Check fraud is on the rise, even as check use has been falling steadily for decades. In fact, checks are the payment method most vulnerable to fraud. Last year, check fraud accounted for about $20 billion in losses. Why is this happening now?

Boston Fed payments fraud expert Mike Timoney says it’s about opportunity. Financial institutions have been focused on preventing online payments fraud, and thieves looking for other opportunities are exploiting vulnerabilities with checks.

On this episode of Six Hundred Atlantic, Timoney talks about how fraudsters get their hands on the checks, the different ways they use them to steal, and what consumers can do to stop them.

JAY LINDSAY:

Hi, I am Jay Lindsay, and you are listening to Six Hundred Atlantic. Our topic today is check fraud. Now, it might seem like we're taking a trip back in time to the 80s and 90s here, but check fraud is on the rise today, and it's the payment method most vulnerable to fraud right now, according to the Association for Financial Professionals. But you're saying, "Well, aren't checks paper? Didn't we all move on to digital and electronic payments a long time ago?" Well, we've brought in Mike Timoney to help us make sense of this.

Mike is based here at the Boston Fed, and he's a vice president for secure payments. That means he's a payments fraud expert, and he has some answers for us about the spike in check fraud. We're going to talk to him about check fraud trends and how these criminals are getting away with all this, because they've gotten creative. What are some of their tactics, and what's their impact? And perhaps most importantly, we'll be asking Mike about ways you can avoid becoming a victim of check fraud yourself. Mike, thanks for being here.

MIKE TIMONEY:

Jay, my pleasure. Looking forward to the discussion.

JAY LINDSAY:

Mike, my first thought when I heard that check fraud was on the rise was, “Who still uses checks?” So, can you talk a little bit about how many checks are still out there?

MIKE TIMONEY:

So, Jay, it's a good question. Checks are still used by consumers. But primarily they're used by businesses. And just for some reference points, I'll tell you, the Fed processed about three-and-a-half billion commercial checks in 2023, and we process probably about one-third of all checks. That equates to about 10 billion commercial checks a year.

However, when you look back in time, back to 2000, at that point in time there were over 43 billion checks. And, then, even as recent as 2018, that was down to 15 billion. So now we're down to about 10. So, as you can see, they're still significant as a payment product, but the key point is that they are still declining.

JAY LINDSAY:

Mike, I'm hoping you can lay out the scope of this fraud problem, and how much is this costing businesses and banks?

MIKE TIMONEY:

So, that's probably one of the most relevant questions that I hear is, “How big is this problem?” And it is significant. The first thing is really that, as you already mentioned, it's risen, and we've seen about a 385% increase nationwide since the pandemic. And so that's not that long ago. And if you try to think about, “Well, what does 385% really equate to?” In 2023, that equates to about $20 billion in losses due to check fraud. And when you look at some of the other types of fraud out there, that number is one of the largest types of fraud that we're seeing today.

Now, the other thing I'll mention is I went back to try and think about how big was check fraud 20 years ago, and there's not a lot of solid data from there. But I did find a report from 2006 that said it was around a hundred million dollars. So, if you think in 15 years or 18 years, Jay, it's gone up from a hundred million to over 20 billion, that's a big increase.

JAY LINDSAY:

Yeah, it's just massive. And the obvious follow-up here is, “Well, why now? Why is check fraud on the rise?” You've already noted that people are using fewer checks. So why would check fraud be on the rise now?

MIKE TIMONEY:

So, I did mention that there's still a significant payment method, but what I didn't mention is that the average check, the dollar value of an average check, has gone up significantly, too. Twenty years ago, a check average was around $800, now it's around $2,700. So, those pieces of paper now became more valuable. But probably the primary reason that we're seeing a shift into the paper items is that the financial industry, including banks, et cetera, have been doing a lot of work and have spent a lot of money over time to try and detect and prevent online payment fraud.

And they've done a very, very good job of doing that. What fraudsters realized is like, well, now that the banks have done all this work and they're spending all this money, it makes it a little harder for me as a fraudster to get through. So, what they've ultimately done is reverted back to some of those old schemes that worked. And basically they looked for the weakest link and tried to exploit that, and one of those is check. So, while the banks were spending all that money to invest in this new technology and new payment methods, one of the things they didn't do was invest as much in check fraud detection, which kind of makes sense if you think about it, because everyone was thinking, “Well, checks are going away.”

So, if you have to tell your boss, “I want to invest in an old technology,” they're not going to be looking at that. They're going to be looking at more the future.

JAY LINDSAY:

That makes sense, Mike, and a quick follow-up before we move on to my next question. You mentioned a particularly high spike in check fraud starting around the time of the pandemic. I'm wondering why then?

MIKE TIMONEY:

There was a lot of money having to be moved at that time. A lot of government programs still used checks and do send out checks. So, there was a lot of checks going out from that perspective.

JAY LINDSAY:

Thanks, Mike. I want to talk a little bit now about exactly how fraudsters can pull this off. How are they even getting ahold of the checks, and what are they doing once they get them?

MIKE TIMONEY:

All right, so there's several different ways to this, Jay. But the first way that fraudsters are doing this is really simply stealing checks out of mailboxes.

They're literally going around and stealing mail and looking through the mail for items that might have a check in it. And they do this for several reasons. First of all, the technology's pretty simple. You can get into a mailbox. There's lots of different ways to reach down to the older mailboxes to get checks, to get mail out of there. I've even seen some videos, Jay, where they literally were taking a grinder and cutting a hole in the side of the mailbox so they can get things out. Once they get their hands on a legitimate check, if I can change the name on that check from “Jay” and make it “Mike,” then I can cash that item.

And clearing that name isn't that difficult. In fact, fraudsters do that by using common household chemicals that would be under your sink. And so, to do that, they just really soak the check in it, put tape over the areas where they don't want the ink to come off, leave the name blank, dip it in the solution for a few minutes, and the name will come clean. I can just type in a new name on there. So, Jay, I wipe your name out. I put my name in, I take it to a bank, and I cash it. If they look at the item, it's still a legitimate item. It just has my name on it instead of yours.

JAY LINDSAY:

So, it seems like you’d draw a lot of attention trying to remove checks like that, do these fraudsters have methods that are less conspicuous?

MIKE TIMONEY:

Well, you might not have heard this term before, but they have keys that open those mailboxes, the traditional blue boxes that we're used to, that were called arrow keys. And those keys basically open a series of mailboxes. So, fraudsters, one, would try to get their hands on some of those, those keys, either buying them on the dark web, stealing them from carriers, holding up carriers and taking their key or literally stealing them out of post offices. And once they get their hands on those keys, they have access to the mailbox.

They've now even gotten to the point where they're 3D-printing those keys so that they have them as well. So that kind of thing's been going on. That's the predominant way that we see check fraud happening. But the other thing that's going on with criminals trying to deposit these items, we all are probably familiar with mobile deposit, where you can deposit a check using your phone or even an ATM for that matter. So, the fraudsters are literally … get signed up for accounts or get access to accounts, and they're depositing these items through a mobile deposit. They never have to go into a bank, just take a picture of it.

Now, the reality is if you have access to that and you have multiple accounts, you could deposit the same check to 10 accounts and maybe you can cash them out before you get caught.

JAY LINDSAY:

Now, the dollar amount, the dollar box on those checks, is obviously important to thieves. But can you talk about other info on a check that’s valuable as well?

MIKE TIMONEY:

When you look at a check, a check contains certain pieces of information. It's got your name, your address, it's got an account number on it, it's got a routing number on it, and it may or may not have a phone number or driver's license number. We used to do that in the past. But once I get all that information, even if I just have the piece of paper, I can take that information, and I can use that for fraud.

I have everything I need to just go and order some new checks, or I could actually take them somewhere and get them to make them for me. Or I could literally use a printer and get some check stock and create counterfeit items myself. And so, if I do that, it's going to look like a legitimate check, right? It's on real check stock, it's made out, looks like the company's checks, but I just print them out to myself, and I go and cash them. So, Jay, that's why I think it's more we've got a system that depends on a piece of paper moving around. It's a physical item, and once you get your hands on it, it contains information that then can be leveraged for bad purposes.

JAY LINDSAY:

Yeah, I guess if you are a check writer, all these methods you're describing, it's obviously a little alarming how many different vulnerabilities there are. But let's say I'm a guy who doesn't write a lot of checks, and I see these stories about increases in fraud, and I think, "Well too bad, but so what? That's not me. I'm not writing a lot of checks." Am I missing something? Does this affect me in some way? Does this matter to me?

MIKE TIMONEY:

I would say, yes, because it does matter to you. And actually, I think it matters to all of us out there. You don't have to actually write a check for your account information to be compromised. So, I'll say that. Most of us have checking accounts. So, you have a checkbook. Even, Jay, if you don't write checks and you throw that in your drawer, it still contains information that there's an account number and an item and everything there, right? You've got an account number, a routing number, your name and address.

Well, if I get that information, I don't even have to get it from your check. If I happen to purchase some of your information from a data breach or on the dark web or some of those kinds of things where these are available for sale, I can take that information, and I can order checks. So, even though you have your checkbook in the drawer, I can order myself a whole bunch of checks that are in your name and drawn against your account. And then literally, I can be writing them out and paying people with them and getting merchandise. And so, you never wrote anything, but you're being impacted negatively.

So that's probably the key piece of it, is that you don't have to actually write them to be a victim.

JAY LINDSAY:

And that's a good segue into prevention, what we want to talk about there. What's being done to stop this? When you talk about the post office being vulnerable, obviously financial institutions, what are these places doing to stop check fraud from happening?

MIKE TIMONEY:

So, I will say there's a lot being done, Jay. We at the Fed continue to try to do education and work with the industry to look for solutions, but I'll say the U.S. Postal Service is doing a lot, as well. They have come up with these new high security boxes and they're changing them out across the country. I know the last time I looked, they were in the process of changing 12 to 15,000 boxes, which is no small feat. The other thing that they're doing is even on some of the existing boxes, they are shifting from these arrow key locks that I mentioned and going to electronic locks.

And I think the numbers I saw there were in excess of 50,000 locks they were going to replace to try and stop the fraudsters from getting into those. So that's a big thing that the USPS is doing. I will mention that they annually probably stop or recover about a billion dollars in fraudulent items. So, that's good. They're doing things there, but they're also partnering with other groups out there. I've seen that they partner with the American Bankers Association where they've created a list of tips and educational programs on how to combat check fraud.

And there's also new tools for detection that can help with check verification and score those items to suggest if they're risky or not. And then if you think about it from an electronic perspective, the banks are looking at things like mobile deposit, how can they better address items coming in from that to make sure they're legitimate? They've done things at the ATM to try and look for suspicious items coming through the ATMs. And then there are, you'll always see still sometimes people trying to check them at the counter. But at the counter, at the banking centers, they're doing a lot of education to try and help the tellers recognize which items could potentially be fraudulent.

JAY LINDSAY:

And Mike, just a follow-up here, you talk about these mailboxes with the USPS, and I think I've noticed some in my own neighborhood, the specific features, there's a very narrow slot. I can't get in there. It seems like it's more buttoned up. What are we talking about? How are they hardening these mailboxes?

MIKE TIMONEY:

Well, that's exactly one of them. So, if you think about the mailbox that had the big door that fell forward, fraudsters used to try and have a stick with adhesive on it and stick down in there, see what they can pull out, fishing line hooks, all that kind of thing, just to try and get into the mailbox. Can't do that really through those slots. So that's one way that they're doing to harden it. The second is getting away from those arrow keys and really going to this electronic locks. Because today the one arrow key can open a series of boxes. With the electronic lock, you can have codes on different ones, so it'll be different. The other thing that they're doing is trying to put mailboxes in areas where they're a little bit more visible. There's lighting, there's cameras and things like that, so that mailboxes just aren't in a random place where no one knows it's there and can be stolen.

JAY LINDSAY:

And Mike, along those lines, you talk about, with the financial institutions, and you noted that not many people, they don't necessarily go to a teller. So the education there may not catch them. Is there technology that you know that banks are using to try to, to try to signal and flag these suspicious transactions?

MIKE TIMONEY:

There are definitely tools that they have for their customers that are significant check-writers to try and stop the check before it ever gets cashed.

And so how you stop that is really using some of the new technologies. There's a lot of now solutions where they have databases of information where they can check against. It's not going to solve all the problem. But there are new tools that are now coming along from an AI technology perspective to look at these mass data sets of check items to try and look for suspicious activity.

JAY LINDSAY:

Gotcha. So, we're talking, we've talked so far, we've talked about what the postal service can do, what banks, financial institutions can do. I'm hoping, Mike, that you can give people out there, listeners, individuals some advice on what they can do to stop themselves from becoming victims of check fraud.

MIKE TIMONEY:

Let's start with some of the things that the U.S. Postal Service is even recommending. So, if you're going to write a check, here's a few things that they suggest. One is, if you're using it, write it in a black ink that's indelible and won't be able to be taken off the item. They say, I learned this when I first was writing a check many years ago, Jay, don't leave blank spaces either on the payee line and the amount line, make sure everything's filled in there or draw lines across it, that sort of thing, to try and fill up the spaces.

Make sure that you review your bank accounts on a regular basis, right? It's very important to look at anything that's being debited to your account and look to see if there's money coming out, especially written by a check. So, definitely be looking at that.

Look at, “Can you do other things?” Can you do an electronic payment? Can you do an e-check possibly or an ACH item? Those kinds of things. Some of the other things that they mention is don't put the mail out with the red flag on your mailbox. Don't put checks in there to mail it. Now you go, "Well, wait a second. I thought that's what it's for." Well, because fraudsters are stealing them from the mailboxes, that little red flag is like a flag for the fraudster that there's something in the mailbox. Another thing that they say is, if you are putting mail out, don't put it out on a Friday night or a Saturday afternoon when there's no mail pick up until Monday because that mail's just going to sit there for a couple of days. Don't let your mail sit in your box. If you're away and that sort of thing, make sure you get it picked up. Ask your post office to hold it if you're going to be away if you don't have somebody to do that. You can use security envelopes. You can have delivery methods where it notifies you that this has been delivered.

And if you are making a payment by check and you want to make sure it gets to the end person, you might follow up with them, as well. So, there's lots of different things, but honestly, a lot of what they're suggesting now is if you are writing them, and as I mentioned, a lot of businesses still do this, but they actually take them to the post office and mail them from there.

JAY LINDSAY:

Great. Thanks, Mike. That's some good advice for us. Thanks for that. And thanks for spending some time with us about this issue. It's interesting stuff. It's important stuff. Thank you.

MIKE TIMONEY:

My pleasure, Jay.

JAY LINDSAY:

You can find more interviews with thought leaders like Mike on bostonfed.org/sixhundredatlantic. You can also check out our podcast seasons there. We just released Season 6. The topic is “full employment.” The season is four episodes, and we invite you to give it a listen.

While you're on the site, please subscribe to our email list to stay informed when episodes are released. And we here at Six Hundred Atlantic would all consider it a personal favor if you’d rate, review, share, and subscribe to the podcast on your favorite podcast app. I'm Jay Lindsay signing off on another episode of Six Hundred Atlantic. Thanks for listening.