Check fraud is on the rise, in part as a result of increasing mail theft, and recruiters have found a new place to recruit people to cash their fake or doctored checks: Telegram.
Late last month, the Financial Crimes Enforcement Network (FinCEN) released
From March 2020 to February 2021, the U.S. Postal Service Inspector Service, which is the law enforcement arm of the Postal Service, received 299,000 mail theft complaints — an increase of 161% compared with the same period a year earlier.
Additionally, FinCEN received 23% more check fraud-related reports from financial institutions in 2021 compared to 2020. The number of reports nearly doubled from 2021 to 2022, from 350,000 suspicious activity reports to 680,000.
Inside a check fraud scheme
Maria Noriega, senior cyber threat intelligence analyst at Q6 Cyber, has been watching fraudsters communicate on Telegram about these schemes, helping each other recruit check walkers — people who can deposit a fraudulent check for them at a bank.
In a typical scheme, a fraudster will use a bank account to which they have stolen access, or they will create an account using a synthetic identity — a combination of stolen and fabricated identifying information. Such an account is sometimes called a mule account.
The fraudster then goes to illicit channels — often cross-platform messaging app Telegram, according to Noriega — to seek out help depositing a stolen check. The fraudster typically gets a reply from a broker, someone who can give the check to a walker.
"A lot of this goes on, I believe, in private messages," Noriega said. "However, fraudsters do also look for walkers [directly] on the platform, so you'll see posts where they say they're looking for a walker and will pay them some amount to walk a check for them."
In this scheme, a walker is someone who matches the description on the mule account — someone who can convince a bank teller that they are the account owner, and that the check is legitimate.
"Typically, the criteria focuses on how much they would be paid, and that they can dress appropriately," Noriega said.
Once the fraudster connects with a broker, they exchange the fraudulent check, which ends up in the hands of the walker. To prepare for the walk, the broker helps the walker learn the details of the stolen or synthetic identity and dress appropriately, to make the whole ruse more convincing when they walk into a branch.
"Need all old walkers, male or female, with dress attire," one fraudster said in a Telegram channel Noriega monitored. They specified they needed someone "socially conservative" for the job.
Stealing checks through the mail
In its alert on surging mail theft-related check fraud, FinCEN said criminals started targeting mail carriers more since the COVID-19 pandemic.
"Criminals typically steal personal checks, business checks, tax refund checks, and checks related to government assistance programs, such as Social Security payments and unemployment benefits," the FinCEN alert reads.
Behind the increasing mail theft are broader economic trends, as well, according to Josh Hanna, a partner in consulting firm Deloitte's anti-money laundering practice.
"As the economy trends downward, we typically see an uptick in opportunistic crimes including check fraud," Hanna said. "Further, there's a chance that as increasingly more Americans work from home, many may be sending or receiving physical checks in the mail with higher frequency than they did pre-pandemic."
Kimberly Sutherland, vice president of fraud and identity management strategy at LexisNexis Risk Solutions, added that fees associated with secure forms of payment can also drive consumers and businesses toward checks instead, which do not tend to come with a fee.
"More merchants are adding their credit card fees to purchases, passing the credit card fees they pay on to consumers who are now having to reconsider whether to use safer credit cards with chips to avoid paying the credit card fee," Sutherland said. "Both check and cash usage are increasing as a result."
When the check is not in the mail
According to Sutherland, check fraud doesn't necessarily involve stealing checks out of the mail.
"Stealing out of mailboxes is one way to get checks and related info, but you really only now need checking account numbers," she said.
Noriega confirmed that fabricating a check does not require the fraudster having a physical, legitimate check in hand. Fraudsters can generate brand new checks with check-rendering software, so check fraud does not always start with mail theft. Nonetheless, she said, it is a major source of fraudulent checks.
"It's not the only way the fraudsters can obtain checks, but I have seen a hefty amount that seem to be coming out of the Postal Service," Noriega said.
No need to physically alter checks
Regardless of how a criminal steals a check, they can turn around and sell that stolen check on the black market, where fraudsters can purchase either the physical check itself or an image of the check, according to Noriega.
"When the checks are being circulated for sale, the maker line at the bottom of the check that indicates the account number — that's redacted, nearly universally," Noriega said. "So when the fraudster purchases the check, they can either choose to purchase the actual physical check or the check image."
Physically altering the check requires more labor than digital alterations — a lot more labor. Some, Noriega said, opt to scratch ink off the check bit by bit to later print over.
"Fraudsters do choose to do this method as opposed to software even though they all agree, for the most part, that the software is clearly much easier," Noriega said.
What banks can do about check fraud
FinCEN coordinated with the U.S. Postal Service Inspector Service to identify 10 red flags of which financial institutions need to be wary in the fight against check fraud, all listed in
The first of these red flags is uncharacteristically large withdrawals via a check to new payees. Others include customer complaints related to stolen or lost checks, checks that don't match any of the issuing bank's existing check designs, abnormal deposits made via remote capture, and others.
The Community Bankers Association of Illinois is calling on regulators to issue guidance that would make large financial institutions toughen customer verification and be more cooperative in resolving disputes over falsified checks.
Ultimately, the way to stop thieves from raiding mailboxes for checks, creating fake checks and recruiting walkers to deposit fraudulent checks may be for the whole system of paper checks to go away, according to LexisNexis Risk Solution's Sutherland.
"There is no point solution to stop check fraud — no silver bullet," Sutherland said. "The solution? Stop using checks. Checks are the opposite of data minimization – there must be an alternative to sharing your full account number for both personal and business check transactions."
