What Is Check Fraud and How Is It Investigated?

Check fraud is any scheme that uses a fake, altered, or stolen check to take money from a person or a financial institution. The primary federal statute treats it as a felony punishable by up to 30 years in prison and a $1 million fine, and banks reported more than $688 million in suspicious check-fraud activity tied to mail theft alone during a single six-month period in 2023.¹ Paper checks are a shrinking share of payments, but the schemes around them keep evolving, and so do the investigation tools.

Under 18 U.S.C. § 1344, a person commits bank fraud by knowingly carrying out a scheme to defraud a financial institution or to obtain its money through false pretenses.² “Knowingly” is the operative word. Prosecutors must prove intent to deceive, not just that a check bounced. A separate statute, 18 U.S.C. § 514, targets anyone who produces or passes a counterfeit check or other fictitious financial document with intent to defraud.³ When mail is involved, 18 U.S.C. § 1708 adds a mail-theft charge carrying up to five years on its own.⁴ Federal prosecutors routinely stack these charges, so a single scheme can produce multiple sentences running back to back.

Common Methods of Check Fraud

Forgery

Forgery is signing another person’s name on a check to drain their account. It usually starts with a stolen checkbook or a single check pulled from a mailbox. The forger mimics the account holder’s signature and cashes or deposits the check before the victim notices anything is wrong.

Check Washing and Mail Theft

Check washing begins with stealing a signed check, often from a residential mailbox or a USPS blue collection box. Criminals use tools tipped with adhesive to fish envelopes out of mail slots, and some open collection boxes with stolen or counterfeit USPS master keys known as Arrow Keys.⁵ Once they have the check, common chemicals like acetone dissolve the original ink, and they write in a new payee name and a higher amount. The technique works on standard ballpoint ink but struggles with gel ink, which soaks into paper fibers and resists chemical removal.

Check Kiting

Kiting exploits the float, the gap between when a check is deposited and when the issuing bank actually moves the money. A kiter writes checks back and forth between accounts at different banks, inflating balances that don’t really exist. The scheme collapses once a bank in the chain catches the circular transfers or one account runs dry. Kiting tends to escalate fast because each round requires larger checks to cover the growing shortfall.

Counterfeiting

Counterfeit checks are manufactured from scratch using high-quality printers and design software to replicate security features like watermarks and microprinting. The counterfeiter usually pairs the fake stock with real routing and account numbers stolen from someone else’s check or bank statement. Producing or passing a counterfeit financial instrument is a Class B felony carrying up to 25 years in prison, and the U.S. Secret Service has explicit authority to investigate.³

Money Mule Recruitment

Many check fraud rings need someone to deposit or cash the fraudulent checks, so they recruit money mules who move stolen funds through their own accounts in exchange for a cut. The FBI warns that mules are often recruited through social media, fake job postings, and online romance scams.⁶ A typical pitch is a work-from-home role where you receive deposits and forward the money by wire transfer or money order. If someone you’ve never met asks you to process payments through your personal account, that is almost certainly a mule operation. Participating can result in federal charges even if you didn’t fully understand what was happening.

How Banks Spot Suspicious Checks

Banks run checks through automated systems that flag anomalies: out-of-sequence check numbers, sudden large withdrawals, transactions outside an account’s normal pattern. Flagged items go to a fraud analyst, who compares the signature on the check against the one on file. If the check looks fraudulent, the bank holds it, preserves surveillance footage from the branch or ATM, and builds an internal file with timestamps, teller notes, and account history. The bank may also verify funds with the issuing institution before releasing money.

Federal regulation requires every bank to file a Suspicious Activity Report with the Treasury Department’s Financial Crimes Enforcement Network for any transaction of $5,000 or more when the bank suspects illegal activity.⁷ For transactions of $25,000 or more, the bank must file regardless of whether it has identified a suspect.⁸ These reports feed a national database that law enforcement uses to identify patterns and track repeat offenders across institutions. Many multi-state rings are caught that way.

Many banks also offer businesses a prevention tool called Positive Pay. The account holder uploads a list of every check issued, and the bank cross-references that list against every check presented for payment. Anything that doesn’t match is flagged as an exception and won’t be paid without approval. Some banks offer an enhanced version, Payee Positive Pay, that also verifies the payee name. For organizations that write high check volumes, it is the single most effective defense against forged and altered checks clearing an account.

How Law Enforcement Investigates Check Fraud

Once a bank’s internal review confirms fraud, the evidence package (surveillance images, transaction records, the physical check) goes to law enforcement. A detective opens a formal case and can seek administrative subpoenas under the Right to Financial Privacy Act to obtain account records the bank didn’t initially release.⁹ The government must show the records are relevant to a legitimate law enforcement inquiry.¹⁰

The physical check itself often yields the strongest evidence. Forensic document examiners analyze handwriting characteristics, ink composition, and signs of chemical alteration to determine whether a check is genuine, forged, or washed. They look for tremor in traced signatures, pen lifts where a natural writer wouldn’t pause, and ink inconsistencies that reveal a document was modified after it was originally signed. For mobile deposit fraud, investigators track IP addresses and device identifiers, working with internet service providers to tie a transaction to a specific location or person.

Local police handle straightforward cases. When a scheme crosses state lines or involves substantial losses, federal agencies step in. The U.S. Secret Service has explicit statutory authority over counterfeit financial instruments, and the FBI handles large-scale bank fraud and money mule networks.³ Joint task forces let local and federal investigators share intelligence on known rings and build stronger cases than either level could manage alone.

Criminal Penalties

Federal bank fraud under 18 U.S.C. § 1344 is always a felony. A conviction carries up to 30 years in prison, a fine of up to $1 million, or both, and judges routinely order full restitution to the victims or the defrauded bank.² A mail-theft conviction under 18 U.S.C. § 1708 adds up to five more years.⁴ Producing counterfeit checks under 18 U.S.C. § 514 is a Class B felony carrying up to 25 years.³ These charges stack, so a single scheme involving mail theft and counterfeiting can produce decades of combined exposure.

Every state also has its own laws on bad checks, forgery, and related offenses. Penalties generally scale with the dollar amount: passing a bad check for a small sum is often a misdemeanor carrying up to a year in jail, while larger amounts trigger felony charges with multi-year prison terms. Most states allow victims to pursue civil damages, typically the face value of the check plus a statutory penalty that varies by jurisdiction. State charges can be filed alongside federal charges for the same conduct.

What to Do If You’re a Victim

Speed matters. The longer you wait, the harder recovery becomes and the more exposure you have to repeat fraud from the same person. Work through these steps in order:

Contact your bank immediately. Report the fraudulent check and ask about closing the compromised account and opening a new one. Fraudsters often make multiple copies of a washed check or resell stolen account information.¹¹
File a police report. Law enforcement needs it to open an investigation, and you’ll need the report number for your bank’s fraud claim process.
Report identity theft to the FTC at IdentityTheft.gov. That generates an official FTC Identity Theft Report and a personalized recovery plan, and the report goes into a database law enforcement uses nationwide.¹²
Place a fraud alert or credit freeze with Experian, TransUnion, and Equifax. A fraud alert tells creditors to verify your identity before opening new accounts; a freeze blocks new credit inquiries entirely.¹¹
Complete your bank’s affidavit of forgery. Most banks require a sworn statement, and some require notarization, before they will investigate the claim and potentially restore funds.

Also review your statements on time. Under the Uniform Commercial Code, if you don’t report an unauthorized check within one year of receiving the statement that shows it, you lose the right to dispute it entirely.¹³

How to Protect Yourself

Prevention is cheaper than recovery. A handful of habits sharply reduce exposure:

Use gel-ink pens when writing checks. Gel ink soaks into paper fibers and resists the chemical washing that dissolves standard ballpoint ink.
Mail checks from inside a post office. Don’t leave outgoing checks in an unlocked residential mailbox, and avoid blue collection boxes after the last posted pickup time. The window between the final pickup and the next morning is when thieves are most active.
Sign up for USPS Informed Delivery. The free service emails you a grayscale image of every letter-sized mailpiece heading to your address, so you’ll notice if an expected check never arrives or if mail you didn’t expect is being sent in your name.¹⁴
Review your bank statements every month. The UCC’s reporting deadlines are unforgiving, and most people who lose disputes simply didn’t look at their statements in time.¹³
Shred old checks and bank statements. Counterfeiters only need your routing and account numbers to produce convincing fakes.
Ask your bank about Positive Pay if you run a business. It remains the most effective tool for catching forged or altered checks before your account is debited.

1
Financial Crimes Enforcement Network. FinCEN Issues In-Depth Analysis of Check Fraud Related to Mail Theft
2
Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud
3
Office of the Law Revision Counsel. 18 USC 514 – Fictitious Obligations
4
Office of the Law Revision Counsel. 18 USC 1708 – Theft or Receipt of Stolen Mail Matter Generally
5
Financial Crimes Enforcement Network. FinCEN Alert on Nationwide Surge in Mail Theft-Related Check Fraud Schemes
6
Federal Bureau of Investigation. Money Mules
7
eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
8
Financial Crimes Enforcement Network. FinCEN SAR Electronic Filing Instructions
9
United States Department of Justice. Criminal Resource Manual 472 – 12 USC 3405 Administrative Subpoena and Summons
10
United States Department of Justice. Criminal Resource Manual 430 – Exceptions Permitting Disclosures by Financial Institutions
11
Office of the Comptroller of the Currency. What Should I Do If Im the Victim of Check Fraud
12
Federal Trade Commission. IdentityTheft.gov
13
Legal Information Institute. UCC 4-406 – Customers Duty to Discover and Report Unauthorized Signature or Alteration
14
United States Postal Service. Informed Delivery – Mail and Package Notifications