Check tampering is fraud in which someone forges, alters or misuses a company's own checks to pay themselves. It takes four forms: a forged maker signature on stolen stock, a changed payee or amount, a concealed check slipped past a signer, and theft by a real signer. Each leaves a different mark on the image or register.
What counts as check tampering?
Check tampering covers any scheme in which an insider takes control of a company check and directs it to themselves or an accomplice. The defining feature is that the check itself is the instrument of theft. That separates it from billing schemes, where a real check pays a fake invoice, and from skimming, where cash never reaches the books.
The four schemes differ by which part of the check the fraudster controls:
- Forged maker. The fraudster has blank check stock and signs a name that is not theirs.
- Forged or altered endorsement and payee. A check written to a real payee is intercepted and changed or endorsed by the fraudster.
- Concealed check. A real signer signs a check made out to the fraudster without noticing.
- Authorized maker. The fraudster is a signer and writes the check legitimately, for an illegitimate purpose.
Outside criminals who steal mailed checks and rewrite them commit a related crime. The post on check washing, where ink is removed and the check rewritten, covers that external threat. This post deals with schemes run from inside the business.
Forged maker checks written on stolen check stock
A forged maker check is a blank company check that someone fills out and signs with an authorized signer's name. It needs access to check stock, so it is most common where checks sit in an unlocked drawer. The check usually goes to the fraudster, to cash, or to a payee name chosen to look ordinary.
Forged maker checks tend to show three traits. The check number is out of sequence, often from the back of a box or a book not yet in use. The register has no entry for it, or the entry was added after the check cleared. And the signature, compared with genuine signatures on nearby checks, differs in slant, spacing or pressure.
The first trace often appears in the bank statement before anyone looks at an image. A cleared check number that is far outside the run of numbers being used that month is a strong lead. So is a gap in the sequence that is later filled by a check the register does not know about.
Altered payee and amount checks after signing
An altered check starts as a genuine check, signed by an authorized person for a real payment, and is changed before it reaches the bank. The fraudster intercepts it after signing, then rewrites the payee, adds a second name, raises the amount, or does all three. The register still shows the original payee and amount.
Alterations leave physical marks that a good image can capture:
- Payee line. A name written over, a second name added after the original, or a different hand from the rest of the check.
- Amount fields. The figure and the written amount disagree, or digits have been added in the space before the first number.
- Ink and surface. Uneven tone where ink was removed or a patch where correction fluid sat.
The most reliable trace is outside the image: the cleared amount differs from the register amount for that check number, or the payee printed by the bank on the statement differs from the register payee. Compare cleared amounts with recorded amounts for every check, not only the large ones.
Concealed checks hidden in a signing stack
A concealed check is a check made out to the fraudster that a real signer signs without reading. The fraudster prepares a stack for signature, slips the false check among routine payments, and covers its payee line. The signature is genuine, which is why the scheme can run for a long time.
Concealment works best when the signer trusts the preparer and signs quickly. It also works when supporting documents are presented separately from checks, so the signer cannot match each check to an invoice. Once signed, the fraudster often voids the check in the register, records it to a real vendor, or never records it at all.
Reviewing the bank statement catches what the signer missed. A cleared check payable to an employee or to cash, with no matching entry or with a register entry showing a vendor, is the classic sign. Check images showing the fraudster's endorsement on the back of a check recorded as a supplier payment are close to conclusive.
Authorized maker check tampering by a real signer
Authorized maker tampering happens when a person with signing authority writes a company check for their own benefit. Nothing is forged: the signature is valid and the bank will pay it. What makes it theft is the purpose: personal bills, payments to relatives, or inflated amounts to a payee who passes money back.
Owners, office managers and treasurers of small organizations are most often in this position. Because the person also tends to keep the books, the register entry is coded to a plausible expense account. The checks may be payable to a credit card company, a utility or a retailer, and only the account numbers on the bill or the memo line show they cover a private bill.
Authorized maker theft overlaps with reimbursement abuse. A signer who pays their own inflated expense claim, or the same claim twice, is committing both. The guide to expense reimbursement fraud and how to test claims covers those patterns.
The control is a second set of eyes on what a signer pays to themselves or for themselves. Checks payable to a signer, to a signer's credit card or to cash should need a second approval, and someone without signing authority should review cleared checks each month.
Check image tests for each check tampering scheme
Each check tampering scheme leaves its strongest trace in a different place, so the test has to fit the scheme. Image review catches alterations and endorsements. Register comparisons catch out-of-sequence numbers and amount changes. Payee review catches concealed and authorized maker checks. Run all three each month rather than relying on one.
The table summarizes where each scheme shows and how to find it. Example situations are illustrative.
| Scheme | Where it shows | Test that finds it | Control that prevents it |
|---|---|---|---|
| Forged maker | Check number outside the range in use; signature differs | List cleared check numbers and compare with the register and the stock log | Locked check stock and a stock log kept by a non-signer |
| Altered payee or amount | Cleared amount or payee differs from the register | Match every cleared check amount to the register by number | Positive pay with payee name, printed checks, prompt mailing |
| Concealed check | Payee is an employee or cash; register shows a vendor | Review payee names and endorsements on all cleared checks | Signer sees the invoice with each check before signing |
| Authorized maker | Payee is the signer, a relative, or a personal creditor | Read memo lines and payees on checks the signer wrote | Second approval for checks payable to signers or cash |
Running the tests
- Pull the cleared check list from the statement and the register for the same period.
- Match by check number. List checks that cleared but are not in the register, and register entries whose amount differs from the cleared amount.
- Look at check numbers that cleared out of sequence or from unused stock.
- Request front and back images for every exception, and for a sample of the rest.
- On each image, compare payee, amount and endorsement with the register and the supporting invoice.
PreciseBankFlow reads check numbers from each statement and flags gaps in the sequence, which shortens step 3 on a large account. The image review in steps 4 and 5 stays with you.
How long does a business have to report a tampered check to its bank?
A business that receives a statement has a duty to review it promptly and report forged signatures or alterations. Under the Uniform Commercial Code, the customer loses claims for repeat forgeries by the same wrongdoer after a reasonable review period of no more than 30 days, and loses any claim after one year.
The rule comes from UCC section 4-406 on the customer's duty to examine statements. It says the customer "must exercise reasonable promptness in examining the statement or the items." If the customer fails to do so, the bank can refuse to cover later items paid in good faith to the same wrongdoer once the customer had up to 30 days to report. Separately, a customer who does not report an unauthorized signature or alteration within one year after the statement is made available is barred, whatever care either side took. Account agreements often set shorter periods, so read the bank's terms as well.
Two practical points follow:
- Monthly review protects the claim. A business that reviews cleared checks each month and reports quickly keeps its rights against the bank for that statement.
- Missing originals are normal. The Federal Reserve's Check 21 questions and answers note that banks are not required to keep the original check for any set time. A substitute check carrying the legend "This is a legal copy of your check" is the legal equivalent of the original. Request images early rather than counting on paper.
A written account reconciliation policy with due dates and reviewers is the simplest way to make sure the review happens inside those windows.
When a check tampering flag turns out to be a register error
Most mismatches between check images and the register are bookkeeping errors, not tampering. A check recorded under the wrong number, an amount keyed with two digits swapped, or a voided check that was later reissued can all look like the patterns above. Rule these out before treating an exception as fraud.
Common innocent explanations:
- Transposed amounts. The register shows $1,562 and the check cleared at $1,526. The difference is divisible by nine, and the image shows the cleared amount written plainly.
- Wrong check number in the register. Two checks written the same day are recorded with each other's numbers. Amounts and payees match once swapped.
- Reissued checks. A lost check is voided and replaced. If the original was found and deposited, two checks clear and the register shows one void.
- Bank encoding errors. The bank keyed the amount wrongly when processing. The image shows the correct written amount, and the bank should correct it.
- Handwritten checks for a known reason. A manual check written during a printer outage may look out of pattern but match an approved invoice.
The test that separates error from tampering is the image itself. An error has a clean image that agrees with a real invoice. Tampering has an image that disagrees with the register on payee, amount or endorsement, and no invoice supports the cleared version.
Firms that test check disbursements across many clients can request early access to PreciseBankFlow to run the matching on statements before the image review.