FinCEN Alert on Mail Theft & Check Fraud

If it seems like you’ve been seeing more and more instances of check fraud, you’re not alone. According to FinCEN, since the start of the COVID-19 pandemic fraudsters have stepped up their activity in check fraud. Approximately 350,000 SARs were filed related to check fraud in 2021, which was a 23% increase over check fraud SAR filings in 2020. The numbers in 2022 were even worse, with more than 680,000 check fraud SARs being filed, nearly double the number of 2021. Combined with these troubling statistics, during this period the United States Postal Service (USPS) received nearly 300,000 complaints of stolen mail, an increase of 161% from pre-pandemic times. In response to these increasing check fraud numbers, FinCEN has issued an alert to help financial institutions take action.

FinCEN issued the alert in collaboration with the USPS Inspection Service to ensure that SARs filed by financial institutions appropriately identify and report suspected check fraud schemes that may be linked to mail theft in the U.S. FinCEN indicates that financial institutions should reference the related alert in SAR field 2 (Filing Institution Note to FinCEN) and the narrative by including the key term “FIN-2023-MAILTHEFT.” Institutions should also mark the check box for check fraud (SAR Field 34(d)).

FinCEN advises that those committing mail theft-related check fraud generally target personal checks, business checks, tax refund checks, and government assistance checks, such as those for unemployment benefits. Although several types of checks are at risk, business checks may be more valuable to fraudsters because business accounts are often well-funded, and it often take much longer for the fraud to be discovered.

After stealing checks from the mail, fraudsters may alter the checks by 1) replacing the payee information with fraudulent information or with business accounts that the fraudsters control, or 2) increasing the dollar amount on the check. Altered checks may also be sold to other fraudsters, often in exchange for virtual currency.

Altered checks may also be counterfeited using routing and account numbers from the original check. Altered checks may show up anywhere at any time. They might be presented to be cashed, deposited checks in person, deposited at ATMs, or deposited via remote deposit into accounts controlled by fraudsters. Normally, once these altered checks are deposited, the funds are often quickly withdrawn through ATMs or wire transfers. Fraudsters may even further exploit the victims by using stolen personal information to engage in other fraud schemes.

The FinCEN alert has a list of ten red flags to help financial institutions detect, prevent, and report suspicious activity connected to mail theft-related check fraud:

  1. Uncharacteristic large withdrawals on a customer’s account via check to a new payee.
  2. Customer complains of a check stolen from the mail and then deposited into an unknown account.
  3. Customer complains that a check they mailed was never received by the intended recipient.
  4. Checks used to withdraw funds from a customer’s account appear to be of a noticeably different check stock than check stock used by the issuing bank and check stock used for known, legitimate transactions.
  5. Existing customer with no history of check deposits suddenly has check deposits and withdrawal or transfer of funds.
  6. Uncharacteristic, sudden, abnormal deposit of checks followed by rapid withdrawal or transfer of funds.
  7. Suspect checks determined to have faded handwriting underneath darker handwriting, giving the appearance that the original handwriting has been overwritten.
  8. Suspect accounts may have indicators of other suspicious activity, such as pandemic-related fraud.
  9. A new customer opens an account that seems to only be used for depositing checks followed by frequent withdrawals and transfer of funds.
  10. A non-customer that is attempting to cash a large check or multiple large checks in-person and, when questioned, provides an explanation that is suspicious.

No single red flag is determinative, but the facts and circumstances surrounding the transaction can help determine whether to suspect fraud. As always, if you have any questions about check fraud, red flags, or suspicious activity you can always reach out to us on the hotline for help.