The journey of a stolen check: exposing the ecosystem and bad actors

In the digital era, when the vast majority of transactions are conducted electronically, it is perhaps surprising that paper checks remain the most popular business-to-business payment method.

While check use in the general population continues to wane, 80% of U.S. businesses steadily make at least some of their payments by check, finding that they align with their financial needs, preferences and workflows. This has led to vulnerability and a recent spike in check fraud.

Check theft isn't a new crime. Banks have been fighting check fraud for as long as checks have existed. In fact, in 1526, the city of Venice, Italy, banned checks outright because fraud was so rampant. With their lengthy process times and the relative ease with which they can be stolen, counterfeited and forged, checks have always been an attractive target for criminals.

However, the amount of money being lost to check fraud is today at historic highs. In 2022, banks saw a staggering 84% increase in check fraud according to the Financial Crimes Enforcement Network (FinCEN), a specialist unit of the US Treasury Department.

The American Bankers Association has also raised the alarm, noting a steep rise in check fraud losses. In 2018 (the last year for which figures are available), losses totaled more than $1.3 billion. That’s a jump of more than half a billion dollars on the $789 million lost to check fraud in 2016.

In this article, we’ll shed light on the story behind the startling statistics and news headlines and answer common questions: Who is perpetrating these crimes? How are they managing to evade detection? Why is fraud continuing to rise? And, importantly, where there are opportunities in the journey of a stolen check to prevent, disrupt and expose this growing fraud threat.

Download the new Journey of a stolen check infographic 

I. How checks are stolen

In February 2023, FinCEN issued an official alert about spiraling rates of check fraud.

“Despite the declining use of checks in the United States, criminals have been increasingly targeting the U.S. Mail since the COVID-19 pandemic to commit check fraud,” they wrote.

The U.S. mail system was named as the main area of concern.

In 2021, the U.S. Postal Inspection Service reported roughly 300,000 complaints of mail theft; an increase of 161% on the same period a year earlier.

The Covid-19 pandemic — and trillions of dollars in relief funds that were mailed out across the U.S. in the form of paper checks — proved to be a target that was too attractive for criminals to ignore. Perhaps as a result of those criminals looking for new sources of revenue when government stimulus payments were no longer an easy target, the problem has continued to grow since.

The FinCEN alert highlighted business payments as a particular source of concern: “Criminals will generally steal all types of checks in the U.S. Mail as part of a mail theft scheme, but business checks may be more valuable because business accounts are often well-funded and it may take longer for the victim to notice the fraud.”

It also details the way these thefts are executed.

“Mail theft can occur through forced entry or the use of makeshift fishing devices, and increasingly involves the use of authentic or counterfeit USPS [United States Postal Service] master keys, known as arrow keys.”

Arrow keys are used by the Postal Service to collect the contents of USPS mailboxes. Both arrow keys and stolen checks have been found for sale online for as much as $1,000 in what experts believe is yet another sign that check fraud is becoming big business.

“It’s completely out of control,” says Frank Albergo, president of the Postal Police Officers Association. Postal services robberies only occurred 80 times in 2018, but now are almost a daily event, with letter carriers being robbed 717 times in fiscal 2022 and the first half of fiscal 2023, according to the USPS Postal Inspection Service.  

In 95% of those cases, the criminals were looking for the arrow key, says Albergo.

Paul Benda, senior vice president of operational risk and cybersecurity at the American Bankers Association, has recently commented that “the mail system isn’t as secure as everyone thought it was,” adding that an audit report in 2020 found that Postal Service management controls over arrow keys were “ineffective,” increasing the risk that lost or stolen keys are not detected before they are used.

There have also been reported cases of postal employees being recruited by organized criminals to steal checks at sorting and distribution centers. In other instances, postal carriers have been robbed at gunpoint for their keys.

II. The ecosystem of a stolen check

The Evidence-Based Cybersecurity Research Group at Georgia State University, calls the modern check fraud ecosystem “an elaborate supply chain”.

Whereas stealing checks was once a small-scale operation – criminals pilfering a check or two from residential mailboxes – a whole new group of perpetrators have moved in on the scene. Check fraud, he says, now resembles a much larger-scale enterprise, often with the involvement of organized crime.

1. The Initial Perpetrator

Motivations and profiles of check thieves

The overwhelming motivation for each person in the check fraud supply chain is financial. Check fraud is big business.

According to the FBI, 70% of U.S. organizations reported instances of check fraud during 2021, resulting in losses totaling more than $18 billion.  And this upward trend shows no sign of slowing, with check fraud losses predicted to hit the $24 billion mark by the end of 2023.

It was reported in early 2022 that the prices being paid for stolen checks were typically $175 for personal checks and $250 for business ones with transactions usually made in Bitcoin. When checks are being stolen in such large numbers, it’s easy to see how the numbers can quickly add up.

For the initial perpetrator – the check thief – there is an almost guaranteed market for their stolen goods. In what many see as a key contributor to the record high rates of check fraud, there are easy ways of connecting to that market thanks to the proliferation of online platforms and encrypted messaging apps.

Techniques for obtaining personal information

For a stolen check to be successfully cashed, criminals require more than just the check itself: they may also need to obtain information about the recipient.

While techniques required for obtaining a check are more traditional – stealing items from mailboxes, offices, homes, purses or apartment building mailrooms – the techniques required to obtain personally identifiable information (PII) are usually more sophisticated.

The modern thief may need to know how to: skim devices on ATMs or point-of-sale terminals; operate phishing or social engineering scams, or; hack into financial institutions and databases.

2. The Broker

Once a thief has stolen checks and personal information in their possession, they will most likely sell them on to a broker – someone who acts as a middleperson and establishes a check trafficking network. With the help of encrypted messaging channels, the broker can connect with a forger who will be looking to acquire genuine, signed checks to ‘wash’.

3. The Forger 

The role of the forger is to alter or counterfeit the stolen checks. Using a technique known as ‘check washing’, a forger will use easy-to-purchase chemicals, such as nail polish remover, to undetectably erase the original check amount and the intended payee’s name. With this information removed, the forger is then free to rewrite the check for a new sum – hundreds or thousands of dollars higher than the original amount – to whichever new payee name they choose.  

Check forgers also use stolen checks to create templates that facilitate their fraudulent activities. After obtaining a genuine check through illicit means, they meticulously scan or photograph it, capturing all its unique elements, such as the bank's logo, account numbers, and signatures. Armed with this digital copy, they employ sophisticated graphic design software to meticulously recreate the check's layout and appearance. By altering the necessary fields, like the payee's name and the payment amount, they effectively create a seemingly legitimate template. Once the template is perfected, the forger can print multiple copies and utilize them in a multitude of fraud attempts; or sell this template online to other fraudsters. This sinister approach enables them to exploit the stolen check's information numerous times.

4. The Money Mule (Launderer)

The role of the money mule, or launderer, is to cash or deposit the forged check. Sometimes known as ‘walkers’, these are the people who actually walk into a bank and present the stolen check, impersonating genuine bank customers.

Money mules are chosen for their ability to seem ‘ordinary’ and ‘unsuspecting’ and will sometimes receive training on how to portray themselves as legitimate customers.

Some money mules are paid to receive stolen checks into their own bank accounts. They are then forced to withdraw or transfer the money back to the criminal gang behind the scam. Other times, walkers will be given fake identity documents which they use to set up a bank account into which the check can be paid – preventing law enforcement officials from tracing the account back to a real person

Again, it is online messaging apps and platforms that usually facilitate the recruitment of money mules. The messaging app, Telegram, in particular, has been identified as a fertile recruitment ground for organized crime groups looking for those willing to put themselves at risk of arrest if caught red-handed with a forged check.

According to Paul Benda, the elderly and homeless are often recruited as walkers because they are vulnerable, more likely to agree to take part in the crime for a low payout and – in the case of the elderly – are less likely to have their credibility questioned by the bank teller.

Brokers often accompany groups of walkers to the bank, having matched their age, race and gender to the names on the checks they are cashing. It’s even been known for brokers to buy clothes for walkers, or take them to the hair salon, to ensure they ‘look the part’.

Where additional verification is required, walkers will be given fake identification and documents that match the business or individual’s name they are presenting.

III. The fate of the stolen check data and images