What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Mail-theft check fraud usually follows a repeatable sequence: a check is stolen, its payment instructions or image are altered or copied, and the resulting instrument is deposited through an account or channel that may keep the criminal away from bank staff. Official reporting does not establish one nationwide “ring” or one universal detection system. It does show a broader U.S. pattern reflected in thousands of suspicious-activity reports cited by banks, FinCEN, the FBI and the U.S. Postal Inspection Service.
Understanding that workflow explains both the risks and the practical defenses. The most important actions are to reduce checks sent through the mail, secure outgoing and incoming mail, monitor paid-check images and account activity, and notify the bank and investigators quickly when a check is missing or altered.
As an Amazon Associate I earn from qualifying purchases.
What the documented check-fraud playbook looks like
FinCEN defines mail-theft-related check fraud as the fraudulent negotiation of checks stolen from U.S. mail. The official material describes a recurring workflow rather than a single prosecution with identified members, dates and locations. A stolen personal, business, tax-refund or government-benefit check can be used in several different ways, and one theft can lead to more than one attempt.
1. Stealing the check or its information
Criminals first obtain an outgoing or incoming check from the mail. They may also capture the information printed on it. The envelope can contain account numbers, addresses, signatures or other personal data that later supports identity theft or unrelated fraud. A missing check is therefore both a payment problem and a possible information-exposure event.
#1 Best Overall
2. Changing, copying or re-signing the instrument
The stolen item can be altered physically, reproduced from an image, or deposited with a fraudulent signature. FinCEN and the FBI describe four common uses:
- Changing the payee or dollar amount on the original check.
- Using the original as a template for counterfeit checks.
- Signing and depositing the original without authorization.
- Selling the check or identifying information to other criminal actors through online channels.
These paths can overlap. An image may be manipulated to produce several counterfeits, while the original paper check is sold or deposited separately.
3. Finding an account and a deposit channel
The FBI reports that stolen checks may be deposited by collusive or recruited account holders, sometimes called money mules, or sold to another actor who makes the deposit. FinCEN’s review found many reported attempts involving remote deposit capture, ATMs or accounts opened online. Those channels can reduce face-to-face contact, but the finding is not a claim that every remote or automated deposit bypasses bank controls.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →4. Trying to withdraw funds before discovery
Funds-availability rules require institutions to make some deposited funds available within specified timeframes. The FBI says that can leave a short window in which a fraudulent check appears spendable before the item is returned or investigated. Discovery may occur after the depositor has withdrawn or transferred the money. The timing varies by account, check and institution; funds availability is one factor, not a complete explanation for every loss.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
Check washing, check cooking and counterfeiting are different
People often use “check washing” as a catch-all term, but official guidance distinguishes several techniques.
| Technique | What is changed | Typical result |
|---|---|---|
| Physical check washing | Chemicals remove or obscure printed information on the paper check. | The criminal commonly rewrites the payee or amount and presents the altered original. |
| Digital check cooking | A stolen check image is edited electronically. | One image can be used to create multiple counterfeit checks or altered payment images. |
| Copying or scanning | The paper check or its image is reproduced. | A counterfeit instrument is made from the stolen item’s layout and account details. |
| Fraudulent signing | The original check is signed or endorsed without the account holder’s authority. | The unchanged paper item is deposited as though the signature were legitimate. |
The categories describe methods, not mutually exclusive crime types. A report can involve more than one method, and not every stolen check is washed.
What FinCEN’s numbers reveal—and what they do not
FinCEN issued a check-fraud alert on February 27, 2023, giving financial institutions red flags and a reporting keyword. It then reviewed Bank Secrecy Act reports filed during the following six months. That reporting system is how investigators and banks saw recurring methods and locations across institutions; it is not evidence of one bank’s proprietary software or one decisive detection event.
| Measure | Reported figure | How to interpret it |
|---|---|---|
| Mail-theft-related check-fraud reports | 15,417 reports associated with more than $688 million in transactions, filed February 27–August 31, 2023. | The associated amount can include attempted transactions and other reporting limitations. It is not a confirmed national loss total. |
| Methods identified in manual review | Approximately 44% altered checks, 26% counterfeit checks and 20% fraudulently signed checks. | These are shares of identified methods in reviewed reports, not mutually exclusive percentages of every U.S. incident. A report could describe multiple deposits or methods. |
| Institution filing reports | Banks filed 88% of the mail-theft-related reports in that review period. | This is the composition of reports reviewed. It does not mean banks prevented 88% of fraud. |
| All check-fraud SARs | More than 350,000 in 2021 and more than 680,000 in 2022. | These FinCEN figures cover check fraud broadly, not specifically checks stolen from mail. |
Those qualifications matter. Suspicious-activity reports are leads and reporting records, not adjudicated cases. They can include attempted transactions, duplicate activity and allegations that have not resulted in a conviction. The figures are useful for showing scale and recurring techniques, but they should not be presented as a precise tally of victim losses.
How banks and agencies recognized the pattern
Reporting turned scattered incidents into a national picture
Individual institutions see particular deposits, accounts and returned checks. FinCEN’s alert gave them a common way to describe suspected mail-theft activity. Its published findings identified recurring behavior and geography in those reports. Publishing the findings allowed other institutions, consumers and law enforcement to recognize that apparently separate incidents shared a workflow.
Detection is layered, not a single “bank system”
The available official evidence does not identify one universal software product or one bank that caught every scheme. Detection can involve transaction monitoring, review of unusual account behavior, examination of endorsements and check images, holds or returns, employee judgment, and information shared with investigators. A remote deposit or online account may still generate alerts; an in-person transaction may still be missed. The channel changes the control points but does not determine the outcome by itself.
Cooperation expanded the response
The American Bankers Association and the U.S. Postal Inspection Service describe a joint effort covering public education, money-mule and collusive-account activity, law-enforcement coordination, and training for bank employees and postal workers. FinCEN Acting Director Himamauli Das said on February 27, 2023: “Their vigilance and timely reporting will help law enforcement identify illicit actors who steal mail with the goal of defrauding innocent American taxpayers and businesses.”
Free tools Windows power users keep installed
One-click scans. No signup required.
American Bankers Association President and CEO Rob Nichols described the partnership as an opportunity to educate the public about sending checks safely while using advances in payment technology. Chief Postal Inspector Gary Barksdale said that awareness and prevention strategies can reduce financial harm and make the crime harder to carry out. Their statements emphasize shared reporting and prevention rather than a claim that one institution solved the problem alone.
Rank #4
Why deposit channels matter
Each channel presents different opportunities for verification and different blind spots. The following comparison describes control points, not a ranking of which channel is safest.
| Channel or practice | What changes | Practical implication |
|---|---|---|
| In-person deposit | Staff may see the depositor and the physical item. | Face-to-face review can add a control, but it is not a guarantee; counterfeit or altered checks can still be presented. |
| ATM deposit | The machine accepts the item without a teller interaction. | Image capture and account monitoring remain possible, while immediate human questioning is reduced. |
| Remote deposit capture | An image is submitted through a mobile or business service. | It can be convenient and can support digital review, but reported schemes have used it to avoid direct contact. |
| Online account opening | The account relationship begins remotely. | Identity and risk checks occur digitally; investigators may connect accounts through shared details, devices or transaction patterns. |
| Business positive pay | The business sends the bank an expected-issue file or otherwise preauthorizes checks, where offered. | The bank can compare presented items with the business’s list. Availability and exact operation depend on the financial institution. |
None of these comparisons establishes that electronic payments are fraud-proof. Electronic bill pay, ACH and mobile payments remove some paper-mail risks but introduce their own account-takeover, authorization and phishing risks.
How to reduce the chance that your check becomes the next target
Secure outgoing mail
- Use an official post-office slot or hand the envelope to postal staff rather than leaving it in an unsecured outdoor box.
- Drop outgoing mail near the posted collection time, reducing the period it sits before pickup.
- Use an envelope that conceals the check’s contents. Concealment can reduce casual exposure but does not make a mailing theft-proof.
- Consider electronic bill pay, ACH or another electronic option when the recipient accepts it. Treat the change as risk reduction, not a guarantee against payment fraud.
Protect incoming mail
- Retrieve mail promptly and do not leave it in the mailbox overnight.
- If you travel, arrange for the mail to be held or collected by someone you trust.
- Contact the sender and your bank if an expected check does not arrive.
Make paper checks harder to alter
- Use indelible black ink; the FBI says it can make washing more difficult.
- Write the payee’s full name and the amount close to the printed boundaries so blank spaces are minimized.
- Do not add unnecessary personal details to the check.
- Use available security features on checks supplied by your institution, recognizing that features differ by check design and provider.
Monitor the account, not just the balance
Review transactions frequently and inspect paid-check images when your bank provides them. Check the front for changes to the payee or amount and the back for an endorsement that does not match the intended recipient. Monitoring is most useful when you know which checks you issued and approximately when they should clear.
What to do when a check is missing, altered or unauthorized
Speed matters because a fraudulent deposit may be followed by a withdrawal before the item is returned.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
- Call the bank or credit union immediately. Explain whether the check is missing, altered, forged or deposited without permission. Ask what stop-payment, account-protection or claim steps apply.
- Request copies of the fraudulent check. Images can show the altered payee or amount, signature, endorsement and deposit path. Preserve them with account statements and correspondence.
- Secure related information. If the stolen item exposed account or personal details, ask the institution whether the account number, online credentials or other controls should be changed.
- Report the crime through the FBI’s Internet Crime Complaint Center, when appropriate. Also contact local police and the U.S. Postal Inspection Service for mail-theft-related cases. The Postal Inspection Service lists 1-877-876-2455 for reporting.
- Notify other affected parties. A business payee, government office or tax authority may need to reissue a payment or watch for additional misuse.
Keep a timeline of when the check was mailed, when it was discovered missing, when the bank was contacted and what documents were supplied. Do not assume that recovering the original account balance resolves the possible identity or mail-theft exposure.
Specific advice for businesses
Businesses often issue many checks and may not notice a single altered item quickly. Separate duties for preparing, signing and reconciling checks; limit who can access blank check stock; and review cleared items on a schedule. Ask the financial institution whether check positive pay is available, what files or approvals it requires, and what deadlines apply to exceptions. Positive pay is a bank control, not a substitute for reconciliation and employee training.
Train staff to question requests to deposit a check for someone else. The Postal Inspection Service specifically highlights the scenario, “Have you ever been asked to deposit a check or money order on behalf of someone else?” A request to use a personal or business account for another party can indicate a recruited depositor or money-mule arrangement. Decline the transaction and report suspicious contact rather than forwarding funds.
Questions the evidence cannot answer
The public materials do not identify a single named ring, a complete roster of participants, or one bank’s internal detection sequence. They also do not establish that every altered check was washed, that every counterfeit came from one image, or that remote deposits caused the losses. Those details require a specific prosecution record or institution disclosure. What is established is the repeatable pattern: mail theft, alteration or reproduction, deposit through varied channels, rapid movement of funds, and detection improved by shared reporting.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
