Check Fraud and Stolen Mail: Protecting Customer Payments

A customer says she mailed your final payment two weeks ago. It never arrived, and her bank shows the check cashed, by a stranger, for more than she wrote it for. In February 2023 the Treasury's Financial Crimes Enforcement Network (FinCEN) warned banks of "a nationwide surge in check fraud schemes targeting the U.S. Mail," and the U.S. Postal Inspection Service (USPIS), which investigates mail crime, publishes its own advice. Here is how the scheme works, the habits that keep your payments out of it, and what to do when one goes missing anyway.

How the scheme works

FinCEN's alert, written with USPIS, describes three steps:

• The theft. Thieves target blue collection boxes, unsecured home mailboxes and the cluster boxes of apartments and neighborhoods, by forced entry, by "fishing" devices coated with adhesive, and increasingly with genuine or counterfeit postal master keys, known as Arrow Keys.
• The washing. Chemicals remove the ink so the payee can be replaced, and the amount is often raised, "sometimes by hundreds or thousands of dollars." A stolen check can also serve as a template for counterfeits that use its routing and account numbers.
• The cash-out. The checks are deposited in person, at ATMs or by remote deposit, into accounts opened for the scheme or held by money mules, and the money is moved out fast.

FinCEN adds that business checks "may be more valuable because business accounts are often well-funded and it may take longer for the victim to notice the fraud." For a contractor that cuts both ways: the checks you mail to suppliers are targets, and so are the checks your customers mail to you.

How big it is

• USPIS received 299,020 mail theft complaints from March 2020 through February 2021, 161 percent more than in the same period a year earlier.
• Financial institutions filed more than 350,000 suspicious activity reports on potential check fraud in 2021 and over 680,000 in 2022. Those counts are for check fraud of every kind, not only checks stolen from the mail.
• From 27 February to 31 August 2023, FinCEN received 15,417 reports on mail theft-related check fraud, tied to more than $688 million in transactions, which may include attempted ones as well as completed ones. About 44 percent involved altered checks, 26 percent counterfeits and 20 percent fraudulently signed checks.

Fewer checks in the mail

The safest payment is one that never goes in an envelope. USPIS tells people who write checks to "consider using e-check, ACH automatic payments and other electronic and/or mobile payments." For a contractor that means:

• Collect at the finish. When the final walk-through is the moment the balance is due, as in getting paid faster, the customer pays in person: by card, by bank transfer, or with a check handed to you.
• Put a pay-online link on every invoice, so mailing a check is the long way round, not the default.
• Pass the post office's advice on. For customers who still mail checks, a line on the invoice helps: mail it from inside the post office rather than a street box, write it in indelible black ink, and leave no blank space on the payee or amount lines. Those are USPIS's own tips.

Habits for the checks you receive

• Get the mail promptly. USPIS: don't leave it in the mailbox overnight. FinCEN names unsecured residential mailboxes among the targets, so if your business mail lands in an open box at the curb, a locking mailbox or a box at the post office is worth pricing.
• Know what is coming. USPIS advises contacting the sender "as soon as possible" when an expected check does not arrive. Keep a short list of invoices where the customer said "it's in the mail," and ask after a few days, not a few weeks.
• Deposit the day it arrives. Mobile deposit from the truck means a check never sits in a console or on a desk. Endorse it for deposit to the business account the moment it is in your hand.

Habits for the checks you write

The supplier checks you mail carry your business account number. USPIS and HelpWithMyBank.gov, run by the Office of the Comptroller of the Currency, suggest:

• Indelible black ink, no blank spaces on the payee or amount lines, and no personal details such as a Social Security or driver's license number on the check.
• Mail from inside the post office, and follow up with the payee to make sure the check arrived.
• Look at the images of your paid checks in online banking, front and back, and check that the endorsement matches the payee, "since criminals will sometimes deposit your check unaltered."
• Pick up new check orders at the bank rather than having them shipped, and shred paid checks or lock them away.

If a supplier emails to say its bank account has changed, that is a different fraud with its own rule; see the fake invoice and the changed bank account.

When a customer's check to you is cashed by someone else

1. Tell the customer the same day, in writing. The invoice number, the amount, the date they say they mailed it, and that you never received or deposited the check.
2. The customer reports it to their bank. It is the customer's account, so it is the customer's claim. HelpWithMyBank.gov says the bank "would need to review your claim to determine liability," that fraud should be reported "as soon as possible," and that the account agreement sets the bank's policies and reporting timeframes. USPIS tells victims to ask the bank for copies of the fraudulent checks.
3. Report it to the Postal Inspection Service. FinCEN tells banks to refer victims to USPIS's online report at uspis.gov/report. USPIS asks for how, when and where the check was mailed, because "these details matter" to find where in the mail stream it was taken, and for copies of the checks and the bank of first deposit to go to law enforcement.
4. Keep the invoice open, with a note. Do not mark it paid; you were not paid.

Who owes what? Under the model text of the Uniform Commercial Code, which the states adopt with their own changes, paying by check suspends the debt when an uncertified check "is taken for an obligation" (UCC 3-310(b)). The same code says a payee "who did not receive delivery" of a check cannot sue for its conversion (UCC 3-420(a)), and the official comment to that section, as the District of Columbia prints it with its code, explains why: "if the check is never delivered to the payee, the obligation owed to the payee is not affected." The route HelpWithMyBank.gov describes is the customer's claim with their own bank. Your state's version and the facts decide any real dispute, and a court decides one that cannot be settled.

The customer is a victim too, so handle it as a shared problem. Say a roofer's customer mailed a $4,800 final payment that was washed and cashed for $9,400 by a stranger. The roofer emails the customer that afternoon with the invoice and a note that nothing arrived, the customer files the claim with her bank and the report with USPIS, and the two agree the balance will be paid by bank transfer or card once the claim is under way, with the invoice held open until then. Nobody is accused of anything, and the job is still paid.

The simplest fix is fewer paper checks. In the office in our tools, invoices go by email, and with your own Stripe key saved the customer can pay online from the invoice.

General information, not legal or tax advice. Rules change and vary by state; check with the agency named above or a professional for your situation.