Check and Electronic Funds Transfer Fraud

Why This Topic Matters

Payment fraud is one of the most heavily tested areas within the Financial Transactions and Fraud Schemes section of the Certified Fraud Examiner (CFE) exam. Checks and electronic funds transfers (EFTs) remain the primary ways that money moves between businesses, consumers, and financial institutions, which makes them prime targets for both external criminals and dishonest insiders. According to industry surveys referenced in the Fraud Examiners Manual, checks continue to be the payment method most frequently targeted by fraudsters, while wire transfer and ACH fraud losses have grown sharply because of business email compromise and account takeover schemes. A fraud examiner must be able to recognize these schemes, understand how they are executed, identify red flags, recommend controls, and understand the basic allocation of liability between parties. On the exam, you will be expected to distinguish between closely related terms, identify the correct preventive control for a given scheme, and apply the material to short fact patterns.

What Is Check Fraud?

Check fraud is any scheme in which a check or check-like instrument is used to steal money or obtain goods and services without proper authorization or payment. The Fraud Examiners Manual groups check schemes into several recognizable categories:

1. Counterfeit checks. Entirely fabricated checks created with desktop publishing software, scanners, high-quality printers, and blank check stock. Counterfeiters often obtain a legitimate check from the victim account to copy the account number, routing number, logo, and signature. Counterfeit checks are frequently used in advance-fee, overpayment, secret shopper, and lottery scams in which the victim deposits a fake check and wires back the excess before the check is returned.

2. Forged maker signature. A genuine check belonging to the account holder is stolen (from the mail, a checkbook, an office, or a trash bin) and the fraudster signs the account holder's name. Within occupational fraud, this is one of the five check tampering subcategories.

3. Forged endorsement. The fraudster intercepts a check made payable to another party and forges that payee's endorsement in order to cash or deposit it. In an occupational setting, an employee may intercept outgoing vendor checks or incoming customer payments.

4. Altered checks. A legitimately issued check is changed after it is signed. Common alterations include raising the amount (changing 100 to 1,000) or changing the payee name. Check washing is a specific alteration technique in which chemicals such as acetone, bleach, or brake fluid are used to erase handwritten ink while preserving the preprinted information and signature, allowing the criminal to rewrite the payee and amount. Washed checks are usually obtained by stealing mail from residential mailboxes or postal collection boxes.

5. Check kiting. A scheme that exploits the float, the time between when a check is deposited and when it actually clears the paying bank. The kiter opens accounts at two or more banks, writes a check from Bank A with insufficient funds and deposits it in Bank B, then draws against the provisional credit at Bank B before the check is returned, covering the shortfall in Bank A with a check from Bank B, and so on. The scheme creates the illusion of balances that do not exist and is essentially an unauthorized, interest-free loan from the banks. Kites collapse when a bank places holds or when the kiter can no longer keep the cycle going, leaving one bank with the loss. Faster clearing under Check 21 image exchange has shortened the float and made kiting harder, but it still occurs, especially with remote deposit capture.

6. Paperhanging. Deliberately writing checks on accounts that are closed or that the writer knows have insufficient funds (NSF). Unlike kiting, paperhanging does not involve circulating checks among multiple accounts; the fraudster simply issues bad checks to merchants or individuals and disappears.

7. Stolen or lost checks and check stock. Theft of blank check stock, company checkbooks, or payroll checks, which are then completed or counterfeited. Organizations that leave check stock unsecured are especially vulnerable.

8. Demand drafts and remotely created checks. Instruments created by a payee rather than the account holder, bearing a statement such as authorized by drawer instead of a signature. Telemarketing fraudsters use them to debit victims' accounts after obtaining account numbers over the phone.

9. Remote deposit capture (RDC) abuse and duplicate presentment. A check is deposited through a mobile banking app and then also cashed or deposited elsewhere, so the same item is paid twice. Fraudsters also deposit altered or counterfeit images that are harder for tellers to scrutinize.

Occupational Check Tampering

The CFE exam frequently frames check fraud within the occupational fraud tree, where check tampering is a form of fraudulent disbursement. The five recognized check tampering schemes are: forged maker (employee signs the company check), forged endorsement (employee intercepts a check payable to a third party and endorses it), altered payee (employee changes the payee on a legitimately signed check, often by inserting their own name or a shell company, or by exploiting a check written to cash), concealed check (employee slips a fraudulent check among legitimate ones for an authorized signer who signs without reviewing), and authorized maker (an employee with signature authority writes checks for personal benefit). Concealment methods include forging the bank statement, altering the returned check or image, re-altering the payee back to the original on the canceled item, miscoding checks in the disbursements journal, and recording fake expenses. Remember that check tampering is distinct from billing schemes because in check tampering the employee physically prepares or alters the check, whereas in a billing scheme the employee causes the organization to issue a check through its normal payment process.

What Is Electronic Funds Transfer Fraud?

EFT fraud involves the unauthorized or fraudulent movement of funds through electronic channels. Key types include:

1. ACH fraud. The Automated Clearing House network processes batch payments such as direct deposit and bill payments. Fraudsters commit ACH debit fraud by obtaining a victim's routing and account numbers and initiating unauthorized debits, often through a complicit or careless originator. ACH credit fraud occurs when a fraudster, often after taking over an online banking account or compromising a payroll system, redirects outgoing credits (such as employee direct deposits or vendor payments) to accounts they control. Consumers generally have 60 days to dispute unauthorized ACH debits under Regulation E in the United States, while businesses often have far shorter windows, frequently only one or two business days under the NACHA rules and bank agreements, making business ACH fraud particularly damaging.

2. Wire transfer fraud. Wires are fast, high-value, and essentially irrevocable once received, which makes them the weapon of choice for sophisticated criminals. The dominant modern form is business email compromise (BEC), in which an attacker spoofs or hijacks an executive's or vendor's email account and instructs accounts payable staff to urgently wire funds to a new account. Variants include CEO fraud, vendor impersonation with changed banking instructions, real estate closing fraud targeting escrow funds, and payroll diversion. Insiders with wire authority may also initiate fraudulent wires, sometimes using bogus supporting documents. Social engineering, urgency, secrecy, and requests to bypass normal procedures are classic hallmarks.

3. Account takeover and online banking fraud. Criminals gain access to online banking credentials through phishing, vishing (voice phishing), smishing (SMS phishing), keylogging malware, credential stuffing, SIM swapping, and man-in-the-middle or man-in-the-browser attacks. Once inside, they add new payees, change contact information to intercept alerts, and move funds out by wire, ACH, or peer-to-peer payment apps.

4. Debit card and ATM fraud. Card skimming at ATMs and point-of-sale terminals, shimming of chip cards, card-not-present fraud, and PIN capture via hidden cameras. Debit card fraud affects the victim's actual bank balance rather than a credit line, which can be more disruptive.

5. Peer-to-peer (P2P) and real-time payment fraud. Scams using instant payment platforms where victims are tricked into sending funds that cannot be recovered, as well as unauthorized transfers from compromised accounts.

6. Electronic payment system manipulation by insiders. Employees with access to payment systems may create fictitious vendors with their own bank details, alter legitimate vendor banking information, or initiate transfers just below approval thresholds.

How These Schemes Work: The Mechanics Fraud Examiners Must Understand

Float exploitation. Kiting depends on the gap between provisional credit and final settlement. Banks that extend immediate availability on deposited checks give kiters the opportunity to withdraw funds before discovering the deposited item is worthless.

Information harvesting. Most check and EFT fraud begins with obtaining account data. A single check reveals the routing number, account number, name, address, and signature, which is why mail theft is so lucrative. Data breaches, phishing, and social engineering serve the same purpose for electronic accounts.

Exploiting weak verification. Banks process enormous volumes of checks and transfers; signatures are rarely examined on low-value items, and image-based processing means tellers never handle the original. Wire fraud via BEC works because employees trust email and fail to verify new payment instructions through an independent channel.

Speed and irrevocability. Wires and real-time payments settle quickly, and the funds are usually moved again through mule accounts within hours, often internationally, before the victim notices.

Red Flags of Check Fraud

Indicators of a kite include frequent deposits and withdrawals of similar amounts, many deposits of checks drawn on the same account at another bank, large deposits made on Fridays or before holidays to maximize float, a rising average balance without corresponding business growth, frequent balance inquiries, repeated use of the same banks in a circular pattern, and checks that are consistently deposited just before earlier ones clear. For altered or counterfeit checks, look for mismatched fonts, missing perforations, smudged or discolored areas, misaligned MICR lines, routing numbers that do not match the bank's location, check numbers that are low (suggesting a new account), absence of security features, and payee names written in a different hand or ink than the rest of the check. In an occupational setting, red flags include missing or out-of-sequence checks, checks payable to cash or to employees, duplicate payee names with slight variations, canceled checks with dual endorsements, altered bank statements, delayed or employee-controlled bank reconciliations, and vendors whose addresses match employee addresses.

Red Flags of EFT Fraud

Unexpected changes to vendor banking instructions received by email, urgent transfer requests from executives who are supposedly traveling and unreachable, requests to keep a transaction confidential, email addresses with subtle misspellings or look-alike domains, transfers to new beneficiaries or foreign jurisdictions inconsistent with business history, transfers just under approval limits, logins from unusual locations or devices, changes to account contact information followed by transfers, and employees receiving no direct deposit because payroll details were changed.

Prevention and Detection Controls

Positive pay is the single most important check fraud control and is heavily tested. Under positive pay, the company transmits a file of issued checks (check number, amount, and date) to the bank; the bank compares presented checks against the file and reports any exceptions for the company to accept or reject. Payee positive pay adds the payee name to the match, defeating altered payee schemes. Reverse positive pay shifts the matching burden to the company, which reviews the bank's daily list of presented items and must reject unauthorized ones within a short deadline. ACH blocks prohibit all ACH debits on an account, while ACH filters permit only debits from pre-approved originators or within set limits. ACH positive pay alerts the company to unauthorized debit attempts for approval.

Additional controls include secure storage of blank check stock and signature plates, check stock with security features (watermarks, microprinting, chemical-reactive paper, void pantographs, heat-sensitive ink, warning bands), prompt and independent bank reconciliations by someone with no check-writing or recording authority, dual signatures above a threshold, prohibiting checks payable to cash, mandatory vacations and job rotation, reviewing canceled check images for dual endorsements or altered payees, and converting vendor payments from checks to secured electronic payments where feasible. Banks mitigate kiting through hold policies, kite detection software that monitors deposit and withdrawal patterns, and Know Your Customer procedures.

For EFT fraud: independent callback verification to a known phone number (never one supplied in the email) before processing any new or changed payment instructions, dual control requiring one person to initiate and another to approve transfers, transaction and daily limits, multi-factor authentication, out-of-band authentication tokens, dedicated computers for online banking, timely review of account activity with same-day alerts, employee training on phishing and BEC, written vendor change procedures, segregation of duties over vendor master file maintenance, and rapid response plans so that banks can attempt a recall or freeze of fraudulent wires within hours.

Liability and Legal Framework (Conceptual Overview)

Although the CFE exam is international, you should understand general principles that appear in the manual. Under the Uniform Commercial Code in the United States, a bank may generally only pay checks that are properly payable; a check with a forged drawer signature is not properly payable, so the paying (drawee) bank typically bears the loss unless the customer's negligence contributed or the customer failed to review statements and report in a timely manner. For a forged endorsement, liability generally flows back to the depository bank that accepted the item under the warranty chain. Customers have a duty of ordinary care, and businesses that decline positive pay may be held responsible for resulting losses under their account agreements. The Check Clearing for the 21st Century Act (Check 21) permits banks to truncate paper checks and exchange images, creating substitute checks. Electronic consumer transfers are governed by Regulation E, which limits consumer liability for unauthorized transfers if reported promptly, while commercial wire and ACH transfers fall under UCC Article 4A and NACHA rules, under which a bank that follows commercially reasonable security procedures agreed to by the customer may shift losses to the business customer.

Investigating Check and EFT Fraud

A fraud examiner should obtain canceled check images (front and back), bank statements, deposit slips, wire and ACH transaction records, online banking access logs with IP addresses and device identifiers, email headers in suspected BEC cases, vendor master file change logs, and signature cards. Trace endorsements and deposit account information to identify the beneficiary, compare handwriting on altered items, reconcile the check register to cleared items to find out-of-sequence or missing checks, and analyze deposit timing across multiple banks to detect kiting patterns. Contact receiving banks quickly to request recalls and freezes, and involve law enforcement for mule account identification and subpoenas.

Exam Tips: Answering Questions on Check and Electronic Funds Transfer Fraud

Tip 1: Master the vocabulary and the distinctions. Many questions hinge on recognizing the precise term. Kiting uses the float across multiple accounts; paperhanging is simply writing bad checks with no intent to cover them; check washing is chemical alteration of a genuine check; a counterfeit check is fabricated from scratch; a demand draft is created by the payee without a signature. If the fact pattern describes circular deposits between banks with withdrawals against uncollected funds, the answer is kiting.

Tip 2: Know the five check tampering schemes cold. Be able to classify a scenario as forged maker, forged endorsement, altered payee, concealed check, or authorized maker, and remember that check tampering falls under fraudulent disbursements in the occupational fraud tree. Watch for the difference between a billing scheme (the company willingly issues a check based on a false invoice) and check tampering (the employee personally prepares, forges, or alters the check).

Tip 3: Match the control to the scheme. The exam loves asking which control best addresses a described risk. Altered amounts or counterfeit checks drawn on the account: positive pay. Altered payee names: payee positive pay. Unauthorized ACH debits: ACH block or filter. Fraudulent vendor banking changes and BEC: independent callback verification and dual control. Kiting: deposit holds and kite detection monitoring. Employee check tampering: segregation of duties and independent bank reconciliation. If an answer choice names a control that does not actually touch the mechanism of the scheme, eliminate it.

Tip 4: Recognize red flag lists. Questions may present several indicators and ask which is NOT a red flag of a particular scheme, or which scheme the indicators suggest. Memorize the kiting indicators (frequent same-amount deposits and withdrawals, Friday deposits, many balance inquiries, deposits of checks drawn on the same account at another bank) and the BEC indicators (urgency, secrecy, changed bank details, look-alike domains, executive supposedly unavailable).

Tip 5: Understand why wires are different. Wires are fast, high-value, and essentially irrevocable, and businesses usually have little dispute protection. If a question asks why BEC is so damaging or why speed of response matters, the answer relates to irrevocability and the rapid movement of funds through mule accounts.

Tip 6: Remember the general liability principles. A forged maker signature is generally the paying bank's loss; a forged endorsement generally falls on the depository bank; customers who fail to examine statements promptly or who refuse reasonable security procedures like positive pay may shift the loss to themselves. Consumers enjoy greater protection for unauthorized electronic transfers than businesses do.

Tip 7: Read the question stem carefully for the words EXCEPT, NOT, and MOST. ACFE questions frequently ask for the best or most effective control, meaning several options may be partially correct. Choose the one that most directly prevents the described scheme. Also watch for true/false statements that are mostly correct but contain one wrong detail, such as stating that positive pay matches the payee name (that is payee positive pay, not standard positive pay).

Tip 8: Think like the Fraud Examiners Manual. When unsure, choose the answer that reflects the manual's emphasis on segregation of duties, independent verification, timely reconciliation, and bank-offered services like positive pay. Avoid answers that rely on a single person's honesty or on controls that occur only after the loss has become unrecoverable.

Tip 9: Practice with mini scenarios. For example: An accounts payable clerk receives an email from the company's largest vendor stating that its bank account has changed and asks that the next payment be wired to the new account. Which control would most likely have prevented the loss? The correct response is a callback to the vendor using a phone number from the existing vendor master file, not the email, to verify the change. Another example: A bank notices a customer depositing checks drawn on his account at another bank almost daily, withdrawing similar amounts, and asking about his balance frequently. This describes check kiting, and the appropriate response is to place holds on deposited items and investigate.

Tip 10: Manage your time. These questions are usually straightforward knowledge checks. Answer confidently, flag any you are unsure about, and do not overthink scenarios that clearly map to a named scheme or control.

Summary

Check fraud includes counterfeiting, forgery of signatures and endorsements, alteration and washing, kiting, paperhanging, and demand draft abuse, while EFT fraud includes ACH debit and credit fraud, wire transfer fraud driven by business email compromise, account takeover, card skimming, and P2P scams. The schemes exploit the float, harvested account information, weak verification, and the speed and irrevocability of electronic payments. Fraud examiners counter them through positive pay and its variants, ACH blocks and filters, callback verification, dual control, segregation of duties, independent reconciliation, secure check stock, and vigilant monitoring for red flags. On the CFE exam, success comes from precise terminology, correctly matching controls to schemes, recognizing red flags, and understanding the general allocation of liability among banks and customers.