Despite the efficiency and security of electronic payments, checks remain a popular payment method for many organizations. As a result, check fraud remains an attractive target for criminal enterprises. Even with the increased numbers of business email compromise and ransomware attacks in the digital age, check fraud remains a powerful tactic due to the relative ease with which it is pulled off.

Over the past year, JPMorgan Chase Commercial Banking clients experienced an increase in check fraud attempts. In many of those cases, losses could have been prevented if clients had utilized the firm’s fraud-prevention features available on their accounts.

Criminals are opportunistic and have used business disruptions, emergencies, and high-profile news events to launch new check fraud schemes.

“Companies often think that when it comes to writing checks, low frequency equals low exposure, but it only takes one large check to incur a significant loss,” said John Geronimo, Fraud Strategy Director for Commercial Banking. “It’s important that every organization validates and authenticates payment requests before releasing funds, and that they understand the risks inherent in checks and use the available fraud protection tools on each of their accounts.”

If just one check falls into the wrong hands, your account and routing information can be compromised. Here is some information on ways to mitigate certain check fraud schemes.

Types of check fraud

Counterfeit checks

Once a criminal possesses an organization's account and routing number—as well as the name and signature style of the authorized signer—they may use printers and desktop publishing software to create counterfeit checks that look legitimate. Positive Pay and Reverse Positive Pay are fraud protection services that help clients identify and prevent payment of counterfeit checks. Keep in mind that without correct usage of these features, the client may be liable for losses.

Altered checks

In this scheme, the criminal will alter the name or the payment amount before depositing a check. Fortunately, JPMorgan Chase clients can use Positive Pay with Payee Name Verification to confirm that a check’s details such as account number, serial number, dollar amount, issue date, and payee name match against the business’ records. Positive Pay with Payee Name Verification can help protect against altered items—Positive Pay alone may not always detect fraudulent changes. A client’s failure to use all the features of Positive Pay make the client liable for preventable losses resulting from an altered item.

Forged, missing or improper endorsement

Here, a criminal forges the endorsement on the back of a check and deposits it at a financial institution. In other cases, they may choose to not endorse it at all, or perhaps one party improperly endorses a check that was payable to two parties. Unlike with most altered or counterfeit checks, fraud protection products are not able to detect missing or improper endorsements.   

To mitigate against this type of fraud, it’s recommended to implement thresholds above which electronic payment methods are required. If a check must be sent, the use of a courier service or other guaranteed delivery methods may help prevent theft of the check during transit. You can also proactively confirm with the recipients of high-value checks that the items were received by them.

Mobile deposit fraud

The convenience of depositing checks using mobile devices has enabled a rapidly growing form of check fraud. In this scenario, a business issues a check to an individual, who scans the front and back of the check and remotely deposits it into their bank account.  The fraudster then takes the same physical check to another bank or check-cashing store and receives payment.

When the paper check is presented for payment to the originating bank a few days later, that bank will dishonor the paper item as a duplicate. The dishonored check is returned to the institution that cashed it, which could begin a time-consuming and expensive claims process. The institution holding the physical check could bring a legal claim against the company that wrote the check. The mobile deposit fraud scheme can be avoided by making electronic payments directly to payees in lieu of checks.

ACH debit fraud

This scheme is related to check fraud, even if it doesn’t use a physical check. By using the routing and account numbers found on a check, criminals can initiate ACH debits against a company’s accounts. To stop this from happening, companies should use JPMorgan Chase’s ACH debit blocking or filtering products, ensure they reconcile transactions daily and quickly return any unauthorized ACH debits.

Internal client fraud

Guarding against internal check fraud is a concern for all types of organizations. This type of fraud typically occurs gradually and involves multiple checks over a period of time. A fraudster could be an employee of the client, such as an assistant with visibility into the organization's accounting practices, or a vendor who has access to checks. Working undetected, this individual may issue company checks to themselves or to other associates to cash. The criminal could also be an employee within the billing department who is well-trusted and handles multiple transactions. Watch for suspicious activity, such as an employee who doesn’t take time off from work or won’t accept help on payroll or other accounting tasks. Clients should implement procedures to prevent internal client fraud, which may include securing the physical checks, segregating duties among employees, restricting access to checks and data and reconciling payments and bank records. Implementing a “clean desk” policy, especially among accounting or finance employees, will help secure checks and other important financial documents and help guard against internal and external theft risks, whether from an employee or a member of a cleaning crew that serves your building.

Remember: If you notice fraudulent check activity, it’s important to act quickly and contact your banking team. Under applicable account terms, failure to enroll in fraud protection services may make your organization liable for unauthorized or altered checks that could have been stopped by those services. To learn more on fraud solutions insights and tools, visit our Trust and Safety webpage.

_{© 2022 JPMorgan Chase & Co. All rights reserved. JPMorgan Chase Bank, N.A. Member FDIC. Visit jpmorgan.com/cb-disclaimer for disclosures and disclaimers related to this content.}