Our office recently encountered a check-fraud situation involving one of our clients. The original check was prepared, signed and mailed locally. When the check image was reviewed on the bank statement later, the check that had cleared the client's account had been altered.
We can't say where or when the check was compromised, and we don't want to speculate. But we can say that the check itself had been altered. That makes this a good time to talk about check washing and, more importantly, the controls businesses can put in place to help protect themselves.
What is check washing?
Check washing is when someone steals a legitimate check and changes the information on it. The payee is commonly changed, and the dollar amount may be changed as well.
The United States Postal Inspection Service warns that criminals may use chemicals to remove ink from stolen checks. They may also use scanners or copiers to create fraudulent copies.
One of the challenges is that the fraud may not be obvious when you review your bank activity.
For example, a check you actually wrote may clear for the correct amount and check number. At a quick glance, everything looks right. But if the payee was altered, the money didn't go where you intended.
That's why reviewing the transaction alone isn't always enough.
Don't just review the amount. Look at the check.
When reviewing your bank activity, periodically open the images of your cleared checks rather than looking only at the transaction list.
Check the:
Payee: Is it the person or business you intended to pay?
Amount: Does it match what you authorized?
Check number: Does it match your accounting records?
Endorsement: If the back of the check is available, does the endorsement appear consistent with the intended payee?
The United States Postal Inspection Service specifically recommends reviewing paid check images, including the endorsement information on the back when available.
This is especially important for businesses that use bank feeds in their accounting software. A downloaded transaction tells you what cleared the bank. Reviewing the check image helps you verify that it is what you actually authorized.
Ask your bank about Positive Pay.
If your business regularly issues paper checks, ask your bank about Positive Pay.
Positive Pay adds another control to the check-writing process. The bank compares checks presented for payment with information about the checks your business has issued. A check that doesn't match can be flagged for review.
Each bank's service may be different, so ask:
What information does the bank require?
How are exceptions handled?
How quickly do you need to review an exception?
Is there a fee for the service?
For businesses that write a meaningful number of checks, it's worth having the conversation.
Be thoughtful about how checks are mailed.
Sometimes a paper check is still the most practical payment method. If you need to mail one, a few precautions can help.
The United States Postal Inspection Service recommends:
Using the letter slots inside a Post Office to mail checks.
If using a collection box, depositing mail before the last scheduled pickup rather than leaving it there for an extended period.
Using indelible black ink when writing checks.
Avoiding blank spaces in the payee and amount lines.
None of these steps can completely eliminate the risk of fraud, but they are simple precautions to add to your normal process.
Consider electronic payments when appropriate.
Reducing the number of paper checks you mail can also reduce your exposure to check washing.
The United States Postal Inspection Service recommends considering options such as e-checks, ACH automatic payments, and other electronic or mobile payments.
That doesn't mean electronic payments are risk-free. They require their own controls, particularly around protecting banking information and verifying payment instructions.
But it may be worth looking at vendors you regularly pay by check and asking: Does this still need to be a paper check?
Review your bank activity frequently.
Don't wait until the monthly bank reconciliation to take a close look at your account.
Regular monitoring gives you a better chance of catching unusual activity quickly.
And remember, there are really two different things to review:
The transaction: Is this a payment we expected?
The check: Does the cleared check match what we actually issued?
If something doesn't look right, pull up the check image.
What should you do if you find an altered check?
If a cleared check doesn't match the check you issued, act quickly.
Contact your bank immediately and report the altered check.
File a police report with your local police department.
If the check was mailed, report it to the U.S. Postal Inspection Service. The Postal Inspection Service specifically recommends reporting check-washing incidents to both local police and its agency.
Keep your records. Save a copy of the altered check along with your records showing the original payee, amount, check number and date.
Document the mailing details. If the check was mailed, note how, when and where it was mailed. The Postal Inspection Service says these details can help determine where the check may have been compromised.
The most important thing is not to wait. Contacting your bank promptly gives it an opportunity to begin addressing the fraudulent transaction, while the police and Postal Inspection Service reports create a record of the fraud.
A good time to review your banking controls.
We aren't sharing this to cause alarm or to suggest that businesses should stop using checks.
It's simply a reminder that fraud prevention works best when you have more than one control in place.
For a business that issues checks, those controls might include:
Monitoring bank activity regularly
Reviewing actual check images
Reconciling bank accounts promptly
Using Positive Pay, when available and appropriate
Taking precautions when mailing checks
Using electronic payments when they make sense
Responding quickly when something doesn't look right
The situation we encountered was caught because someone looked at the check image rather than just the transaction.
That's a simple control, but in this case, it made all the difference.
Good accounting isn't only about accurately recording what happened. Good financial controls can also help you identify when something happened that shouldn't have.