Preventing and Detecting Payment Tampering

Why This Topic Matters

Payment tampering (historically called check tampering in the ACFE Fraud Tree) is the fraudulent disbursement scheme in which the perpetrator physically or electronically prepares, intercepts, or alters an organization's outgoing payment instrument—a check, wire transfer, or ACH payment—and converts the funds for personal benefit. Although payment tampering is less frequent than billing or expense reimbursement fraud, the ACFE Report to the Nations consistently shows it carries one of the highest median losses of any asset misappropriation scheme and tends to last a long time before detection. The reason is simple: the fraudster is usually someone trusted with access to the payment process—a bookkeeper, controller, office manager, or even an authorized signer. Because the scheme attacks the payment instrument itself rather than hiding behind a false invoice, the controls that stop it are different from those used for billing schemes, and the CFE exam tests whether you understand that distinction.

For the CFE exam (Financial Transactions and Fraud Schemes section), you must be able to (1) recognize each subcategory of payment tampering, (2) match each scheme to the controls that prevent it, (3) identify the red flags and detection techniques that uncover it, and (4) choose the most effective control or detection method when several plausible options are offered.

What Payment Tampering Is

Payment tampering is distinguished from other fraudulent disbursement schemes by one defining feature: the perpetrator takes physical or electronic control of the payment instrument and makes it payable to themselves or an accomplice. In a billing scheme, the fraudster tricks the organization into issuing a legitimate-looking payment; in payment tampering, the fraudster manipulates the payment itself. The ACFE identifies five classic subcategories, each of which the exam expects you to know:

1. Forged maker schemes – The employee steals blank check stock (or gains access to the electronic payment system), prepares a payment to themselves or an accomplice, and forges the authorized signature or approval. Access to blank checks and signature authority is the vulnerability.
2. Forged endorsement schemes – The employee intercepts a check that was legitimately issued to a third party (vendor, customer refund, etc.), forges the payee's endorsement, and cashes or deposits it. Access to outgoing or returned checks is the vulnerability.
3. Altered payee schemes – The employee intercepts a legitimate check and changes the payee name (by erasing, 'washing,' or inserting a name) so it becomes payable to the employee. Variations include leaving the payee line blank when the check is signed, or writing a payee name that is easy to alter (e.g., changing 'A. Jones' to 'A. Jones Supply').
4. Concealed check schemes – The employee prepares a fraudulent check and slips it into a stack of legitimate checks presented to an authorized signer, who signs without reviewing supporting documentation.
5. Authorized maker schemes – The perpetrator is themselves an authorized signer who simply writes checks to themselves or pays personal expenses. This is the hardest to prevent because no forgery occurs; the control failure is one of oversight and review of the signer's activity.

In modern environments, the same logic applies to electronic payment tampering: creating unauthorized ACH or wire transfers, altering the bank account details of a legitimate vendor payment so funds route to the fraudster, or using stolen online banking credentials. The ACFE increasingly frames the topic as 'payment' rather than 'check' tampering for exactly this reason.

How Payment Tampering Works—and How Fraudsters Conceal It

To understand prevention and detection, you must understand concealment, because every control is designed to break a concealment method. Common concealment techniques include:

• The fraudster reconciles the bank account. This is the single most important enabler. If the same person who writes or has access to checks also receives the bank statement and performs the reconciliation, they can remove or destroy the canceled check, alter the check register, or force the reconciliation to balance.
• Re-altering the check after it clears. The payee name is changed back on the canceled check image or physical check, or the check register is coded to a legitimate vendor.
• Falsifying the disbursements journal. The fraudulent check is recorded as a payment to a real vendor or coded to an expense account unlikely to be scrutinized (e.g., miscellaneous, supplies).
• Reissuing intercepted checks. In forged endorsement schemes, the victim payee complains of non-payment; the fraudster claims the check was lost and issues a replacement, so the vendor is satisfied and the loss is buried.
• Voiding or miscoding checks. The stolen check is marked 'void' in the register while the physical check is actually cashed.
• Using out-of-sequence checks from the back of a checkbook or a dormant account so the theft is not noticed until much later.
• Changing vendor master file bank data (electronic version) so a legitimate payment lands in the fraudster's account, then changing it back.

Preventing Payment Tampering

The exam frames prevention around the principle that no single employee should be able to initiate, approve, execute, and record a payment. Key preventive controls include:

1. Segregation of duties. Separate the functions of check preparation, check signing, mailing/distribution, recording in the disbursements journal, and bank reconciliation. A person who prepares checks must never have signature authority or custody of signed checks, and must never perform the bank reconciliation.

2. Physical security of check stock and signature devices. Blank checks should be stored in a locked, access-restricted location; unused check stock should be periodically inventoried and accounted for by number. Signature plates, stamps, and electronic signature files must be secured separately from the check stock. Voided checks should be defaced and retained, not discarded.

3. Signature controls. Require two signatures on checks above a defined threshold; prohibit signing blank checks; require signers to review supporting documentation (invoice, purchase order, receiving report) before signing; cancel supporting documents (stamp 'PAID') so they cannot be reused; and never allow a signer to approve a payment to themselves.

4. Positive pay. The organization transmits to its bank a file of issued checks (check number, amount, and payee for 'payee positive pay'). The bank refuses or flags any presented check that does not match the file. Positive pay is widely regarded as the single most effective bank-based control against forged maker, altered payee, and counterfeit check schemes, and exam questions frequently point toward it as the best answer. The ACH equivalent is an ACH debit block or ACH filter, which restricts which parties may debit the account.

5. Independent bank reconciliation. Bank statements should be delivered unopened to—or accessed directly online by—someone with no check-writing, approval, or recording duties. The reconciler should examine canceled check images, not just totals.

6. Mailing and distribution controls. Signed checks should be mailed promptly by someone other than the preparer; returned or undeliverable checks should go to a person independent of accounts payable. For electronic payments, require dual authorization and independent verification (such as a call-back to a known phone number) before changing a vendor's bank account details.

7. Vendor and payee controls. Prohibit checks payable to 'Cash' or to bearer; require all payees to be in an approved vendor master file; restrict and log changes to vendor banking information; compare employee addresses and bank accounts to vendor records.

8. Personnel controls. Mandatory vacations and job rotation (many payment tampering schemes unravel when the fraudster is away and someone else opens the bank statement), background checks for positions with payment access, and a visible hotline.

9. Electronic access controls. Multifactor authentication for online banking, token-based approval, separate user IDs for initiating and releasing payments, dollar limits per user, and review of system access logs.

Detecting Payment Tampering

Detection focuses on examining the payment instruments themselves and the records surrounding them, because payment tampering leaves physical and documentary traces. Exam-relevant detection techniques include:

Reviewing canceled checks and check images. Look for:
• Dual endorsements (a vendor's name plus an employee's name) – the classic sign of a forged endorsement scheme.
• Endorsements that do not match the payee name or that are handwritten when the payee is a company that would normally use a stamp.
• Erasures, different ink or handwriting on the payee line, or payee names that look 'squeezed in' – signs of altered payee schemes.
• Signatures that differ from the authorized signer's known signature – forged maker.
• Checks payable to employees, to cash, or to unknown payees.
• Checks deposited into an account with the same bank or branch where an employee banks.

Examining the check register and disbursements journal. Look for gaps in the check sequence, out-of-sequence checks, an unusually high number of voided checks, checks recorded as void that cleared the bank, duplicate check numbers, checks with missing or vague payee information, and checks coded to unusual expense accounts.

Bank reconciliation review. Compare the bank statement to the check register for amounts, payees, and dates; investigate long-outstanding items, reconciling items that never clear, and adjustments made to force the reconciliation to balance. A reconciliation performed late or by the person who writes checks is itself a red flag.

Data analytics. Match employee master file data (names, addresses, bank account numbers) to vendor and payee records; identify payments just below approval thresholds; flag payees added and removed within a short period; flag vendor bank account changes shortly before payment; search for payees with no tax ID or a P.O. box address; test for Benford's Law anomalies in payment amounts.

Investigating customer and vendor complaints. Repeated vendor claims of non-payment that are resolved by 'reissuing' checks, or customers who insist a refund was never received, often expose forged endorsement schemes.

Surprise audits and check stock counts. Unannounced verification that all unused checks are accounted for.

Behavioral red flags. An employee who refuses vacation, insists on personally handling bank statements, works unusual hours, is defensive about the reconciliation, or displays a lifestyle inconsistent with income.

Matching Controls to Schemes (A Common Exam Pattern)

• Forged maker → secure blank check stock, secure signature devices, positive pay, independent reconciliation.
• Forged endorsement → segregate check preparation from mailing; route returned checks to someone independent; review canceled checks for dual endorsements.
• Altered payee → never sign checks with blank payee lines; use tamper-resistant check stock and full payee names; payee positive pay; review check images for alterations.
• Concealed check → signers must review supporting documentation for every check; cancel documents after payment; avoid rushed or batch signing.
• Authorized maker → dual signatures above thresholds, independent review of the authorized signer's payments by the board or an audit committee, and prohibiting self-approval.
• Electronic payment tampering → dual authorization, ACH blocks/filters, call-back verification of vendor bank changes, multifactor authentication, review of access logs.

Exam Tips: Answering Questions on Preventing and Detecting Payment Tampering

Tip 1 – First identify which subcategory the scenario describes. Ask: Did the fraudster create a payment from scratch (forged maker or authorized maker), or intercept a legitimate one (forged endorsement or altered payee)? Did an authorized signer sign unknowingly (concealed check)? The correct control or red flag almost always follows from this classification.

Tip 2 – Read carefully whether the question asks for prevention or detection. Positive pay, segregation of duties, secure check stock, and dual signatures are preventive. Reviewing canceled checks for dual endorsements, examining check register gaps, and independent bank reconciliation reviews are primarily detective. If the stem says 'most likely to uncover' or 'red flag,' it wants detection; if it says 'most effective in preventing' or 'reduce the risk,' it wants prevention.

Tip 3 – When asked for the 'most effective' or 'best' control, favor the one that directly breaks the fraudster's concealment. In most payment tampering scenarios, the critical enabler is the fraudster's control over the bank reconciliation or access to both check stock and signatures. Therefore segregation of duties and independent bank reconciliation are usually stronger answers than generic options like 'conduct ethics training' or 'increase audit frequency.' When a bank-based option is listed, positive pay is frequently the best answer for forged maker and altered payee schemes.

Tip 4 – Know the signature red flags. 'Dual endorsements' is the textbook indicator of a forged endorsement scheme; 'an endorsement that does not match the payee' points the same way. 'A check signed with the payee line blank' or 'different ink on the payee line' indicates an altered payee scheme. 'The authorized signer does not review supporting documents' indicates vulnerability to concealed check schemes.

Tip 5 – Remember that authorized maker schemes are not prevented by signature controls alone. Because the signer is legitimate, the exam expects answers such as dual signatures, independent review of the signer's disbursements, and removing the signer's ability to approve payments to themselves—not 'secure the check stock,' which would be irrelevant.

Tip 6 – Watch for distractors that address the wrong scheme. A question about forged endorsements will often list 'secure blank check stock' as a tempting option; it is wrong because the check was already legitimately issued. Likewise, 'require two signatures' does not stop a forged endorsement.

Tip 7 – Treat electronic and check-based payments with the same logic. If the scenario involves ACH or wire fraud, translate the controls: positive pay becomes ACH filters/debit blocks; locking the check stock becomes securing user credentials and tokens; dual signatures become dual authorization; and verifying vendor changes by call-back replaces payee verification on paper checks.

Tip 8 – Key phrases that signal payment tampering rather than another scheme. 'Intercepted a check,' 'forged the signature,' 'changed the payee,' 'check payable to cash,' 'checks missing from the back of the checkbook,' and 'reissued a lost check' all point to payment tampering. 'Submitted a false invoice' points to billing schemes instead, and 'inflated mileage' points to expense reimbursement—do not confuse them.

Tip 9 – Eliminate absolute or impractical options. Answers such as 'eliminate all check payments' or 'have the CEO sign every check personally' are rarely correct on the CFE exam. The exam rewards cost-effective, well-designed internal controls.

Tip 10 – Default to the ACFE's hierarchy when stuck. If you genuinely cannot decide, the ACFE materials place greatest emphasis on: (1) separating the bank reconciliation from check-writing and recording duties, (2) positive pay, (3) securing check stock and signature devices, and (4) reviewing canceled check images for endorsement and payee irregularities. An answer built on one of these four is more likely to be correct than one that is not.

Quick Review Summary

• Payment tampering = the fraudster controls the payment instrument itself; five subcategories: forged maker, forged endorsement, altered payee, concealed check, authorized maker (plus electronic variants).
• Highest-impact concealment enabler: the fraudster reconciles the bank account.
• Core prevention: segregation of duties, secure check stock and signatures, dual signatures, positive pay / ACH filters, independent reconciliation, controlled mailing, vendor master file controls, mandatory vacations.
• Core detection: canceled check image review (dual endorsements, altered payees, signature mismatches), check register gaps and voids, reconciliation anomalies, data analytics matching employees to payees, vendor non-payment complaints, surprise check stock counts.
• Exam strategy: classify the scheme, determine prevention versus detection, pick the control that breaks the specific concealment method, and avoid distractors aimed at a different scheme.