While the use of checks has declined in recent years, nearly two-thirds of organizations have experienced some type of check fraud activity, according to a report by Association of Financial Professionals (AFP). Suspicious activity reports for verification fraud at storage institutions more than tripled between 2018 and 2022, despite the declining prevalence of controls.

In the corporate setting, handling checks and payments is the most expensive asset diversion schemecosting an average loss of $155,000. Despite all this evidence that checks are risky, 75% of organizations surveyed by AFP do not plan to discontinue the use of checks. As such, conformity and risk management professionals must institute strong internal controls to protect their companies from check fraud.

Criminal appeal of checks

Paper checks have several vulnerabilities that allow fraudsters to exploit them.

• Physical nature: Criminals can easily steal and tamper with paper checks. FinCEN recently issued a alert about an increase in check fraud schemes related to mail theft. Thieves steal checks from mailboxes and collection boxes, then “wash” them to remove the ink, create counterfeit checks, or even sell the documents online.
• Lack of advanced security features: Checks lack the security features of electronic payments, including encryption, advanced authentication methods, and real-time verification. While digital transactions are subject to intense scrutiny, financial entities now accept paper checks and ask questions later.
• Processing time: complex banking system means that processing and clearing checks can take days. Fraudsters exploit this time to cash in and disappear before the bank detects the fraud.
• Insufficient details: Checks leave no digital money trail, making these payments difficult to trace. In addition, the corresponding bank statement records omit crucial details such as the source and ultimate recipient of the funds. Companies cannot verify the destination of the funds or determine the purpose of the payment just by examining the statement.
• Limited supervision: Companies process high volumes of transactions, and aligning checks and deposit slips with the appropriate statement is cumbersome and time-consuming. As a result, many lack controls for reconciling controls with accounting records. Poor oversight allows fraudsters to misdirect funds without detection.

How to spot check fraud

Association of Certified Fraud Examiners (ACFE) “Occupational Fraud 2024: Report to Nations” found that check and payment tampering schemes take an average of 18 months to be discovered, but proactive detection methods can significantly reduce the duration and accumulated losses. The following controls have demonstrated success in monitoring fraud.

• Reporting mechanisms: tips were the most common fraud detection tool, alerting business leaders to 43% of all cases. While employees accounted for about half of these tips, a third came from outside sources. To encourage tipping, business leaders should provide and publicize reporting mechanisms, including hotlines, email and web portals.
• Internal audits and management review: Reviewing financial records, procedures, and controls allows auditors and managers to identify irregularities that may indicate fraudulent activity, such as large check amounts or frequent checks written to an unknown recipient. According to the ACFE report, surprise audits reduced losses by 63%.
• Account Reconciliation: While this effort can be labor intensive, regular account reconciliation allows organizations to promptly discover discrepancies to limit losses.

Challenges in Fraud Investigation

Detecting potential fraud is one thing – proving it is another. Compliance teams lead the response to suspicious activity, which typically involves a detailed and time-consuming investigation.

Before forensic investigators and accountants can delve into analysis, they must sort, enter, verify, and reconcile data from hundreds or thousands of financial documents from multiple institutions, accounts, and time periods. Checks and deposit slips are particularly difficult to prepare because they are separate from the corresponding bank statements. Transactions and checks on the statement must be transcribed and matched. The challenge intensifies when a single deposit slip corresponds to multiple checks, creating a one-to-many relationship. Traditional spreadsheet-based methods struggle to effectively handle these situations.

Teams spend up to 90% of their allotted time investigating preparation and management the significant volume of complicated evidence, which can take weeks or even months. Companies often continue to incur fraud losses during this time, and the extended investigation timeline and associated expenses force companies to pursue only the most obvious and costly cases.

Forensic investigations generate extensive documentation, including detailed reports, spreadsheets, transaction logs, and audit trails. Compliance professionals must review and understand this dense and technical set to determine how the fraud occurred and then translate investigative findings into policy and process improvements.

Because the lengthy data preparation stage effectively prevents a thorough examination of each individual transaction, compliance teams may not be able to identify all points of failure, preventing them from mitigating all risks.

Additional controls to prevent fraud

The ideal scenario is complete fraud prevention. In addition to the strategies mentioned above, the following internal controls help compliance and risk management teams inhibit verification schemes.

• Separation of duties: No one person should control all aspects of the verification process. Separation of responsibilities increases oversight and prevents anyone from exploiting check vulnerabilities.
• Permissions: Instituting additional steps in check approval processes—such as requiring multiple signatures—adds another layer of security.
• Regular risk assessments: Compliance teams should regularly assess their internal controls for effectiveness, adjusting them as technology and organizational processes change.
• Routine and surprise audits: Conducting audits catches irregularities in financial records, but also deters fraud by increasing the threat of discovery.
• Education: Educate employees about the signs of check fraud and the importance of following internal controls. Educated employees are more likely to follow protocols and report suspicious activity.
• Positive salary system: In this system, the bank only honors checks that match a list of checks issued by the company, including check numbers, amounts, and payee names, helping to detect and reject unauthorized or altered checks.
• Automatic transaction monitoring: Less than half of organizations currently use proactive monitoring and analytics, but real-time monitoring will become a more accessible and effective method of detecting unusual activity.

While the use of checks is declining, the world is far from becoming a paperless financial system. As security around other transaction methods advances, physical checks will become more attractive to fraudsters. Unfortunately, it doesn’t take a criminal mastermind to exploit them. Organizations must improve and enforce internal fraud and compliance controls to counter this threat.