's right to return an item expires. An item discovered to be fraudulent after the applicable midnight deadline may leave the bank absorbing the loss even where the fraud is not disputed. This is why exception queues must be worked every business day without exception.

What should a teller do when a check looks suspicious?

Slow the transaction down, involve a supervisor, and verify independently — never confront the presenter. Institutions should give staff explicit permission to take extra time on a suspicious item and should tell them afterward what happened, because unacknowledged escalations stop happening.