Check fraud.

Check fraud is any scheme that uses a check to take funds the fraudster isn't entitled to. A fraudster might change the payee or amount on a real check, print a fake one with real account numbers, forge a signature or endorsement, or deposit a bad check and withdraw the money before it bounces.

The paper is often genuine, which makes check fraud hard to spot on the item alone. The strongest signals usually come from comparing a check with everything else the bank knows: the drawer's past checks, the depositor's account, and where the money goes next.

Is check fraud a federal crime?

Often, yes. Defrauding a bank is a federal crime under the bank fraud statute, punishable by up to 30 years in prison and a $1 million fine.⁠[2] Making or passing a counterfeit or forged check of an organization can bring up to 10 years,⁠[3] and stealing checks from the mail up to 5 years.⁠[4] States also prosecute check fraud under their own forgery and theft laws.

Who is liable for check fraud?

It depends on what was faked. For an altered check — a real check with a changed payee or amount — the paying bank can generally recover under the presentment warranty that the check wasn't altered, pushing the loss toward the bank of first deposit. A forged endorsement also generally shifts the loss toward the bank of first deposit. A forged drawer's signature generally stays with the paying bank. A washed check can involve both alteration and forgery, and customer negligence or late statement review can shift any of these outcomes.⁠[5]⁠[6]

Check fraud is among the most-reported financial crimes in the US, even as check use falls.

• Over 680,000 suspicious activity reports on potential check fraud were filed in 2022, nearly double the more than 350,000 filed in 2021.⁠[7]
• 63% of banks and credit unions saw check fraud attempts in the prior 12 months, and 31% had losses, in a 2026 Federal Reserve Financial Services survey of 403 institutions.⁠[8]
• More than $688 million in transactions, which may include attempts, appeared in 15,417 mail theft-related check fraud reports filed in six months of 2023.⁠[9]
• 9.2 billion checks were paid in 2024, down from 42.6 billion in 2000.⁠[10]

A SAR counts a report, not a loss.

Most check fraud follows the same four steps.

1. 1Get a check. Steal one from the mail, buy stolen checks online, or print fakes with real account details.
2. 2Change it or copy it. Wash the payee and amount, forge a signature or endorsement, or use it as a template for counterfeits.
3. 3Deposit it. In a branch, at an ATM or by mobile deposit — often into a new or rented account.
4. 4Withdraw before it comes back. Move the money out by ATM, transfer or P2P before the paying bank returns the item.

In FinCEN's review of mail theft-related reports, altered checks were the most common method.⁠[9]

Which schemes are growing? In the Federal Reserve's 2026 survey, counterfeit checks led the reported increases — 32% of institutions said they were rising — while only 1% said the same of kiting.⁠[8]

Red flags

• A payee or amount that doesn't fit the drawer's past checks
• A business check payable to an individual with no relationship to the business
• Check numbers far outside the drawer's normal sequence
• Inconsistent ink, handwriting or a smudged courtesy amount
• A large check deposit soon after an account is opened
• Withdrawals or transfers out within a day of availability
• A mobile deposit from a device or location new to the account
• The same check image deposited at another institution

The paying bank must return a bad check, or send notice, before midnight of the banking day after it receives it. Miss that “midnight deadline” and the bank is generally accountable for the item, though it keeps defenses such as breach of warranty.⁠[6] Three other clocks run alongside it.

Funds availabilityNext business day from deposit

Regulation CC requires the first $275 of a customer's check deposits each banking day to be available by the next business day — often before the paying bank has decided whether to pay. That amount has applied since July 1, 2025. New accounts are exempt: for their first 30 days they run on a longer schedule. Holds for large deposits (over $6,725 a day), redeposited checks, repeatedly overdrawn accounts and reasonable cause to doubt collectibility need written notice to the customer, and a reasonable-cause hold also needs a record of the facts behind it.

12 CFR 229.10(c)(1)(vii), 229.13(a)–(g)⁠[11]

The paying bank's midnight deadlineMidnight, next banking day from receipt

Miss it and the paying bank is generally accountable for the item, though it keeps defenses such as breach of a presentment warranty. Regulation CC adds an expeditious-return duty, a notice of nonpayment for checks of $5,000 or more, and an extension when the return reaches the depositary bank by its next banking day.

UCC §§ 4-301, 4-302 · 12 CFR 229.31(b), (c), (g)⁠[6]⁠[11]

The SAR deadline30 calendar days from detection

A bank has 30 calendar days from first detecting facts that may support a SAR to file one, or up to 60 if no suspect has been identified. Under the banking agencies' rules, a known or suspected federal crime against or through the bank must be reported at $5,000 or more when a suspect can be identified, and at $25,000 or more regardless of a suspect. FinCEN's rule separately covers suspicious transactions of $5,000 or more.

31 CFR 1020.320(a)(2), (b)(3) · 12 CFR 21.11(c), 208.62(c), 353.3(a), 748.1(d)⁠[12]

The customer's statement reviewOne year, at most from the statement

Customers must review their statements with reasonable promptness and report forged drawer signatures or alterations. After one year a claim against the bank is barred regardless of care. A customer who doesn't review promptly can also lose claims on later items by the same wrongdoer that the bank paid in good faith after a reasonable period of no more than 30 days. Deposit agreements often shorten these windows.

UCC § 4-406⁠[6]

• Offer Positive Pay to business customers. Presented checks are matched against the customer's list of issued checks; payee Positive Pay also matches the payee name.
• Compare every check with the drawer's history. Signature, handwriting, payee, amount and check-number patterns expose alterations that look clean on the item itself.
• Use exception holds, and document why. Regulation CC allows longer holds for reasonable cause to doubt collectibility, large deposits, redeposited checks and repeatedly overdrawn accounts, with written notice to the customer.⁠[11]
• Watch new accounts and mobile deposits. New accounts run on a longer availability schedule for their first 30 days; device, location and duplicate-image checks help catch mobile deposit fraud.⁠[11]
• Help customers protect their checks. Encourage them to mail checks inside the post office, pay electronically where they can, and review statements promptly — late review can shift losses onto them.⁠[6]
• File SARs on time. A SAR is due 30 calendar days after first detecting facts that may support one (up to 60 if no suspect is identified). For mail theft, use FinCEN's key term FIN-2023-MAILTHEFT.⁠[12]⁠[7]

Why check fraud reviews take so long

Deciding is quick once the picture is complete. Getting the picture is the slow part: the evidence for one flagged check sits in seven systems. When every item takes that long, review has to be rationed — and with a dollar threshold, an altered check under the line clears without a second look.

Socratix AI coworkers take on the gathering. For every check, they pull the evidence from each system, compare the item with everything the drawer has written before, and hand your analysts a recommendation with the reasoning laid out. Your team still makes every call — it just stops spending the day assembling the picture.

Fraud has learned to move fast: stolen checks are washed, sold online and deposited, and the money is often withdrawn quickly.⁠[7] Your team can't add analysts that fast. AI coworkers do the gathering — every item, around the clock — so the people you have spend their time on the decision. Risk officers already list AI image analysis to detect alterations among their fixes for check fraud losses.⁠[8]

1. GatherPulls the item image, the drawer's signature and past checks, usual payees and amounts, account activity and prior returns from the systems that hold them, into one case.
2. AssessCompares signature, handwriting, written and numeric amounts and the MICR line with the drawer's history, looks for signs of washing, and watches the clocks.
3. RecommendAuto-clears what's clean. For the rest: pay, return, hold or escalate — with the evidence, a plain-language reason, and a draft SAR narrative when one is warranted. Your analyst decides.
4. LearnLearns from each decision — your policies, your risk appetite, your analysts' judgment — and every step is logged for the examiner.

How First Community Bank and Trust reviews every check

First Community Bank and Trust has served Beecher and Peotone, Illinois, for more than 100 years. Like many community banks, it relied on a flat dollar threshold to decide which checks got a closer look — careful work, but only a fraction of its checks.

Socratix now evaluates every check against the drawer's own history: signatures, handwriting, written and numeric amounts, the MICR line, signs of washing. Clean items clear automatically. The rest reach an analyst with the check image, the historical comparison and a plain-language reason in one view — and the analyst can follow or override the recommendation.

The work changed how the bank talks to customers, too. In one case a check written for $1,100 had cleared for $2,200; the analyst contacted the customer, who sorted it out with the vendor immediately. The bank now reaches out whenever a flagged check looks wrong, fraud or not.⁠[13]