Payment Tampering Schemes

1. Why Payment Tampering Schemes Matter

Payment tampering (historically called check tampering on the ACFE Fraud Tree, and now broadened to include electronic payments) is one of the most damaging categories of fraudulent disbursement. In the ACFE's Report to the Nations, check and payment tampering consistently appears in roughly one in ten asset misappropriation cases, yet its median loss is among the highest of all disbursement schemes, often exceeding $100,000 per case. The reason is simple: the perpetrator is not tricking the organization into issuing a payment; the perpetrator directly controls the payment instrument itself. Because these schemes usually involve trusted employees with access to check stock, signature authority, or online banking credentials, they tend to run for years before discovery.

For the CFE exam, this topic is heavily tested in the Financial Transactions and Fraud Schemes section. Examiners expect you to (a) classify a described scheme into the correct sub-category, (b) distinguish payment tampering from billing, payroll, expense reimbursement and register disbursement schemes, (c) recognize concealment techniques and red flags, and (d) identify the most effective preventive and detective controls.

2. What Payment Tampering Is

Payment tampering is a form of fraudulent disbursement (a branch of asset misappropriation involving cash) in which an employee either:
• Prepares a fraudulent check or electronic payment for his or her own benefit, or
• Intercepts a legitimate payment intended for a third party and converts it.

The critical distinguishing feature: in all other fraudulent disbursement schemes (billing, payroll, expense reimbursement, register disbursements), the organization issues a payment that looks legitimate because the perpetrator submitted false documentation (a phony invoice, a ghost employee timecard, an inflated expense report). In a payment tampering scheme, the perpetrator physically prepares, forges, alters, or diverts the payment instrument itself. The fraud is in the instrument, not in the supporting documentation.

3. The Five Classic Check Tampering Categories

(a) Forged Maker Schemes
The employee signs a check as the maker without authority. This requires access to blank check stock (stolen from storage, taken from the back of a checkbook, or produced on company check stock the employee controls) and the ability to produce a passable signature of an authorized signer. Checks are usually made payable to the perpetrator, an accomplice, a shell company, or to 'cash.' Red flags: missing or out-of-sequence check numbers, checks drawn on accounts the employee should not access, signatures that differ from authorized signatures, and payees who are not approved vendors.

(b) Forged Endorsement Schemes
The employee intercepts a legitimately issued check payable to a third party (a vendor, a customer refund, an employee) and endorses it by forging the payee's signature, often adding a second endorsement (dual endorsement) in his or her own name so the bank will deposit it. Interception usually happens because the perpetrator is responsible for mailing checks, handles returned mail, or has access to outgoing checks awaiting signature or mailing. Red flags: dual endorsements on canceled checks, vendor complaints of non-payment, duplicate payments to the same vendor (the fraudster re-issues the legitimate payment after stealing the first).

(c) Altered Payee Schemes
The employee intercepts a legitimately issued check and changes the payee so it can be converted. Techniques include 'tacking on' letters to a payee name (changing 'A. Jones' to 'A. Jones Supply'), inserting the perpetrator's name in a blank payee line, erasing or chemically 'washing' the payee, or in some cases altering the amount as well. Altered payee schemes also include preparing a check with the payee left blank, obtaining an authorized signature, and filling in the payee later. Red flags: alterations visible on canceled check images, payee on the check image differing from the payee in the cash disbursements journal, and discrepancies between vendor records and bank records.

(d) Concealed Check Schemes
The employee prepares a fraudulent check (payable to himself, an accomplice, or a shell entity) and slips it into a stack of legitimate checks presented to an authorized signer who does not review them carefully. The signer, trusting the employee or pressed for time, signs everything. The scheme depends on the signer's negligence. Red flags: large batches of checks signed without supporting documents, signers who rubber-stamp, checks lacking vouchers or invoices.

(e) Authorized Maker Schemes
The employee has legitimate signature authority and uses it to write checks to himself, to pay personal expenses, or to pay accomplices. This is the hardest to prevent because there is no forgery and no alteration: the check is technically authentic. These schemes are common among owner-managers, controllers, office managers of small organizations, and anyone who both signs checks and controls the books. Red flags: a signer who also reconciles the bank account, override of controls, refusal to take vacation, checks payable to the signer or to unfamiliar vendors without support.

4. Electronic Payment Tampering

Because most disbursements are now ACH, wire, or card payments, the ACFE expanded this category to payment tampering. Electronic schemes include:
• Using stolen or shared online banking credentials to initiate unauthorized ACH or wire transfers.
• Altering vendor bank account numbers in the master file so legitimate payments route to the fraudster's account.
• Modifying payment batch files after approval but before transmission.
• Abusing authorized access (the electronic equivalent of an authorized maker) to send payments to personal accounts.
• Misusing company purchasing cards for personal purchases.
Electronic schemes are attractive because they leave no paper check to be intercepted and conversion is immediate. Controls include dual authorization for electronic payments, ACH debit blocks and filters, payee-match positive pay, dedicated hardened computers for online banking, multi-factor authentication, independent review of vendor master file changes, and daily review of bank activity.

5. How a Payment Tampering Scheme Works: The Life Cycle

Step 1 – Access. The fraudster obtains blank check stock, intercepts outgoing or returned checks, holds signing authority, or acquires online banking credentials.

Step 2 – Preparation or Diversion. The fraudster forges a maker signature, forges an endorsement, alters the payee, slips a check past a careless signer, signs as an authorized maker, or alters electronic payment details.

Step 3 – Conversion. The instrument is cashed or deposited. Checks may be made payable to the perpetrator, to 'cash,' to an accomplice, to a shell company with a similar-sounding vendor name, or to a personal creditor (paying one's own credit card or mortgage directly). Conversion of third-party checks typically requires a forged or dual endorsement.

Step 4 – Concealment. This is where exam questions concentrate. Common techniques include:
• The fraudster reconciles the bank statement. Lack of segregation of duties is the number one enabler.
• Forced reconciliation. Plugging the reconciliation so it balances, or falsifying the outstanding check list.
• Altering or destroying canceled checks and bank statements, or intercepting the statement before anyone independent sees it.
• Re-altering checks. After the altered check returns from the bank, changing the payee back to the legitimate vendor so it matches the disbursements journal.
• Falsifying the disbursements journal. Recording the fraudulent check as payable to a legitimate vendor, coding it to an expense account with high volume (supplies, miscellaneous, cost of goods sold), or recording it as 'void.'
• Miscoding. Charging the fraudulent disbursement to an account unlikely to be scrutinized.
• Re-issuing intercepted checks. In forged endorsement schemes, issuing a second payment to the vendor to quiet complaints, producing duplicate payments.
• Electronic concealment. Deleting or editing audit trails, changing vendor data back after payment, or timing changes between review cycles.

6. Red Flags Summary

• Voided checks missing from files or voided in unusual numbers.
• Missing, duplicate, or out-of-sequence check numbers.
• Checks payable to cash, to employees (other than payroll), or to unfamiliar vendors.
• Dual endorsements or endorsements not matching the payee.
• Alterations visible on check images; payee on image differs from the journal.
• Bank reconciliations that are late, unsupported, or prepared by the same person who writes or signs checks.
• Unexplained reconciling items or increasing 'plug' adjustments.
• Vendor complaints of non-payment despite recorded payments; duplicate payments.
• Changes to vendor bank account details shortly before a large payment.
• Employees who refuse vacations, work odd hours, or insist on handling bank correspondence personally.
• Signers who sign stacks of checks without reviewing supporting documents.

7. Prevention and Detection Controls

Prevention
• Segregation of duties: custody of check stock, check preparation, check signing, mailing, posting to the ledger, and bank reconciliation should be performed by different people.
• Secure physical storage of blank check stock and signature plates; log and periodically count check stock.
• Require supporting documentation for every check before signing; prohibit signing blank checks; use dual signatures above a threshold.
• Prohibit checks payable to 'cash' or to bearer.
• Rotate duties and enforce mandatory vacations.
• Bank statements sent unopened to (or accessed online directly by) someone independent of disbursements.
• Positive pay and payee-match positive pay: the bank pays only checks matching the issued file by number, amount, and payee.
• ACH debit blocks and filters, dual authorization for wires and ACH, multi-factor authentication, dedicated banking workstation.
• Independent approval and verification (call-back to a known number) of any change to vendor bank account information.

Detection
• Independent, timely bank reconciliations with review of canceled check images, including endorsements.
• Cutoff bank statements requested directly from the bank by auditors.
• Review of voided checks and gaps in the check sequence.
• Data analytics: checks to employees, round-dollar amounts, payee names resembling vendors, duplicate invoice or payment amounts, payments to vendors with employee addresses or bank accounts.
• Vendor confirmations and investigation of non-payment complaints.
• Review of expense accounts for unusual coding and increases without business explanation.
• Surprise audits and a well-publicized hotline (tips remain the most common detection method).

8. Exam Tips: Answering Questions on Payment Tampering Schemes

Tip 1 – Classify by asking two questions. First: Is the fraud in the instrument itself or in the supporting documentation? If the employee submitted a fake invoice and the company issued a genuine check, it is a billing scheme, not payment tampering, even though a check was involved. Second: What did the perpetrator do to the instrument? Signed it without authority = forged maker. Signed with legitimate authority = authorized maker. Forged the payee's endorsement on an intercepted check = forged endorsement. Changed the payee name = altered payee. Slipped it past a negligent signer = concealed check.

Tip 2 – Watch for signature authority. The single most common trap is forged maker vs. authorized maker. If the fact pattern says the controller 'has signature authority' or 'is an authorized signer,' the answer is authorized maker, no matter how blatant the theft. If a clerk 'signs the CFO's name,' it is forged maker.

Tip 3 – Dual endorsements point to forged endorsement. Whenever a question mentions a second endorsement, a vendor claiming non-payment, or an employee who handles outgoing mail stealing checks, think forged endorsement. If the question says the payee name was changed, washed, or 'tacked on,' think altered payee.

Tip 4 – Concealed check vs. authorized maker. Both involve a fraudulent check that is genuinely signed. The difference is who signs: in a concealed check scheme a legitimate signer is deceived into signing; in an authorized maker scheme the fraudster is the signer.

Tip 5 – 'Most effective control' questions. When asked for the best preventive control, look for segregation of duties, especially separating check signing/preparation from bank reconciliation, or positive pay. When asked for the best detective control, look for independent bank reconciliation with review of check images and endorsements, or a cutoff statement obtained directly from the bank. For authorized maker schemes, remember that forgery controls are useless; the answer is segregation, dual signatures, independent reconciliation, and oversight (board or owner review).

Tip 6 – Concealment questions. If the question describes a fraudster changing an altered payee back to the original name after the check returns, that is re-altering. If it describes a reconciliation forced to balance with fictitious items, that is forced reconciliation. If a fraudulent check is recorded as 'void' or charged to a high-volume expense account, that is falsifying the disbursements journal / miscoding.

Tip 7 – Electronic payments. Expect questions framed around ACH and wires. Map them to the same logic: unauthorized transfer using stolen credentials is analogous to forged maker; changing a vendor's bank account to divert a legitimate payment is analogous to altered payee; an authorized user sending funds to a personal account is analogous to authorized maker. Controls to remember: dual authorization, ACH blocks/filters, payee-match positive pay, verified call-backs for bank account changes.

Tip 8 – Eliminate distractors systematically. Many wrong answers are other fraudulent disbursement categories (billing, payroll, expense reimbursement, register disbursement) or other cash schemes (skimming, cash larceny). Remember: skimming is off-book theft of incoming cash; cash larceny is theft of recorded incoming cash; payment tampering is theft via outgoing payment instruments. Keeping the Fraud Tree structure in mind (Asset Misappropriation → Cash → Fraudulent Disbursements → Payment Tampering → five sub-types) will help you discard distractors quickly.

Tip 9 – Read the fact pattern to the end. Exam scenarios often describe a legitimate check being issued first, and the fraud occurring afterward. The classification depends on the last act the perpetrator performed on the instrument, not on how the check originated.

Quick Reference
• Forged maker – fraudster signs without authority.
• Forged endorsement – fraudster intercepts and forges payee's endorsement (look for dual endorsements).
• Altered payee – fraudster changes the payee on an intercepted or blank-payee check.
• Concealed check – fraudster hides a bad check in a stack for a careless authorized signer.
• Authorized maker – fraudster has signing authority and abuses it (hardest to prevent).
• Electronic payment tampering – unauthorized or diverted ACH/wire/card payments.
• Key enabler – lack of segregation of duties, especially the fraudster reconciling the bank account.
• Key controls – segregation of duties, positive pay, independent reconciliation, dual authorization, secured check stock, vendor master file change verification.

Master these distinctions, practice classifying short scenarios, and tie every control answer back to the specific weakness that each sub-scheme exploits. That approach will let you answer payment tampering questions on the CFE exam quickly and confidently.