The Outlier Lab

Check and Mobile Deposit Fraud

Counterfeit, altered, washed, forged and duplicate-presented checks deposited remotely or at ATMs, with funds withdrawn before the check is returned or a warranty claim arrives.

What it is

Checks are a shrinking payment instrument with a growing fraud problem. FinCEN's February 2023 alert on mail-theft-related check fraud reported more than 680,000 check fraud SARs in 2022, nearly double 2021's 350,000 (FinCEN Alert FIN-2023-Alert003). Remote deposit capture (RDC) removed the teller (the one person who might have handled the paper), and the check's slow, multi-party return process gives fraudsters a window that faster outbound rails let them exploit.

The core typologies:

TypeWhat happened to the itemWho usually reports it
CounterfeitA fake check, often built from a real account's routing and account dataPaying bank (returned item)
Altered / washedA real check with payee or amount changedThe check writer, after seeing their statement
Forged / fraudulently signed or endorsedA real or stolen check signed or endorsed by someone not entitledCheck writer or intended payee
Duplicate presentmentThe same check deposited twice, mobile at one institution and in person or mobile at anotherThe second depository bank, or the paying bank
Fake check scamsA genuine-looking check given to a victim who deposits it and sends money backVictim, after the return

Distinguish from Instant Funding Abuse (Kiting), which concerns the provisional-credit exposure window across any rail (including checks written on accounts with no funds), and from Seller-Targeted Scams (Fake Payment and Overpayment), where the depositor is a victim.

How it works

Conceptually, the actor obtains checks or check data (mail theft, counterfeiting, a scam payment), finds a deposit channel with limited human contact (a newly opened online account, a mule's account, an ATM), deposits, and withdraws or moves funds as soon as they're available. The item is returned, or a claim arrives, after the money is gone.

Diagram: Stolen, altered or counterfeit check, Account obtained: new, mule or own, Remote or ATM deposit, Funds made available under hold policy, Exit: ATM, P2P, instant payment, card, wire, Returned unpaid, Warranty or alteration claim from paying bank, Negative balance

FinCEN's 2024 analysis found perpetrators preferred deposit channels that avoid human contact (ATMs and remote deposit capture), and that accounts used to negotiate stolen checks were often opened online with compromised or synthetic identities, or via a mule (FinCEN Financial Trend Analysis, 2024).

Two exposure clocks

With checks, "the check cleared" doesn't mean the loss risk is gone. A counterfeit or NSF item is typically returned within days. But an altered or forged-endorsement check drawn on a real, funded account may pay normally and only come to light when the check writer notices and their bank makes a warranty claim against the depository bank. That second clock can run weeks or months.

Transaction footprint

StageWhat you see in the dataDecision point
AccountNew account (often opened online); minimal history; no prior check activity; identity shared with other new accountsOnboarding risk tier; mobile deposit eligibility
DepositCheck amount large relative to history; business or government check deposited into a personal account; payee name differs from account holder; check stock or image anomalies; same check image or MICR line seen beforeDeposit acceptance and hold decision
AvailabilityCustomer contacts support to ask when funds are available; repeated small deposits building to larger onesHold length and amount; exception holds
ExitATM withdrawals at limit; P2P or instant payment to new counterparties; gift card or crypto purchases; wire outExit decision on funds not yet collected or aged
Return or claimReturned item reason; warranty claim; duplicate-presentment notice from another bankRecovery; account closure; SAR consideration

The 2017 Regulation CC amendments, effective July 1, 2018, added remote-deposit indemnities in 12 CFR 229.34 that put duplicate-deposit risk on the mobile or remote-deposit bank.

  • Duplicate deposits. Say a customer mobile-deposits a check and later deposits or cashes the paper original elsewhere, and the original is returned because it was already paid. The bank that accepted the remote deposit indemnifies the bank that took the original.
  • The endorsement exception. The indemnity doesn't apply if the original carries a restrictive endorsement inconsistent with the means of deposit, such as "for mobile deposit only." That's why many RDC agreements require that endorsement.
  • Limits. Recovery is capped at the indemnified bank's loss plus interest and expenses, and is reduced for that bank's own negligence or bad faith.
  • Electronically created items. The same rule created parallel indemnities (not warranties) for items that never existed on paper.

For a mobile deposit product, duplicate-presentment detection is therefore a direct loss control. How the availability schedule and these indemnities apply to your program is a legal question, particularly for a non-bank relying on a partner bank's charter. Settle it with counsel and your partner bank before setting hold policy.

Common variants

VariantWhat's differentWhere it shows up
Mail-theft check fraudStolen checks altered, used as counterfeit templates, or fraudulently signedBanks and credit unions nationwide
New-account check fraudAccount opened online primarily to negotiate stolen checksNeobanks, online banks, brokerages with check deposit
Mule depositsScam victims or recruited mules deposit checks and forward fundsAll; see Money Mules
Duplicate presentmentSame item deposited at two institutions, or mobile then in personAnywhere RDC exists; first-party and third-party
Fake check scamsOverpayment, fake job, lottery or marketplace sale; victim deposits and sends money backConsumers, marketplace sellers
Check kitingChecks written between accounts with no real funds to exploit floatSee Instant Funding Abuse (Kiting)
Check-funded bust-outBad check deposited to pay down a credit or overdraft balance, then the line is drawn againSee Bust-Out Fraud

Where it shows up

  • Neobanks and Consumer Fintech: mobile deposit is a standard feature; instant P2P, debit cards and early availability make exit fast. Partner-bank arrangements mean the fintech may set availability policy while the bank carries regulatory obligations.
  • Brokerage and Investing: check deposits are less common but can fund trading. The exit path runs through trades and withdrawals; a returned check after positions are opened adds market risk.
  • Online Marketplaces and Payments and P2P: fake check overpayment scams against sellers; the seller deposits, sends "the difference" by P2P, and the check returns. See Seller-Targeted Scams (Fake Payment and Overpayment).
  • Cashback, Coupons and Rewards: rare as a funding rail; programs that pay out by check face stolen and altered payout checks, the same mail-theft exposure a business check writer has.

Impact

  • Scale: FinCEN received 15,417 reports on mail-theft-related check fraud in the six months after its alert (February 27 to August 31, 2023), linked to about $688 million in transactions; the average report was about $44,800 and the median about $14,200 (FinCEN Financial Trend Analysis, 2024; FinCEN release).
  • Typology mix: in FinCEN's review, about 44% of reports involved altered checks, 26% counterfeits built from stolen checks, and 20% fraudulently signed checks (FinCEN FTA).
  • Who files: banks filed 88% of reports, mostly small and mid-size institutions (ABA Banking Journal, 2024).
  • Interbank disputes: warranty claims between depository and paying banks are slow and contentious; operational cost is significant.
  • Victim harm: mule depositors (often scam victims) end up liable for the returned item.

Red flags

FinCEN's red flags include new accounts used only for check deposits followed by rapid withdrawals or transfers, existing customers with no check history suddenly depositing checks, check stock inconsistent with the issuing bank, and signs of overwritten handwriting (FinCEN Alert). Map them to signals:

Prevention and detection at a glance

LayerControl or signalWhat it does here
PreventMobile deposit eligibility and limitsTie RDC access and per-item, daily and monthly limits to tenure and history (Velocity and Exposure Limits)
PreventFunds Availability HoldsUse exception holds with documented reasons; differentiate spendable vs. withdrawable funds
PreventKYC and Customer Identification Program (CIP)Raises the bar for online accounts opened to cash stolen checks
DetectImage analytics and duplicate detectionImage forensics plus cross-institution duplicate and item-level checks (Consortium and Data Sharing)
DetectManual Review QueuesReviewer verification for high-risk items, including contacting the paying bank or drawer
RespondWithdrawal and Payout ControlsBlocks instant exit of uncollected funds
RespondBSA-AML and SAR FilingSARs with FinCEN's key term for mail-theft-related check fraud
RespondCustomer Education and Scam WarningsWarns depositors about fake check scams before they send money back

Emerging variants and adversary adaptation

  • Industrialized mail theft. FinCEN's 2023 alert described organized theft from collection boxes and residential mailboxes, washed and counterfeit checks, and quick withdrawal through ATMs or wires (FinCEN Alert).
  • Channel preference. Fraudsters favor deposit channels without human contact (FinCEN FTA). As RDC controls tighten at one institution, deposits migrate to institutions with looser mobile deposit eligibility, so new-account risk management at onboarding is part of check fraud defense.
  • Social media as recruitment. Viral "glitch" trends recruit genuine customers to deposit bad checks, turning first-party fraud into a crowd phenomenon; see Case Study - Chase Infinite Money Glitch (2024).
  • Faster exits. Instant P2P and real-time payments mean uncollected funds can become irrevocable within minutes of availability. See Real-Time Payment Rail Fraud.
  • Weakening image signals. Better counterfeiting and editing tools make item-level visual checks less reliable on their own. The compensating controls are consortium item data, account-level behavior, and exposure caps that don't depend on spotting the fake.

Real-world examples

Sources and further reading