Even though they are protected by online banking passwords, the digital check images posted on banks' Web sites could be used for check fraud, warn some observers.
Technology vendors say it would be possible to modify their software to redact some details from the images and make it harder to create fake checks, but one banker says he is not concerned.
Christopher Leach, the chief information security officer for First Horizon National Corp. of Memphis, said that criminals have long stolen customers' checkbooks, but in the online world, they must now crack a password to gain access to checks.
"That's one additional control that you don't have with your checkbook," he said.
Mr. Leach said he is more interested in persuading his customers to shred their financial documents than he is in trying to modify the images posted on his company's Web site.
But Frank W. Abagnale, the president of the Tulsa security consulting firm Abagnale & Associates, said banks should reconsider the way they present check images.
Not only can the information on images be used to forge checks, but it could also facilitate identity theft, he said. Along with names, addresses, and account numbers, people are often asked to write their birth date and driver's license number on checks. Some states use Social Security numbers as driver's license numbers, and all of these details are included on the images of cancelled checks.
"I don't understand why the bank does not block the MICR line on the image or, for that matter, block the name on the check," he said. "To me, it's a very simple problem to solve."
Mr. Abagnale made his name as a check forger in the 1960s and 1970s. "What I did 40 years ago is now 4,000 times easier to do today."
He also said that it is no longer even necessary to forge checks; they can simply be purchased from a major vendor. "Today, there are over 200 companies selling checks online and through the mail," and if a customer has a distinctive check design, such as an image of Popeye, a crook can simply order checks with the same style.
Avivah Litan, a vice president and research director at the Stamford, Conn., market research company Gartner Inc., said that an online archive of check images can be a treasure trove for criminals - potentially more valuable than a checkbook or a few cancelled checks. Criminals can see a months-long spending history that could help them use forgeries to emulate a person's spending habits or estimate what check number a victim would be using at a specific time, she said.
Banks have underestimated the potential of digital images as a forgery tool, Ms. Litan said. Banks are more focused on preventing criminals from using online payment services, such as wire transfers and bill payments, to steal money from a customer's account.
"They just haven't realized that online criminals would resort to check forgery," she said. "Crooks come in to look at your imaged checks to see what your signature's like. They study the checks, and then they copy the checks."
Amar Verma, a vice president of product management with the Alpharetta, Ga., imaging software vendor Alogent Corp., said that images lose some check details, such as security watermarks, when they are created, but other important features, such as the signature, are easily visible.
None of Mr. Verma's customers have asked him "to change the image itself," he said.
Kathie Gibbons, a senior product manager with the risk solutions group for the Dallas imaging software vendor Carreker Corp., said that images could provide a new way for criminals to pursue an old scam.
She said she was not aware of any cases where images have been copied. "Could it happen? Absolutely."
The best protection is strengthening online banking security to make it harder for people to gain access to a customer's image archive, Ms. Gibbons said.
Copying images is no different from forging a check after studying a real one, and if criminals use images to create fake checks, the systems already in place to catch forgeries will be just as effective, she said.
"It's the same old stuff; it's just kind of repackaged," she said. "I don't know that we've introduced any new risk by providing that in the online environment."
