Forging or Altering Financial Instruments

Criminals fraudulently alter or misuse bona fide financial instruments (e.g., letters of credit, bankers’ receipts, checks, promissory notes) to hide and move illicit proceeds. This often involves simulating legitimate trade operations among shell entities, with non-existent, inflated, or circular transactions that obscure pricing or quantities. By forging or manipulating key details (such as reference numbers, shipment values, or goods specifications), criminals complicate the flow of funds and thwart standard compliance checks. In some cases, offenders forge entire documents or alter existing ones—adjusting values, modifying payee details, or creating fictitious reference data—to legitimize otherwise illicit transfers. The specialized nature of these instruments (e.g., documentary credits) heightens vulnerabilities when there is weak verification of authenticity, especially if original documentation is missing or replaced by tampered copies. This tactic, typically used for layering, can intersect with broader schemes (e.g., under- or over-invoicing, counterfeit corporate paperwork) to conceal ultimate beneficiaries and disguise the true origin of funds.

[
Code
T0126
]
[
Name
Forging or Altering Financial Instruments
]
[
Version
1.0
]
[
Parent Technique
]
[
Tactics
]
[
Risk
Product Risk
]
[
Created
2025-03-12
]
[
Modified
2025-04-02
]

Misuse of Financial Instruments

Letter of Credit Manipulation

Tactics

ML.TA0007
|
|

Criminals alter or forge financial instruments (e.g., letters of credit, checks) to construct complex or circular transaction chains, explicitly obscuring the origin of illicit funds under layers of falsified documentation and hindering straightforward compliance reviews.

Risks

RS0002
|
Product Risk
|

Criminals exploit specialized financial instruments (e.g., letters of credit, checks, promissory notes) by forging or altering key details relied upon for authenticity. By doing so, they circumvent standard verification or validation protocols inherent in these products, enabling illicit funds to appear legitimate. This vulnerability is central to the technique, as tampered or fabricated documents hamper clear AML scrutiny and allow layering through apparently credible instruments.

Indicators

IND00813
|

Letters of credit or bankers’ receipts bearing inconsistent or altered reference numbers that do not match corresponding bank or issuing authority records.

IND00814
|

Repeated presentation of trade documents with inflated or fictitious shipment values lacking corroborating evidence of actual goods movement.

IND00815
|

Customer or intermediary consistently fails to provide verifiable originals, presenting only incomplete or scanned copies with apparent signs of tampering or forgery.

IND02053
|

Multiple shell entities submitting near-identical financial instruments referencing the same cargo details without valid commercial justification.

IND02054
|

Frequent discrepancies between declared shipping routes or quantities in letters of credit and independently sourced logistics or customs data.

IND02055
|

Reliance on financial instruments issued by poorly regulated offshore institutions lacking transparent history or publicly verifiable records of operation.

IND02056
|

Physical checks or promissory notes exhibit visible alterations such as overwritten amounts or changed payee details that conflict with official issuance records.

Data Sources

  • Contains authoritative information on goods movements, declared values, and shipping routes.
  • By comparing declared shipment details in financial instruments with the actual customs records, investigators can detect discrepancies or forged references.
  • Provides insight into regulatory environments and the transparency of jurisdictions associated with issuing institutions.
  • Assists in detecting heightened risk from poorly regulated or opaque offshore entities that issue or handle suspect financial instruments.
  • Contains records of invoices and contractual agreements, including identifiers, amounts, and parties.
  • Comparing these details with the reference numbers, values, or payee data in financial instruments can uncover forged or inconsistently stated amounts, indicating possible document manipulation.
  • Provide official transaction details, including timestamps, transaction identifiers, and amounts.
  • Cross-check these transaction records with the reference numbers and amounts on allegedly forged financial instruments to reveal mismatches indicative of document tampering.
  • Store reference copies and official templates for financial instruments, checks, or promissory notes.
  • Comparing submitted documents against the archived originals or authorized templates can uncover unauthorized modifications or forgeries.
  • Employs forensic checks and specialized analyses (e.g., digital watermark verification, overwritten text detection) to authenticate financial documents.
  • Enables investigators to quickly spot signs of physical or digital tampering in letters of credit or other financial instruments.
  • Includes shipping logs, bills of lading, and other official documentation for cross-border transactions.
  • Matching these documents against the data presented in letters of credit or other financial instruments helps identify inflated or fictitious values.
  • Provide official records of entity registration, ownership structures, and directorships.
  • Uncover shell entities or overlapping beneficiaries orchestrating the circulation of forged financial instruments to obscure the flow of funds.

Mitigations

Extend rigorous background checks and validation procedures to customers dealing in specialized financial instruments. Conduct direct authenticity checks with issuing banks or authorities by verifying reference numbers, shipment details, and payee information to detect forged or altered instruments before completing transactions. This deeper scrutiny helps expose document tampering and prevents laundering via fraudulent letters of credit, promissory notes, or checks.

Implement specialized transaction monitoring scenarios to verify references, payee details, or amounts in checks, letters of credit, or promissory notes by cross-referencing with official issuance records or external data. Trigger alerts for repeated alterations, mismatched instrument details, or incomplete documentation that may indicate forgery. Focusing on anomalies in high-value or specialized instruments helps detect attempts to launder funds through tampered or forged financial instruments.

Provide specialized training to employees on detecting forged or manipulated financial instruments, emphasizing red flags such as inconsistent reference numbers, overwritten amounts on checks, or contradictory payee details in letters of credit. Highlight steps to confirm authenticity with issuing banks or reference authorities. A knowledgeable workforce ensures timely identification of document manipulation attempts.

Leverage open-source intelligence and independent databases to confirm the legitimacy of financial instruments and associated references, such as shipping routes and commodity valuations. Compare key document data, including reference numbers, payee details, or pricing, against official records to uncover potential forgeries or alterations. This independent verification layer increases the likelihood of detecting fraudulent or tampered instruments.

Systematically review trade-related financial instruments (e.g., letters of credit, shipping manifests, or invoices) for inconsistencies such as inflated values, mismatched cargo descriptions, or missing original documentation. Cross-verify with customs, shipping logs, or other reliable sources to pinpoint forged or manipulated documents. By focusing on authenticity and consistency, this measure helps detect layering attempts that rely on fraudulent trade documentation.

Instruments

IN0004
|
|
  • Criminals physically or digitally overwrite amounts, modify payee details, or forge signatures on checks.
  • These altered checks then enter clearing processes as if genuine, masking the true origin or purpose of funds.
  • The apparent legitimacy of check-based transactions makes detecting tampering more challenging for standard AML reviews.
  • Fraudsters alter core information (e.g., reference numbers, shipment details, or beneficiary data) on genuine letters of credit or create entirely forged ones.
  • By exploiting the trust and guarantee these instruments provide in trade finance, criminals mask the true nature of the underlying transactions.
  • This falsification hinders standard due diligence checks, allowing illicit funds to move through ostensibly legitimate trade channels.
  • Criminals falsify documents such as bills of lading or documentary collections, inflating values or referencing nonexistent goods.
  • This misrepresentation conceals the true flow of proceeds by presenting them as legitimate trade settlements, undermining AML checks that focus on genuine commercial activity.
IN0025
|
|
  • Offenders manipulate bank drafts by overwriting payee names or amounts, producing altered documents that still appear formally issued.
  • Because bank drafts are perceived as secure and guaranteed, these forged versions can evade casual inspection, enabling illicit funds to slip into legitimate payment flows.
  • Forgers modify payment amounts, beneficiary details, or due dates, circulating a falsified financial obligation.
  • Since bills of exchange are accepted as valid trade liabilities, these alterations legitimize otherwise illicit funds disguised as proceeds from normal business transactions.
  • Criminals generate or inflate invoices for goods or services that did not occur, creating fictitious claims.
  • By forging invoice details (e.g., amounts, reference numbers), they justify the movement of illicit funds under what appear to be legitimate receivables.
  • This tactic intermingles illegal proceeds with genuine transactions, obscuring their origin and complicating AML scrutiny.
  • Offenders fabricate entire promissory notes or tamper with key terms (e.g., principal, payee, due dates).
  • These fraudulent obligations create a facade of legitimate liabilities or repayment streams, providing a cover for illicit transfers or layering efforts.

Service & Products

  • Criminals can forge or alter reference numbers, shipment details, or beneficiary information to create inflated or fictitious transactions.
  • By tampering with key data points, they exploit the reliance on these instruments for trade settlement and obscure the actual flow of illicit funds.
  • Criminals physically alter paper checks, promissory notes, and similar instruments by changing amounts, payee details, or forging signatures.
  • These counterfeit documents are then presented as legitimate to move illicit proceeds undetected through manual clearing channels.
  • Criminals misuse trade finance by manipulating financial instruments (e.g., documentary credits) with inflated or nonexistent shipment values.
  • They forge or alter supporting documents to layer illicit proceeds under legitimate trade transactions, hiding true beneficiaries and complicating AML checks.

Actors

They create or alter official financial instruments, such as letters of credit, checks, or promissory notes, by adjusting key details like amounts, payee information, and reference numbers to legitimize otherwise illicit transfers. By presenting these falsified documents, criminals circumvent routine AML checks and obscure the flow of illicit funds.

They act as nominal corporate structures to issue or receive forged financial instruments, simulating legitimate trade transactions while concealing the true origin of funds. By leveraging falsified documentation, such as letters of credit and invoices, these entities impair due diligence measures and facilitate the layering of illicit proceeds.

References

  1. APG (Asia Pacific Group on Money Laundering). (2016, September). APG Typologies Report on Fraud & Money Laundering in the Pacific.APG Secretariat. https://apgml.org/documents/default.aspx

  2. MENAFATF (Middle East and North Africa Financial Action Task Force). (2014). Biennial Typologies Report, 2014. MENAFATF. https://www.menafatf.org/sites/default/files/Final_Biennial_Typologies_report_EN.pdf

  3. MENAFATF (Middle East & North Africa Financial Action Task Force). (2010). Money laundering and terrorist financing: Trends and indicators in the Middle East and North Africa region. MENAFATF.

  4. Manning, G. A. (2011). Financial investigation and forensic accounting (3rd ed.). CRC Press. http://www.crcpress.com