- Key insight: The ring coached recruits to keep debit cards off Apple Pay and unlinked from Cash App because those actions "can cause alerts to [a] bank."
- Supporting data: The ring deposited about $50,000 a week in fraudulent checks and obtained roughly $10,000 of it before banks caught on, according to the plea agreement.
- Forward look: Court records show banks made the victim businesses whole where they caught an altered check, but they do not say who absorbed the losses on the checks nobody caught in time.
Overview bullets generated by AI with editorial review.
In a case that police uncovered by accident, 19 people have pleaded guilty to conspiracy to commit bank fraud by depositing fraudulent checks at Florida banks,
The network picked its targets by stealing checks out of industrial buildings, digging up bank account information and calling banks to obtain more of it. It also
The ring defrauded about 26 banks and more than 200 victims between July 2021 and November 2023, according to the U.S. Attorney's Office for the Middle District of Florida.
The victims whose checks the ring altered or copied included insurance companies, law firms, construction companies, auto shops, public school districts, colleges and state agencies.
One ring member, Tyler Jacob, 26, of Winter Haven, Florida, admitted to recruiting and coaching the people who deposited the checks.
Despite the coaching, banks caught the fraud again and again, usually within days. The ring made money anyway, thanks to federally mandated deposit availability schedules.
Court records trace the start of the investigation to June 2022, when Jacob fled a traffic stop in Winter Haven, Florida, and crashed. Deputies searched his car and found checks, ATM receipts, debit cards and ID cards belonging to other people.
The papers in Jacob's car included handwritten personal information belonging to residents of assisted living facilities who were "mentally incompetent, either by old age or mental defect," as well as dead people, according to his
Jacob had also been carrying 27 bank debit cards in other people's names. Investigators later found that fraudulent checks had been deposited into nearly all 27 of those accounts.
Where the ring got its intel
Jacob's plea agreement gives three sources for the ring's information about its victims.
The first was physical theft. Jacob "stole checks from industrial buildings," the agreement said. Neither the plea agreement nor the charging document says which buildings, how he got in or whether he was taking mail, outgoing payments or something else.
The second was an illicit website. Investigators searching Jacob's iPhone found he had visited Brian's Club, which his plea agreement describes as a website for buying and selling the financial and personally identifiable information, or PII, of victims of identity theft and fraud.
The third was phoning banks to obtain information. The charging documents in Jacob's case do not say whether that involved reaching an automated phone line or speaking with an employee, nor does it say what he asked for or what he got.
A spokesperson for the U.S. attorney's office did not respond to a request for details.
Whatever the channel, the Justice Department says it worked. Its Wednesday
The release does not say what those systems and databases were.
Once the ring had a check, it used check-writing software to alter the check or build a fictitious one, "changing the banks, businesses, and the check amounts," according to the Justice Department's press release.
The court records do not indicate which specific check-writing software the ring used.
The coaching
Jacob "recruited and enlisted a network of individuals to help him deposit those checks at various banks, instructing them on how to successfully deposit and withdraw funds and avoid detection by financial institutions," according to his plea agreement.
In April 2022, a recruit sent Jacob the details (including the username, password and PIN) of an account she had opened in her own name. Jacob then told her what not to do with the debit card on her account.
"Take card off Apple Pay, unlink cashapp, do not login, no buying anything. When doing any of those things can cause alerts to bank and that will freeze and put account in the negative," Jacob wrote, according to court records. "So don't do anything at all to card."
He was describing what he believed set off the alerts a bank's automated systems generate when an account starts behaving unlike its owner and telling her how to avoid them.
Timing mattered, too. Discussing a $28,800 check, someone in the operation wrote: "Yo it has to be pulled before the bank open or they might put hold back on it," according to a charging document.
The advice reads as fraudsters guarding the wrong door, according to Trace Fooshee, a strategic advisor in the fraud and anti-money-laundering practice at Datos Insights, a research firm.
Enrolling a card in Apple Pay or using Cash App may register at some banks as an indicator of first-party fraud, meaning a customer who defrauds their own bank, he told American Banker.
But, it's likely that such an indicator is "very weakly predictive of fraud," he said, and "there are many, many other risk indicators that are much more predictive" than the ones Jacob mentioned to recruits.
Fooshee, who reviewed the case at American Banker's request but had no role in it, said fraudsters tend to fear banks' defenses more than the defenses warrant.
"There is an alarming amount of awareness among the fraudsters about what controls financial institutions use," he said, "but that awareness is often based on flawed or incomplete (sometimes wildly inaccurate) information."
What the banks caught
The ring "deposited approximately $50,000 a week in fraudulent checks, approximately $10,000 of which they successfully obtained weekly prior to detection by financial institutions," according to Jacob's plea agreement.
In other words, for every $5 the ring deposited in fraudulent checks, it got out with $1 before the bank detected anything.
Prosecutors charged Jacob with 16 counts of bank fraud (one per deposit), spanning the period from October 2021 to May 2023. The charging document against him describes a bank catching and returning the check in seven of those 16 cases.
Banks that
A Regions spokesperson declined to discuss the investigation or the bank's "own, unique security protocols," and said "fraud prevention is a never-ending focus at Regions Bank and across the industry."
A Truist spokesperson declined to comment, saying the bank "wouldn't have anything to add or contribute, since this is an active law enforcement matter."
A TD Bank spokesperson also declined, citing "privacy and security considerations."
Spokespeople for JPMorganChase and PNC did not respond to requests for comment.
How the money got out anyway
The charging document in Jacob's case describes the ring getting cash out at least twice. It says he and his co-conspirators withdrew funds from a check deposited in May 2022 and that he pulled fraudulent money out of a credit union ATM in October 2023.
Those are the two the document walks through; Jacob's own estimate to investigators describes it happening far more often.
A next-day catch is still a loss if the cash left the ATM on day zero, and the whole scheme was built around that gap. Deposit; withdraw before the check gets flagged; abandon the account;
The gap is written into federal rules. Under
How much it has to release turns on whether it suspects anything. A bank that sees nothing wrong with a deposit can make the full amount available immediately or by the next business day, Fooshee said.
A bank that does suspect the check can place a hold on it, but it still has to hand over a minimum by the next business day and more on a schedule while it works out whether the check is good.
During this conspiracy, that guaranteed minimum was $225. An inflation adjustment
That minimum is the floor on what a fraudster collects, not the ceiling. The ring cleared about $10,000 on $50,000 of deposits in a typical week, far more than the floor alone would produce across any plausible number of accounts, which suggests much of what it took came from checks that drew no suspicion from banks.
Jacob coached ring members on how to chase the whole deposit, not the floor, according to Fooshee. Keeping an account quiet was an attempt to avoid a hold that would cap the take at the next-day availability minimum. A check that survived the night without drawing suspicion paid out much more.
Some fraud executives, he said, describe the availability schedule as "effectively a federal guarantee to keep deposit fraud at least minimally profitable" for anyone willing to commit the crime.
A bank that flags a check in a day has, by then, usually had to hand over the minimum already. "It's tedious," Fooshee said, "but clearly it worked pretty well at scale for Tyler Jacob."
Jacob told agents that 40% to 60% of the checks for which he paid got successfully deposited and withdrawn. He agreed the conspiracy caused an actual loss of at least $150,000, against an intended loss of at least $550,000.
Where a bank caught an altered check, the charging documents indicate it returned the money to the account on which the fraudsters drew the check, which made the victim business whole.
The court records do not say who ate the losses on the checks nobody caught in time.
