As all of you know, banking is changing at an ever quickening pace. Technology has dramatically revolutionized the payments system in our country and throughout the world, and these changes have not only decreased the amount of time necessary for a customer to make a payment from their account, but it has also made available to the customer nearly instantaneous reporting of transactions through online and mobile banking. Not that many years ago, customers primarily withdrew funds from their accounts by writing checks and visiting ATMs, and reconciled their account transactions to monthly paper statements in order to identify any withdrawals from their account that were not properly authorized. Customers now have myriad ways to withdraw funds from their account through debit cards, ACH transactions, and even real-time payments, and those transactions can often be reported to the customer immediately through online banking or a bank’s mobile app. Considering that, it is ironic that one of the more common account frauds today is the good old-fashioned check fraud. The use of the US mail as a means for committing such check fraud was even the subject of a recent Financial Crimes Enforcement Network alert that is addressed more specifically in this month’s Compliance Update.

We are noticing these check fraud schemes more and more in our practices as well. Clients are calling almost every week with questions about how to address a customer who has reported one or more fraudulent checks being paid from their accounts. These customers, who have often enjoyed long-standing relationships with the bank, may or may not be liable for the checks, depending on the law applied, but the bank probably wants to keep them happy regardless of their legal liability. Many times, the customer on whose account the check is drawn may ask their bank to return the fraudulent check as unauthorized, and the success of such returns depends on many factors typically applied pursuant to articles 3 and 4 of the Uniform Commercial Code (UCC). The UCC is a set of uniform laws adopted by each state in nearly identical form, and almost all states now apply articles 3 and 4 to check fraud.

Under Article 4, the depositary bank of a fraudulent check is responsible for making sure that the check is properly endorsed and no alterations were made to the check after it was first written, and the payor bank is responsible for making sure that the check was actually authorized by the payor bank’s customer (i.e., the check itself as well as the signature on the front of the check are authentic). The policy behind this different treatment has historically been that the depositary bank that accepts the item for deposit is in the best position to inspect it in order to determine whether it has been “altered” and that the endorsement is proper, whereas the payor bank on which the check was drawn and that has the customer’s signature card on file is in the best position to timely identify a counterfeit check or one that has a forged customer signature. In today’s banking environment, where many checks are negotiated and even deposited in imaged form and volume is too great to check every signature, that policy distinction is becoming even more blurred.

The general application of these rules means that the depositary bank will be responsible if a check is “washed” through the use of chemicals that remove the original ink on a check to replace the payee or amount, whereas the payor bank will be responsible if that same washed check is instead replicated into a counterfeit item that is reproduced by fraudsters. However, because the washed alterations are so good and the fraudsters are becoming more and more sophisticated in their use of counterfeit checks, it is very difficult to tell the difference, especially when it is the image of a check that is being negotiated instead of the original check.

In 2019, the Federal Reserve Board amended the liability provisions of Regulation CC, which govern the collection of checks through the Federal Reserve System, to reflect the changing methods of check collection from ones that were largely paper-based to ones that are mostly electronic. Those amendments provide that an imaged substitute check is presumed to be altered for the purposes of assigning liability between depositary and payor banks unless the original check is presented by the depositary bank for inspection. Therefore, while the underlying law governing liability for a counterfeit or altered check has not changed, the legal burden now largely lies with the depositary bank to prove that a check negotiated through image was an alteration instead of a forgery or is counterfeit.

Another possible avenue for recourse that can be used by payor banks is Rule 9 of the Electronic Check Clearing House Association (ECCHO). Rule 9 is an ECCHO warranty in which a depositary bank warrants to the payor bank that (i) the signature of the purported drawer is not forged or otherwise unauthorized, and/or (ii) the related physical check is not counterfeit. It is only available for electronic checks exchanged under ECCHO rules by ECCHO members who have agreed to use the rules and not opted out of Rule 9. It shifts responsibility in some cases, as it is assigned by the UCC from the payor bank to the depositary bank when there are sufficient funds in the depositor’s account, but the loss remains with the payor bank if there are insufficient funds in the depositor’s account to cover the fraudulent item once the claim is received by the depositary bank. 

Many community banks that try to use the Reg CC presumption or Rule 9 in order to return an item to a larger “money center” bank that accepted it for deposit are instead finding that these returns are either being ignored or the depositary bank claims the check was not properly returned and attempts to again present the same image for payment without supplying the original for inspection. In many cases, the checks are small enough that banks are choosing to accept the loss instead of spending time and money to press the issue. However, in cases where the amount of the check is significant, litigation may be the only possible redress for payor banks. And in circumstances where the fraudster has already absconded with the funds and it is difficult to determine whether the check was actually a counterfeit or an alteration, the costs associated with pursuing that litigation can be a pretty significant deterrent to seeking protection under the rules.

Oftentimes, these fraudulent checks may go months before being noticed by certain customers, after which several subsequent fraudulent checks altered or created by the same users may be drawn. This is more likely in business account situations where the volume of check activity and the size of account balances may make it easier to disguise a series of fraudulent checks. In this situation, depending on the terms of the payor bank’s deposit agreement with the customer, the customer will usually be prohibited from making a claim for reimbursement related to fraudulent checks paid more than 15 to 30 days following the customer’s receipt of the account statement containing the first item, and the customer may be responsible for all items reported after a contractually agreed-upon period, which can be as short as 30 to 60 days after the fraudulent item is included in the customer’s account statement. This is usually a very helpful tool for the payor bank when defending a reimbursement claim from a customer, but it can also be problematic if the bank wishes to return any such altered item since a bank that has these delinquent reporting defenses against its customers is generally prevented by the UCC from enforcing the related presentment warranty of the depositary bank.

Because of the increasing prevalence of check fraud, the changes in technology that are making it more difficult to apply the relevant laws, and the inevitable conflicts that arise with customers who fall victim to it, banks are beginning to use technology and operational solutions more and more to try to catch fraudulent checks before they are paid. One such solution familiar to many bankers is “positive pay,” which can either require the bank to affirmatively approve each check over a certain payment amount before it clears their account or involve the automatic comparison of certain information from each check (e.g., check number and amount) to a check ledger provided by the customer before a check is paid. The problem with this system, particularly its automatic application, is that it often only uses the check number and amount for verification of a washed or counterfeit check’s legitimacy, and the responsibility is placed on the customer to check the payee name as well before it is approved. As a result, positive pay may give customers a false sense of security that makes them even less likely to check their account statements and, therefore, more susceptible to certain types of check fraud.

To add an additional layer of security, some of our clients are discovering elements of their Bank Secrecy Act/anti-money laundering software may be “turned on” in order to identify checks that have features and/or stock paper that are different from what the customer uses for their actual checks. If available, this solution can help payor banks identify certain counterfeit checks before they are paid, which may be invaluable since counterfeit checks, as opposed to alterations, generally cannot be returned to depositary banks under the presentment and transfer warranties of the UCC. This is especially important when a washed check has been duplicated or recreated in such a way that positive pay applications will not identify it.

Although checks are rapidly becoming obsolete for legitimate banking transactions, for fraudsters with highly developed alteration and counterfeit technology, checks seem to be developing into an exciting new way to game the system. As a result, banks are being forced to spend more time and money on solutions to prevent fraud within transactions that seem to be more of a reflection of where banking has been than where it is going.