Responding to Counterfeit Instrument Scams and Mail-Related Check Fraud
Editor’s Note: This article was originally published in 2008, with an updated version published in 2018. We have updated it further to reflect changes that have occurred since then.
Check fraud has become a growing concern for financial institutions, businesses, and consumers. According to the 2025 payment fraud survey of the Association of Financial Professionals (AFP), “checks continue to be the payment method most often subjected to payments fraud, with 63 percent of respondents experiencing attempted or actual fraud via checks in 2024.”1 Statistics for mail-related check fraud and counterfeit instrument scams confirm the gravity of this issue. The Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) reported that during a six-month period in 2023, it received 15,417 Bank Secrecy Act reports involving mail-related check fraud with more than $688 million in transactions,2 while the Federal Trade Commission received 13,616 consumer complaints of fake check scams in 2024.3
While the number of checks the Federal Reserve processes has generally been decreasing over the years,4 the total check volume is still substantial: In 2024, the Federal Reserve processed nearly 3 billion commercial checks and 36 million government checks.5 According to a 2024 AFP survey, 75 percent of surveyed organizations reported using checks, and 70 percent had no immediate plans to stop using them.6 Thus, it is important for all stakeholders to understand check fraud risks and ways to respond. This article discusses two types of common check fraud — counterfeit instrument scams and mail-related check fraud — and ways financial institutions, businesses, and consumers can help mitigate these risks.
COUNTERFEIT INSTRUMENT SCAMS
Background
Congress passed the Expedited Funds Availability Act (EFAA) in 1987 to “end excessive holds on customer deposits by depository institutions”7 by establishing the maximum permissible hold periods for checks and other types of deposits. For certain “safe” instruments considered low risk for being dishonored, the law requires funds be made available the next business day. These include cashier’s and certified checks, Treasury checks, U.S. postal money orders, checks drawn on a Federal Reserve Bank or Federal Home Loan Bank, and checks issued by a state or local government.8 For most other check deposits, Regulation CC, the EFAA’s implementing regulation, requires funds be made available not later than the second business day following the banking day on which funds are deposited.9
When the EFAA was enacted, desktop publishing was in its infancy, and tools to create high-quality counterfeit checks were expensive and not readily available. But desktop publishing has evolved considerably since 1987. Inexpensive, off-the-shelf software and hardware can now create counterfeit instruments, such as cashier’s checks or money orders, that look identical to genuine ones.10 Criminals understand that many people mistakenly believe that these checks or money orders cannot be rejected once the funds have been received, so they exploit the delay between the time deposits must be made available under the EFAA and the time it takes to discover an instrument is counterfeit. During this window of opportunity, fraudsters can deceive victims into wiring funds from the check or money order that was deposited.
Nature of the Schemes
Criminals create a counterfeit financial instrument believed to be a form of guaranteed payment, such as a cashier’s check or postal money order, and trick consumers or businesses into depositing it and wiring back a portion of the deposit based on a contrived explanation. The check will appear to have cleared because the EFAA and Regulation CC limit the hold periods for deposited checks and other instruments, even though they may not have been paid yet by the payor bank. Eventually, the payor bank to which the check will be presented for payment will flag it as a counterfeit and return it to the depositary bank.11 When the check is returned unpaid, the depositary bank will typically seek to reverse the deposit that was originally in the customer’s account. The customer may have assumed the check was legitimate because the funds were made available and blames the depositary bank for this misunderstanding; however, the depositary bank has simply complied with federal law by crediting the account within the Regulation CC time frames.12
Common counterfeit instrument scams many institutions encounter include:13
- Job/task scams: A consumer is told he can earn a commission by completing different online tasks such as rating product images. Before receiving the commission, the consumer is told he must “charge up” his online account by making a deposit, after which he will receive the amount of the deposit back plus his commission.14
- Car wrap: A consumer is told she can earn money by agreeing to have her car wrapped to advertise a product such as an energy drink. The scammer sends the consumer a counterfeit check to cover the cost of having the car wrapped and instructions to deposit the check and then wire the money to the company performing the car wrap.15
- Mystery shopper: A consumer receives a letter stating he has been chosen to act as a mystery shopper and receives a cashier’s check to deposit. The consumer is told to use a portion of the funds to purchase merchandise at the designated stores, transfer a portion of the funds to a third party using a designated wire service company, and keep the remainder.
- Online transactions: A consumer sells an item through an online marketplace, and someone offers to buy it using a cashier’s check (or similar instrument) for an amount greater than the asking price. The buyer offers a contrived explanation for the overpayment and asks the seller to deposit the check, keep the amount of the selling price plus an extra amount, and wire the balance back to the buyer.
While these schemes initially focused on consumers, businesses also have been targeted in recent years. In one common scheme, fraudsters contact law firms pretending to be new clients seeking representation to collect debts. The law firm contacts the alleged debtor, who agrees to pay the debt and sends the law firm a counterfeit check. The law firm deposits the check and sends the client the payment less attorney’s fees and later learns the check was counterfeit. In 2024, the FBI issued an alert about this issue.16
RISK MITIGANTS
Exception Holds
Regulation CC contains several exceptions to its expedited funds availability requirements for check deposits.17 Of relevance here, a depository bank may extend the hold period for check deposits when it has reasonable cause to believe the check is uncollectible from the paying bank.18 Banks may leverage this exception when they have reason to believe a depositor is attempting to cash a counterfeit or altered check, provided the reason satisfies the regulation’s standard for invoking this exception: “Reasonable cause to believe a check is uncollectible requires the existence of facts that would cause a well-grounded belief in the mind of a reasonable person. Such belief shall not be based on the fact that the check is of a particular class or is deposited by a particular class of persons.”19
If a bank has reasonable cause to believe a check is uncollectible from the paying bank, written notice must be provided to the depositor that includes the time period within which the funds will be available for withdrawal and the reason the exception was invoked.20 An exception hold extends the hold period by a “reasonable period of time” beyond the period that would otherwise be required for the type of instrument.21 The regulation includes safe harbors for “a reasonable period of time.” If a hold exceeds the applicable safe harbor, the burden is on the bank to justify it.22
Educating Customers
Counterfeit instrument scams present challenges for financial institutions because many consumers and businesses believe that certain instruments, such as a cashier’s check or a money order, cannot be dishonored. They therefore assume that next-day funds availability means their financial institution was paid on the deposited instrument.
Financial institutions can play an important role by educating their customers about this issue. This is admittedly a delicate task because banks want to educate their customers without alarming them.
For deposits made in person, banks could consider training tellers to discuss the risks of accepting cashier’s checks or similar instruments from parties with whom they have few or no prior dealings.
Banks can also consider posting advisories on their websites, in their mobile applications, and in branches about counterfeit check scams to alert customers to the red flags of suspicious transactions.23
Educating Employees
A well-trained staff can also help detect counterfeit or altered checks. Physical signs of counterfeiting that employees can be vigilant for include evidence of alteration or erasing, spelling errors, mistakes, suspicious check amounts, a lack of or incorrect financial institution information, and a routing number that does not match the routing number of the instrument’s issuer.
A bank could also mitigate risks by including its wire department in any educational campaign because many schemes require the consumer or business to wire funds to a fraudster. Banks may consider training wire department staff to recognize suspicious transactions in which bank customers are at high risk for counterfeit check scams. Typically, these scams involve some or all of the following characteristics:
- A wire transfer request is made shortly after the deposit of an instrument subject to next-day availability that a customer received from a third party with whom the customer has no prior dealings.
- The instrument deposited is generally believed by consumers to be incapable of bouncing such as a cashier’s check or certified check.
- A customer who rarely makes wire transfers makes a transfer.
- A recipient is outside the United States.
When a wire transfer involves some or all of these characteristics, staff may consider informing the customer about counterfeit check scams and the risk of wiring funds to someone with whom the customer has no prior relationship.
Verifying Suspected Counterfeit Instruments
Treasury Checks
Executive Order 14247 generally phases out Treasury checks, but they will still be issued on an exception basis. The Department of the Treasury maintains a website to verify whether a Treasury check is valid.24
Postal Money Orders
The U.S. Postal Service provides a phone number to verify postal money orders: 866-459-7822. The Postal Service also has a web page discussing security features.25
Other Money Orders
Some private money order providers offer verification services.
MAIL-RELATED CHECK FRAUD
Mail-related check fraud occurs when criminals steal checks from mail receptacles to facilitate check fraud. For example, criminals might break into a U.S. Postal Service blue collection box after the last collection for the day or steal mail left overnight in someone’s mailbox.
In a 2024 report,26 FinCEN identified principal ways criminals use stolen checks:
- Altering and depositing them
- Using the account number and bank routing number to create counterfeit checks
- Fraudulently signing and depositing them
- Selling them on the dark web
Between October 2021 and October 2022, the Postal Service reported 38,500 mail theft incidents involving mail receptacles.27 In the first half of fiscal 2023, more than 25,000 such incidents were reported. Furthermore, the U.S. Postal Inspection Service (USPIS) reported 299,020 mail theft complaints between March 2020 and February 2021, an increase of 161 percent over the prior year, while the number of Suspicious Activity Reports for check fraud nearly doubled between 2021 and 2023.28
RISK MITIGANTS
Positive Pay
To combat check fraud, banks have begun offering positive pay as a service to commercial customers. Under positive pay, an automated system compares checks presented to the bank with a list of information on checks sent by a business.29 Checks deemed suspicious are sent back to the business for verification, and they are cleared only when the business approves them. Since businesses update these lists on a regular basis, positive pay allows them to bank more securely when issuing paper checks.
Other Mitigants
- Making payments electronically when possible and encouraging payors to send electronic payments
- Using checks with security features, writing checks in nonerasable ink, and filling out checks as fully as possible to make it more difficult for criminals to alter the information, known as check washing
- Taking checks directly to the post office instead of putting them in a mailbox
EXECUTIVE ORDER ON PAYMENTS TO AND FROM THE FEDERAL GOVERNMENT
On March 25, 2025, President Trump signed Executive Order 14247, “Modernizing Payments to and from America’s Bank Account,” which will implement significant changes regarding Treasury checks. The order directs the Secretary of the Treasury to cease issuing paper checks, with limited exceptions, for all federal disbursements, including intragovernmental payments, benefits payments, vendor payments, and tax refunds beginning on September 30, 2025, to the extent provided by law.30 In addition, the order provides that as soon as practicable, and to the extent permitted by law, all payments made to the federal government, with limited exceptions, shall be processed electronically.
The order notes that maintaining the existing infrastructure for issuing Treasury checks and digitizing paper records cost over $657 million for fiscal 2024.31 According to the order, Treasury checks are more likely to be stolen, altered, or returned undeliverable than electronic funds transfers.
The order includes certain exceptions where electronic payment and collection methods are not feasible. These exceptions, listed in §4(a) of the order, include individuals lacking access to banking services and electronic payments, emergency payments where electronic transfers would cause undue hardship, and security-related activities where issuing electronic payments would pose a hindrance.
FEDERAL BANKING AGENCIES’ REQUEST FOR INFORMATION ON POTENTIAL ACTIONS TO ADDRESS PAYMENTS FRAUD
In June 2025, the Office of the Comptroller of the Currency, the Treasury, the Federal Reserve Board, and the Federal Deposit Insurance Corporation published a request for information (RFI) on payments fraud in the Federal Register with a comment period ending September 18, 2025.32 The RFI is summarized in this issue.
INTERAGENCY STATEMENT ON ELDER FINANCIAL EXPLOITATION
Federal and state financial regulators issued a joint statement in December 2024 that provides examples of risk management and other practices for elder financial exploitation that may also be effective in mitigating check fraud risk.
CONCLUSION
Mail-related check fraud and counterfeit instrument scams present challenges for financial institutions, businesses, and consumers. This article discussed these risks and ways to help mitigate them. The federal banking agencies are soliciting information from the public to help them explore ways in which they can use their authorities to mitigate payment and check fraud. Specific issues or questions should be discussed with your primary regulator.
ENDNOTES
1 See “Survey: 79% of Organizations Were Victims of Attempted or Actual Payments Fraud Activity in 2024” AFP press release, April 15, 2025.
2 “Mail Theft-Related Check Fraud: Threat Pattern & Trend Information, February to August 2023,” FinCEN (September 2024). See also Ann Carrns, “Check Fraud Is on the Rise. Here’s What You Can Do to Prevent It,” New York Times (March 10, 2023); Ron Lieber, “Stolen Checks Are for Sale Online. We Called Some of the Victims,” New York Times (July 3, 2024).
3 Consumer Sentinel Data Book 2024 at p. 87. See also Ann Carrns, “Got an Unexpected Check in the Mail? It May Be Fake,” New York Times (February 21, 2020).
4 The Federal Reserve publishes annual data on check volumes for commercial and government checks and postal money orders. The Clearing House also processes checks through its network, so these data understate the total number of checks processed.
5 Id.
6 “2024 AFP Payments Fraud and Control Survey Report Key Highlights,” Association for Financial Professionals (April 2024).
7 S. REP. No. 100-19, at p. 1 (1987).
8 12 C.F.R. §229.10(c).
9 12 C.F.R. §229.12(b).
10 George Brandon and Matthew J. Ohre, “The Nigerian Check Scam: An Oldie Revisited,” 126 Banking Law Journal at pp. 223–224 (March 2009).
11 “Beware of Fake Checks,” Federal Deposit Insurance Corporation (August 2019).
12 12 C.F.R. Part 229, subpart B.
13 The FTC has provided data on some of the top check scams: “Don’t Bank on a ‘Cleared’ Check” (February 10, 2020). See also “Don’t Cash That Check: BBB Study Shows How Fake Check Scams Bait Consumers,” Better Business Bureau (September 2018).
14 “Paying to Get Paid: Gamified Job Scams Drive Record Losses,” FTC Data Spotlight (December 12, 2024).
15 “How to Avoid Getting Wrapped Up in a Car Wrap Scam,” FTC Consumer Alert (April 1, 2024).
16 “Counterfeit Check Scam Targets Law Firms Via Debt Collection Scheme,” FBI Alert Number: I-100824-PSA (October 8, 2024).
17 12 C.F.R. §229.13.
18 12 C.F.R. §229.13(e).
19 12 C.F.R. §229.13(e)(1).
20 12 C.F.R. §229.13(g).
21 12 C.F.R. §229.13(h)(1); Comments 13(h)-1, -2, -3, -4.
22 12 C.F.R. §229.13(h)(4); Comment 13(h)-1. Records of exception holds must be retained. 12 C.F.R. §229.13(g)(5).
23 The Georgia Department of Banking and Finance has a web page discussing red flags for counterfeit checks.
24 See the Treasury Check Verification System.
25 See “Verifying U.S. Postal Service Money Orders” at www.usps.com. The New York Times published an article in 2005 detailing the increase in counterfeit postal money orders. See Tom Zeller Jr., “Authorities Note Surge in Online Fraud Involving Money Orders,” New York Times (April 26, 2005).
26 “Mail Theft-Related Check Fraud: Threat Pattern & Trend Information, February to August 2023,” FinCEN (September 2024).
27 Id.
28 “Mail Theft-Related Check Fraud Is on the Rise,” FBI and USPIS public service announcement (January 27, 2025).
29 See “Positive Pay 101: A Guide to Preventing Payment Fraud” at www.bill.com.
30 90 FR 14001 (March 25, 2025).
31 Id.
32 90 FR 26293 (June 20, 2025).