Under the Uniform Commercial Code, how long you have to report a forged check depends on which deadline binds you first. The outer wall is one year from the date your bank statement was made available; miss that, and your claim is permanently barred no matter how sympathetic the circumstances. Inside that year, a 30-day rule can make you liable for any additional forgeries by the same person once the first one shows up on a statement you ignored. And your deposit agreement likely sets a tighter window still, often 14 to 30 days, that controls in practice. Criminal reporting to police runs on an entirely separate clock measured in years, not days.
The One-Year Absolute Cutoff
UCC 4-406 sets a final, non-negotiable deadline: you have one year from the date your bank statement is made available to discover and report an unauthorized signature or alteration. After that, your claim against the bank is gone. No exceptions, no extensions, and this applies even if the bank was itself negligent in paying the check.1Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
The clock starts when the statement is available to you, not when you actually look at it. Online banking has made that date earlier for most customers: if your statement posts to your portal on the first of the month, your year begins running then, whether or not you log in.
The 30-Day Repeater Rule
This is where most people get hurt. If someone forges one of your checks and you fail to report it within 30 days after the bank statement becomes available, you become liable for any additional forgeries by the same person that the bank pays before you finally notify it.1Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration The bank paid the first forged check in good faith. Once it handed you a statement showing that payment, you had notice. If you sat on it for more than 30 days and the same forger kept cashing checks during your silence, those later losses are yours.
The rule matters most in embezzlement situations, where an employee or bookkeeper writes unauthorized checks over a period of months. Catching the first one early caps your exposure. Letting it slide puts every subsequent forged check from that same person on your shoulders.
Reasonable Promptness
Separate from the 30-day repeater rule, the UCC requires you to review your statements and report problems with “reasonable promptness.” The code does not define that in days. It depends on how often you receive statements, whether you use online banking, and how obvious the forgery was. If the bank can show that your delay caused it a financial loss it could have avoided, you lose the right to recover that amount.1Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
Your Deposit Agreement Probably Shortens These Deadlines
Here is the catch most customers do not see coming. The UCC lets banks modify these timeframes by contract, and the deposit agreement you signed when you opened the account almost certainly does. Many banks require customers to report discrepancies within 14 to 30 days of receiving a statement. If your agreement says 30 days and you report on day 45, the bank can deny your claim even though the one-year UCC deadline has not passed. The one limit on this: the bank cannot use the agreement to disclaim responsibility for its own lack of good faith or failure to exercise ordinary care.
Pull your deposit agreement and check the section on statement review, unauthorized transactions, or dispute resolution. If you no longer have a copy, request one from your bank or find it in your online banking portal. Your contractual deadline matters as much as the UCC deadline, and in most cases it is the one that actually controls.
Reporting the Forgery to Police Is a Separate Clock
A police report serves a different purpose than reporting to your bank. It enables criminal prosecution of the forger; it does not directly recover your funds. The deadline is set by the applicable statute of limitations.
For felony-level forgery, most states set statutes of limitations in the range of three to seven years. Federal crimes follow a separate timeline, with a general five-year limit from the date the offense was committed.2Office of the Law Revision Counsel. 18 U.S. Code 3282 – Offenses Not Capital When the fraud affects a financial institution, that window extends to ten years, which covers bank fraud under 18 U.S.C. ยง 1344.3Office of the Law Revision Counsel. 18 USC 3293 – Financial Institution Offenses
Years of theoretical time does not mean waiting is smart. Evidence gets stale, witnesses forget, and surveillance footage gets overwritten. A police report filed the same week you discover the forgery also strengthens your bank claim, because it shows you treated the situation seriously and acted quickly.
What to Do the Moment You Spot a Forged Check
Call your bank’s fraud department first to get the investigation started, then follow up in writing. The bank will ask you to complete an affidavit of forgery, a sworn statement declaring that you did not authorize the check. It will ask for your account number, the check number, the dollar amount, the date the check was paid, and the payee name. Request a copy of the front and back of the forged check if you do not already have one.4Consumer Financial Protection Bureau. I Wrote a Check, but It Was Stolen and Cashed by the Thief. What Can I Do?
Many banks will issue provisional credit while they investigate. If multiple checks were forged or your checkbook was stolen, ask about closing the compromised account and opening a new one.5Office of the Comptroller of the Currency (OCC). Check Fraud
Then file a report with your local police department. Bring the affidavit, copies of the forged check, and your bank statements showing the unauthorized transaction. Give the resulting case number to your bank; it supports your fraud claim.5Office of the Comptroller of the Currency (OCC). Check Fraud
If the Bank Denies Your Claim
Banks do deny forgery claims, sometimes citing late reporting, sometimes citing customer negligence, and sometimes with no clear explanation. Start by requesting the denial in writing with a specific explanation. If the bank points to your deposit agreement, compare the agreement’s language with what actually happened. Even a bank that invokes a shortened reporting period cannot disclaim liability for its own failure to exercise ordinary care.
If direct resolution fails, you can file a complaint with the Consumer Financial Protection Bureau. Describe the problem with key dates and amounts, attach supporting documents (up to 50 pages), and identify the company. The CFPB forwards the complaint to the bank, which generally responds within 15 days. More complex cases can take up to 60 days for a final response. You then have 60 days to provide feedback.6Consumer Financial Protection Bureau. Submit a Complaint
The CFPB does not order banks to pay you, but companies take complaints seriously because they enter a public database and can draw regulatory scrutiny. For larger amounts, small claims court or civil litigation remain available, depending on the dollar figure and your jurisdiction.
When Your Own Conduct Reduces What You Can Recover
Reporting on time is not the only factor. Under UCC 3-406, if your failure to exercise ordinary care substantially contributed to the forgery, you cannot assert it against someone who paid the check in good faith. Leaving a book of signed blank checks on an accessible desk is the classic example.7Legal Information Institute. UCC 3-406 – Negligence Contributing to Forged Signature or Alteration of Instrument
The flip side is comparative fault under UCC 4-406(e). If the bank was also negligent in paying the item, the loss is split between you and the bank based on how much each party’s carelessness contributed. Even if you reported late, you may still recover a portion if the bank missed red flags such as a dramatically different signature or an unusual payee. And if the bank did not pay the check in good faith at all, the preclusion rules do not apply and the bank bears the full loss regardless of your reporting delay.1Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
The practical takeaway on timing is simple. Treat the deadline in your deposit agreement as the real one, use the 30 days after a statement posts as your working deadline for any single forgery, and never let a year pass with an unexamined statement.