Cheque Fraud

Criminals commit check fraud to generate illicit proceeds from worthless or stolen checks, exploiting float periods or forging endorsements to illegally acquire funds that then move into subsequent laundering phases. This is the primary objective behind the technique.

Fraudsters open new bank accounts using stolen or fabricated identities to deposit fraudulent checks, circumventing KYC and identity verification controls. This distinct vulnerability arises from the exploitation of customer onboarding processes, enabling the swift placement and layering of illicit proceeds.

Criminals exploit the inherent vulnerabilities of checks—specifically float periods and delayed clearing—by depositing worthless or altered checks and rapidly withdrawing or transferring funds before the checks are returned unpaid. This is the primary vulnerability enabling this check fraud technique.

• Capture check deposit details, including timestamps, amounts, payors, and deposit channels, as well as subsequent withdrawals or transfers.
• Facilitate the identification of returned checks that have already been withdrawn, revealing potential fraudulent float exploitation.
• Provide concrete evidence of suspicious deposit and withdrawal patterns linked to possible check fraud schemes.

• Analyzes physical or scanned checks for chemical alterations, tampered payee fields, or other signs of forgery.
• Enables proactive identification of check 'washing' techniques before funds are released.

• Consolidates records on known or suspected fraudulent activities, including stolen checks, identity theft incidents, and frequently used scam techniques.
• Enables cross-referencing of ongoing check fraud patterns or flagged payors with existing fraud alerts, supporting earlier detection of high-risk deposits.

• Contain verified identity documents, beneficial ownership information, and account opening details, enabling the detection of inconsistent or suspicious customer profiles.
• Provide baseline transaction behavior and risk assessments, allowing for the identification of anomalies such as sudden large check deposits from unknown payors.
• Help verify the legitimacy of recently opened accounts used for rapid withdrawals following fraudulent check deposits.

• Logs the time, location, and frequency of ATM-based check deposits, revealing geographically dispersed or rapid deposit patterns.
• Helps identify multiple deposits made in quick succession across different branches or ATMs, consistent with check fraud layering tactics.

Require thorough identity verification of new account holders, including verifying the authenticity of identification documents and cross-checking customer details with fraud databases to detect stolen or fabricated identities frequently used in cheque fraud. Additionally, confirm the legitimacy of payors for large or unusual checks to ensure alignment with the customer’s stated profile.

Implement targeted monitoring scenarios to flag repeated deposits of checks from suspicious sources, immediate large withdrawals before deposited checks clear, or excessive NSF returns. Use near real-time alerts to freeze or hold accounts for review when such patterns appear, preventing criminals from exploiting the float period.

Train frontline staff to detect check 'washing,' including spotting chemical erasures, mismatched handwriting, or discolored areas on checks. Provide clear escalation protocols for unusual deposits or repeated NSF checks, reinforcing systematic ID verification steps for new customers to reduce the risk of fake or stolen identities.

Impose extended holds on fund availability for new or high-risk customers depositing checks. Restrict or delay access to specially flagged checks, such as those from unfamiliar payors or with suspicious alterations, and deny check-cashing services if documents appear invalid. Freeze or block transactions pending further inquiry when deposits show signs of check fraud.

Perform regular reviews of customers who repeatedly deposit checks from disparate payors without clear legitimate ties. Scrutinize sudden large deposits, verify the payors’ authenticity, and update risk ratings when checks bounce or appear altered. Apply enhanced controls or enhanced due diligence (EDD) if patterns indicate a persistent risk of check fraud.

• Criminals deposit fraudulent (e.g., NSF or washed) checks into newly opened or existing accounts, exploiting float periods or delayed clearing to receive temporary credit.
• By the time these checks are flagged as worthless and returned unpaid, the illicit actors have often withdrawn or transferred the credited funds.
• Stolen checks may be chemically altered to change payee or amount details, further facilitating unauthorized withdrawals or purchases.

• Fraudsters set up bank accounts (personal or business) using stolen or fabricated identification to deposit worthless checks.
• Once the funds are credited and become available, they quickly withdraw or transfer them across multiple accounts, obscuring the transaction trail.
• The routine nature of check deposits into these accounts helps criminals evade immediate scrutiny, making it easier to move or convert illicit proceeds before the checks are returned unpaid.

• After depositing counterfeit or washed checks, offenders exploit provisional credit by withdrawing the funds as physical currency.
• Converting the temporarily credited amounts into cash makes the proceeds less traceable and facilitates rapid layering or integration into the illicit actors’ financial activities.

• Criminals deposit fraudulent checks via mobile or scanned images, reducing face-to-face scrutiny and accelerating crediting of funds.
• They quickly move or withdraw the provisional balances, capitalizing on delayed verification of check authenticity.

• Fraudsters deposit worthless or altered checks at ATMs outside normal banking hours, minimizing scrutiny.
• By exploiting the delayed clearing, they can rapidly withdraw or transfer proceeds before the checks are returned unpaid.

• Offenders exploit the manual clearing processes for physical checks, depositing forged or “washed” checks into accounts and withdrawing credited amounts before discovery.
• The reliance on paper documentation allows tampering with payee details or amounts, enabling fraudulent deposit activities.

• Illicit actors establish accounts under fabricated or stolen business credentials, depositing high-value checks that may be non-sufficient funds (NSF) or altered.
• The guise of business activities masks the rapid outflow of temporarily credited funds, hindering immediate detection.

• Criminals open accounts with stolen or fabricated identification and deposit counterfeit or worthless checks, exploiting the float period to withdraw or transfer funds before detection.
• The straightforward setup of these accounts and routine check deposits enable rapid movement of illicit proceeds once checks are credited.

Illicit operators commit check fraud by:

• Opening new bank accounts with stolen or fabricated identification.
• Depositing worthless or altered checks and rapidly withdrawing or transferring funds before detection.
• Physically stealing checks from the mail and chemically “washing” them to manipulate payee or amount details.

These actions exploit the float period or delayed clearing and generate direct losses for financial institutions once the checks are returned unpaid.

Document forgers enable check fraud by:

• Producing stolen or fabricated identification used to open fraudulent bank accounts.
• Altering checks (often referred to as “washing”) to change payee or amount details.

Financial institutions face difficulty in identifying these tampered checks before crediting accounts, leading to losses when the checks prove invalid.