Preventing mobile deposit fraud comes down to three things: spotting the scam before you tap “deposit,” locking down the transaction itself, and knowing which federal deadlines apply if a bad check or unauthorized transfer slips through. Banks are required to make deposited funds available quickly, but a counterfeit or altered check can take weeks to be discovered. Once it is, the full amount gets pulled back from your account and you are on the hook for anything you already spent or forwarded.
The Scam Patterns Worth Recognizing
Almost every mobile deposit scam is a version of one of four setups.
Fake check and overpayment. Someone sends you a check, asks you to deposit it, keep a portion, and wire, gift-card, or app-transfer the rest back. The check looks real, the funds show up in a day or two, and the check bounces days or weeks later. When it does, the bank claws back the entire deposit. The FTC has been blunt about this: seeing the funds in your account does not mean the check is good.
Employment scams. A remote “employer” sends a check for equipment or supplies and tells you to forward most of it to a vendor. The FTC’s guidance is direct here too: a legitimate employer will never ask you to deposit a check and send part of it to someone else, and any job promising thousands of dollars for minimal effort is almost certainly a fake check setup.
Double-dipping. A person deposits a check through a mobile app and then cashes the same physical check at a retail check-cashing store or another bank, exploiting the gap between mobile approval and full clearance. If you are the account holder whose deposit is disputed, you can face freezes or reversals while the banks sort it out.
Check washing. Thieves steal mail containing checks, use chemicals to dissolve the payee name and amount while preserving the signature, then rewrite the check to themselves for a larger sum and deposit it by phone. This is the one scam pattern that targets checks you wrote, not checks you received.
One boundary worth stating: if you unknowingly deposit a fraudulent check in good faith, you are not going to be criminally prosecuted. Federal bank fraud penalties under 18 U.S.C. ยง 1344 apply to the people running the scheme. You will, however, owe the bank the money.
Red Flags Before You Deposit
The signs repeat across nearly every scam. If any of these fit, stop.
- Someone you don’t know well asks you to deposit a check on their behalf. There is no legitimate reason a stranger needs your account to process their check.
- You are told to send money back after depositing. This is the defining feature of fake check scams.
- The check amount is larger than what you were owed. “Overpayment” is the classic pitch: someone pays $3,000 for a $500 item and asks you to wire back the difference.
- You are being pushed to act quickly. Urgency exists because the scammer needs your money to move before the check bounces.
- The job or opportunity sounds too generous for the effort. Offers to “process payments” or “evaluate services” for high pay are almost always check fraud.
Inspecting the Check Itself
Before you photograph any check, spend thirty seconds looking at it. Commercially printed checks carry security features that counterfeits usually lack. Microprinting looks like a thin line to the naked eye but becomes readable text under magnification. Hold the check up to a light and look for a watermark. Check the MICR line along the bottom for consistent font and alignment; counterfeits printed on home inkjet printers tend to have uneven MICR characters and lack the slight magnetic sheen of genuine check stock.
Then endorse the check the way your bank tells you to. Almost every mobile deposit requires a restrictive endorsement: write “for mobile deposit only” below your signature on the back, and add your account number if the app instructs. This is not paperwork for its own sake. Under Regulation CC, a bank that accepts an original check bearing a restrictive endorsement inconsistent with its means of deposit can lose its ability to make an indemnity claim, so your bank has a real financial stake in the endorsement, and skipping it can trigger a rejected deposit or leave the check exposed to being cashed a second time in person.
Securing the Transaction
The check image is sensitive financial data on the move from your phone to the bank. A few habits reduce your exposure.
Use cellular data or a trusted home Wi-Fi network. Public Wi-Fi at coffee shops, airports, and hotels is inherently insecure because anyone on the same network can potentially intercept traffic. Banks encrypt check images with AES 256-bit encryption in transit, but a compromised network introduces avoidable risk even with that protection in place.
Turn on multi-factor authentication in your banking app. A password alone is not enough. Most banks now support a text code, an authenticator app, or biometric login through fingerprint or facial recognition. Biometrics tie account access to your physical identity rather than to a credential that can leak in a data breach.
Keep your phone’s operating system current. Security patches close the vulnerabilities that malware uses to capture screen data or intercept app communications, and banking apps are high-value targets.
What to Do With the Paper Check Afterward
Once a mobile deposit is accepted, the physical check becomes a liability. It can still be presented at a teller window or check-cashing store, and if that happens, your account absorbs the consequences.
Store the check in a locked drawer or safe until the deposit has clearly cleared. There is no single federal rule on retention. Bank policies vary, with some recommending 14 days and others 30 or longer; two to four weeks is a reasonable baseline, but follow your bank’s specific guidance. Do not mark the check “void” until the bank confirms the transaction is final, because a voided check that has not cleared can complicate a dispute if the original is needed.
After the retention period, destroy the check thoroughly. Cross-cut shredding reduces the document to small fragments rather than the long strips a strip-cut shredder produces, which can be reassembled. The check carries your account number, routing number, and signature, all of which are valuable to anyone digging through trash.
Protecting the Checks You Write
Check washing is preventable with a couple of habits. Use gel pens with black ink; gel ink pigments soak into the paper fibers and resist the solvents thieves use to erase writing, while standard ballpoint ink sits on the surface and washes off.
Do not leave outgoing mail containing checks in a residential mailbox with the flag raised. That flag signals the mail carrier and thieves equally well. Drop checks at the post office, hand them to a carrier directly, or use a secured collection box. If you are going away, place a hold on your mail rather than letting it accumulate.
If You Think You’ve Been Scammed
Speed matters, both because scammers move money fast and because your legal protections are tied to how quickly you report.
Call your bank’s fraud department first. Use the number on the back of your debit card or on the bank’s official website, not any number the suspected scammer gave you. Ask the bank to freeze the affected account and flag the deposit for investigation. Write down the representative’s name, the date and time, and any case number.
Report to the FTC. For identity theft tied to check fraud, use IdentityTheft.gov, which produces a personalized recovery plan and an Identity Theft Affidavit you will need later. For scams and fraud more generally, use ReportFraud.ftc.gov.
File a police report. Bring a government-issued photo ID and your FTC Identity Theft Affidavit to local law enforcement. Banks, creditors, and collection agencies often require an official report before they will investigate or reverse charges.
Place a fraud alert or freeze with ChexSystems. ChexSystems is the specialty consumer reporting agency banks use to screen new account applications. If someone has your banking information, they may try to open accounts in your name. Request a security freeze by calling 800-428-9623 or through chexsystems.com.
Read your statements line by line. Fraud rarely stops at one transaction. Watch for small test charges, unfamiliar transfers, and new payees. Report anything suspicious right away, because your liability window under federal law runs from the date the statement is sent, not the date you open it.
Keep copies of everything: bank correspondence, FTC and police reports, and your own notes. If the dispute drags on, that paper trail decides whether you recover the money.
The Federal Deadlines That Decide Your Recovery
Two federal frameworks do most of the work for consumers, and both are timing-driven.
Regulation E, for unauthorized electronic transfers. If someone gains access to your account, through a stolen phone or compromised login, and moves money, your maximum liability is $50 if you notify the bank within two business days of discovering the unauthorized activity. Wait longer than two business days and it can rise to $500. Fail to report unauthorized transfers within 60 days after the bank sends your periodic statement and you are liable for the full amount of any unauthorized transfers occurring after that 60-day window. The bank must investigate within 10 business days and either resolve the claim or provisionally credit your account while it continues to investigate for up to 45 days.
Check 21 expedited recredit, for improper substitute-check charges. The Check Clearing for the 21st Century Act gives digital check images and substitute checks the same legal weight as paper originals, and it created a consumer recredit right. If your account was charged based on a substitute check and you believe it was improper, you can submit a recredit claim within 40 days of receiving your statement. The bank must provisionally recredit up to $2,500 within 10 business days while investigating, and must resolve the remainder within 45 calendar days.
Regulation CC, for the double-dipping scenario. When a check has been paid twice, Regulation CC requires the bank that accepted the electronic image to indemnify other banks that took the original. You will not run that claim yourself, but it is the reason your bank has an interest in enforcing restrictive endorsements and the reason interbank disputes eventually resolve, even if your account sees a freeze in the meantime.
The through-line across all three: the clock starts when the bank sends the statement or when you discover the problem, not when it is convenient to deal with it. Open the app, read the statements, and pick up the phone the same day something looks wrong.