Even in an era dominated by mobile apps, instant transfers, and digital wallets, check fraud stubbornly endures. It’s easy to assume paper checks are a relic of the past, but in many sectors—government disbursements, large-volume payrolls, vendor payments—they’re still in active use. And where checks linger, so do the risks.
At the heart of the problem is a simple truth: checks are physical documents. That means they can be intercepted, copied, manipulated, or simply stolen in transit. For organizations still issuing thousands of checks each month, this creates a broad—and often overlooked—attack surface. It’s not just small businesses that face this threat. Public agencies, financial institutions, and even Fortune 500 companies continue to cut paper checks in ways that can expose them to fraud if internal controls aren’t airtight.
One of the more common schemes is old-fashioned mail interception—sometimes quaintly dubbed “mailbox fishing.” With tools ranging from homemade devices to stolen USPS arrow keys, criminals pull envelopes from drop boxes and sift through them for checks. Once in hand, the opportunities branch out.
Some checks are “washed”—a process where solvents like acetone or alcohol erase ink while leaving the paper intact. The fraudster then rewrites the check, changing the payee and jacking up the amount. Others are used as templates. Account and routing numbers are harvested, then fed into printers to produce near-perfect replicas. These clones, paired with fake IDs, are used to cash in at banks or through mobile apps. Sometimes, even if the check itself isn’t used, the exposed banking details are enough to initiate unauthorized ACH withdrawals.
The financial fallout from this kind of fraud can be massive. A single washed check might cost a few hundred dollars. But in high-volume environments, where reconciliation lags and oversight is dispersed, undetected fraud can spiral into tens—or even hundreds—of thousands in losses. Often, the issue surfaces only after a customer complains or during a delayed audit, when the recovery window has already closed.
Certain red flags tend to pop up. Duplicate check numbers, unusual payee names, discrepancies between issue and deposit locations—these are all warning signs. If several customers report not receiving mailed checks within a reasonable timeframe, mail theft should be a real consideration, not an afterthought.
So how do you shrink the target? First, reduce reliance on physical checks whenever possible. Digital alternatives like ACH transfers, RTP (Real-Time Payments), Zelle for Business, and wires offer faster, traceable, and more secure options. Many enterprise platforms can automate disbursements and embed authorization layers into the process. If a check must be used, don’t cut corners: implement features like microprinting, watermarks, heat-reactive inks, and secure templates. Handwritten checks or those generated outside of vetted systems introduce unnecessary exposure.
Mail handling is another critical point. Outdoor USPS boxes may be convenient, but they’re vulnerable. Use indoor locations or direct handoffs whenever possible. For high-value checks, consider tracking deliveries or requiring delivery confirmations. Positive pay—where banks validate each check against a pre-approved issue list—should be non-negotiable for any sizable operation.
Education is often overlooked but is essential. Train employees on how check fraud happens and what to watch for. Make sure clients know their role, too—especially when checks are delayed or lost. They should understand how to report a problem and what to do next.
There’s a broader model worth examining: the European Union. By moving nearly all payments to fully digital platforms—SEPA transfers, mobile apps, and centralized networks—they’ve virtually eliminated check fraud. Paper checks are now rare, and so are the losses tied to them.
If fraud is suspected, time is of the essence. Freeze the affected account. File a police report. Notify the U.S. Postal Inspection Service if mail theft is suspected. Monitor all impacted accounts aggressively, and consider enabling daily review protocols or outbound check verification until the situation stabilizes.
Checks may be disappearing, but they’re not gone—and as long as they’re used, the risks won’t fade. For organizations that still issue them, the challenge isn’t just legacy systems—it’s legacy threats that haven’t gone away. Proactive oversight is no longer optional. It’s the only thing standing between a routine disbursement and a five-figure theft.
