---
title: "Check fraud: evidence and controls for bank operations | Trustable"
url: "https://trustable.ai/insights/check-fraud-evidence-and-controls"
description: "Understand check fraud through the evidence banks need: check images, supporting PDFs, issuer records, deposit history and bank-owned review decisions."
---

Insights · October 31, 2026 · 15 min read

# Check fraud: an evidence guide for bank operations

Understand check fraud through the evidence banks need: check images, supporting PDFs, issuer records, deposit history and bank-owned review decisions.

A convincing check image can conceal an unauthorized payment. A poor scan can make a genuine item look suspicious. For a bank's fraud team, appearance is only one part of the case.

U.S. bank and credit-union teams need evidence tied to the decision still available to them. That means distinguishing changes to the instrument from problems with authorization and collection, while keeping payment deadlines visible throughout the investigation.

## What check fraud means for a bank

Check fraud is the fraudulent use of paper checks or check images to obtain funds. It includes altered instruments, counterfeit checks, unauthorized signatures and fraudulent deposits. An unpaid check alone does not establish fraud or the depositor's intent.

The institution's role changes the evidence it can access. For an ordinary check drawn on a customer account, the paying bank is the account-holding bank by which the check is payable, unless the check is payable at another bank and sent there for payment or collection.

Under [Regulation CC's definitions](https://www.ecfr.gov/current/title-12/chapter-II/subchapter-A/part-229/subpart-A/section-229.2), the depositary bank is the first bank to which the check is transferred, even if it is also the paying bank or payee. For an account deposit, the check is deemed transferred to the bank holding that account, even if another bank physically receives and endorses it first. The drawer writes the check, and the payee is the intended recipient. An institution may hold both accounts, but its payment and deposit decisions still need separate records.

At Trustable, we check documents for signs of editing and AI generation. In a check-fraud investigation, that work belongs with supporting paperwork, such as a customer-supplied PDF statement used to explain a deposit. The bank's reviewer can then decide which supporting claims need independent corroboration. The document check does not establish the check's validity, confirm available funds or replace check-processing controls.

## Match the suspected scheme to its missing evidence

A stolen check can lead to several different cases. The Financial Crimes Enforcement Network (FinCEN) identified alteration, counterfeiting and fraudulent signing as distinct outcomes in its [mail-theft fraud analysis](https://www.fincen.gov/sites/default/files/shared/FTA-Check-Fraud-FINAL508.pdf). Keeping those distinctions helps an investigator collect evidence that addresses the actual concern.

Match the suspected scheme to its missing evidence

| Suspected scheme | What happened | What image review may reveal | Evidence still needed |
| --- | --- | --- | --- |
| Alteration, including check washing | A genuine check's payee, amount or other information was changed. | Overwriting, inconsistent backgrounds or differences from a retained issue image. A clean-looking image does not exclude alteration. | The drawer's issue record, intended payee and amount, plus an authenticated account of any authorized correction. |
| Counterfeit instrument | A fabricated check imitates an issuer or uses copied account information. | Layout or content differences from known genuine items, sometimes repeated across submissions. | Issuer records showing whether that item was issued. A real routing number or account number does not establish issuance. |
| Stolen blank check or forged drawer signature | Someone uses genuine check stock or signs without the account holder's authority. | A signature or check-stock inconsistency that warrants review. Genuine stock may look ordinary. | Authorized-signatory records, the account holder's account of events and relevant transaction history. |
| Forged or unauthorized endorsement | Someone negotiates a check without the payee's authority. | Missing or inconsistent endorsement information on the back image. | The intended payee's account of receipt, endorsement authority and the deposit relationship. A signature image alone does not establish who signed. |
| Duplicate presentment | The same underlying item is submitted more than once, accidentally or deliberately. | Similar front and back images or matching item details. | Separate deposit and presentment events, their status and settlement history. An image match alone does not distinguish a retry from a second deposit. |

Account-level abuse needs a different investigation. Check kiting exploits uncollected funds; the relevant evidence is the flow between accounts and the exposure created while collection is pending. The Federal Reserve Bank of Richmond's [check-kiting explanation](https://www.richmondfed.org/publications/research/econ_focus/2025/q3_feature2) describes how this abuse creates the appearance of sufficient funds before banks settle the transactions. An instrument may have no suspicious visual edits in such a case.

## What a check image can establish

Image review can reveal a discrepancy worth investigating. Its value depends on which version reached the reviewer.

A phone capture, a processed clearing image and an issuer's retained copy may differ in color, resolution, cropping and compression. Preserve their relationship. A mark that appears in one version may disappear in another, and a processed image may not retain enough detail to assess a suspected physical alteration.

The Federal Financial Institutions Examination Council (FFIEC) notes that physically altered documents can be harder to detect through remote deposit capture when a qualified person does not inspect the original. Its [remote-deposit risk guidance](https://bsaaml.ffiec.gov/manual/RisksAssociatedWithMoneyLaunderingAndTerroristFinancing/06) also distinguishes altered item data from file resubmission and duplicate presentment.

Several limits belong in every image-based review:

- Optical character recognition (OCR) reads fields. Correct extraction does not authenticate the information it reads.
- A picture of a paper security feature does not establish that the original has the expected physical properties.
- A signature comparison can identify a discrepancy. It does not establish authorship or authority by itself.
- A detector score is evidence about the analyzed input. It is neither overall model accuracy nor a calibrated probability that the customer committed fraud.

Where an image-review tool supplies localized signals, they identify areas for attention; they do not establish ground truth or certify the rest of the instrument. Missing, unsupported or unreadable analysis remains an evidence gap. Our [content-authenticity approach](https://trustable.ai/content) keeps file observations separate from whether the underlying claim is true.

![File observations and independent bank records feed a bank-owned decision.](https://trustable.ai/assets/articles/check-fraud/workflow.f534b82b3226.webp)

[Open full-size diagram](https://trustable.ai/assets/articles/check-fraud/workflow.f534b82b3226.webp)

## Where Trustable fits in supporting-PDF review

A customer-supplied PDF statement or invoice is another input to the investigation. Before the bank relies on its contents, the reviewer needs to consider whether the document itself has been manipulated. That question is separate from whether a transaction happened or a check was authorized.

Our document checks look for signs of editing and AI generation. In supporting-PDF review, that adds a document-authenticity question before the bank relies on a statement or invoice. The bank's reviewer selects the financial claims that need corroboration, such as an earlier payment offered to explain a new deposit. Our [bank-statement review guide](https://trustable.ai/insights/fake-bank-statements-mortgage) covers page and file warning signs in a mortgage context; a check investigation also needs the item's issuance and deposit records.

The bank owns the review loop and the links between its records:

- Retain the submission. Preserve the received PDF. Link the analyzed file and any page-level evidence back to that source and case record, separately from the check images.
- Retain the document-check record. Record what was analyzed and any limits on the review. Missing analysis stays an unresolved gap; an absence of identified concerns does not authenticate the PDF.
- Examine the supporting claim. The analyst identifies the relevant entry and seeks independent evidence for the claim it supports. A statement transaction may need corroboration from the institution that holds the account.
- Record the bank's decision. Keep the document-check record, source response and reviewer rationale distinct. Payment operations retains authority over the check-processing action and its deadline.

The practical value is to put the supporting file's authenticity into the review before its contents become a reason to close the case. The analyst chooses the claim to corroborate, performs the source comparison and assembles the case. A document check does not supply issuer confirmation, reconcile deposit events or operate the bank's clearing controls.

### A hypothetical statement-PDF review

Suppose a business deposits a check and supplies a PDF statement from another institution to support its explanation of earlier payments from the same drawer. This is a hypothetical bank-owned workflow, with an invented discrepancy and source response. It describes no real customer case or measured product result.

The bank includes a Trustable document check for signs of editing and AI generation. Suppose the bank's supporting-document review leaves the statement's authenticity unresolved. The analyst identifies the earlier-payment entry used to support the depositor's explanation and records that claimed payment as uncorroborated. Through an authorized, authenticated source channel, the bank obtains a record showing a different amount.

The case now contains an unresolved document-authenticity concern and an independently established discrepancy. Fraud operations investigates the explanation while payment operations handles the available action under bank policy and applicable requirements. The bank's case packet retains both versions and the analyst's reasoning.

Trustable's role in this example is the document check. The bank's reviewer selects the transaction to corroborate and establishes the discrepancy through a source record. The bank still establishes what the check issuer authorized and who is entitled to the proceeds. The supporting-PDF concern alone proves neither check fraud nor the depositor's intent.

## Route the case while payment options remain open

Fraud review and payment operations need to work in parallel. Waiting for a complete investigation can leave an otherwise available action outside its processing window.

### Record the item and the decision clock

Open a case with the front and back images, item identifiers, deposit channel and event timestamps. Record whether the institution is acting as paying bank, depositary bank or both. Include the item's current processing status and the next applicable operational cutoff, with a named owner.

Keep the original received files unchanged under approved access and retention controls. Store enhanced views, extracted text and annotated copies as derivatives linked to those files. Otherwise, a later reviewer may mistake an investigator's processing for evidence of an alteration.

### Resolve discrepancies against an independent record

For a suspected payee or amount change, compare the presented item with the drawer's retained issue record. For suspected counterfeiting or a forged drawer signature, obtain the issuer's response through an established, authenticated channel. Contact information printed on the suspect check is part of the untrusted instrument.

Record exactly what the response establishes. An issuer's confirmation of the original payee and amount differs from a response about the existence of an account. Neither automatically establishes the depositor's entitlement to the proceeds.

When a source cannot provide information, record that limitation. Silence is not confirmation, and a customer-supplied screenshot of an account is not an independent bank response.

### Reconstruct the deposit history

For a duplicate alert, join the candidate items to their actual deposit events. Include accepted, rejected, returned and retried submissions, rather than counting every image as a completed deposit.

Compare the front and back images, account and check identifiers, amounts, channels and processing references. Different photographs or endorsements can still relate to the same underlying instrument. A search limited to one mobile session leaves branch or other-channel activity outside its view.

### Assign the action to the team with authority

Fraud operations develops the concern and supporting evidence. Deposit or payment operations owns the available processing action. Treasury services handles commercial issue-file exceptions with the authorized customer. Compliance and legal teams resolve the applicable requirements and disputed liability questions.

Funds availability is a separate decision from whether the check is genuine. The Federal Trade Commission explains that [available deposited funds](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-fake-check-scams) do not mean a check is good. A balance becoming available is therefore an unsafe closure reason for an authenticity investigation.

A detector alert also does not automatically justify an exception hold. Where Regulation CC's reasonable-cause exception applies, the bank needs fact-based grounds to doubt collectibility, an appropriate notice and retained supporting records. The [exception-hold requirements](https://www.ecfr.gov/current/title-12/chapter-II/subchapter-A/part-229/subpart-B/section-229.13) govern that route, rather than the detector's label.

Returns, adjustments and warranty or indemnity claims have different requirements. They can overlap: a warranty or indemnity claim may use an [adjustment channel](https://www.frbservices.org/resources/financial-services/check-services-resources/check-adjustments-quick-reference-guide-qrg/forward-collection-return-letter-error/warranty-indemnity-claim-wic-check-21-electronically-created-item-eci/). Payment operations needs the route-specific facts and deadline, including applicable state law, agreements and clearing rules. For example, the Federal Reserve's [paid-item adjustment process](https://www.frbservices.org/resources/financial-services/check-services-resources/check-adjustments-quick-reference-guide-qrg/forward-collection-return-letter-error/paid-item-paid/) has its own eligibility and documentation requirements; it is not a general remedy for every duplicate deposit.

## Deposit controls cover gaps that image review leaves open

Positive pay connects presentment to issuance. A commercial customer supplies issued-check information, which the institution compares with presented items. Exceptions go through the agreed pay/no-pay process. The field coverage matters: matching a check number and amount leaves a changed payee unresolved unless payee comparison is included. The Social Security Administration's [account-control guidance](https://www.ssa.gov/payee/best.htm) distinguishes these positive-pay and positive-payee functions.

Issue-file delivery, exception ownership and the action taken when a customer does not respond belong in the operating procedure. An image detector cannot supply a missing issue file or make the customer's authorization decision.

Remote deposit capture (RDC) lets a customer transmit a check image while retaining the paper. Duplicate controls need coverage across days and deposit methods. The National Credit Union Administration's [RDC examination guidance](https://publishedguides.ncua.gov/examiner/Content/ExaminersGuide/ElectronicPaymentSystems/EPSTypes/RemoteDepositCapture.htm) describes the optimal solution as real-time duplicate detection at item and file level, across days and presentment points, and across all applications or deposit methods within the enterprise. That scope is broader than finding repeated uploads inside one queue.

Original-paper custody and endorsement details also matter after a loss. Regulation CC's [RDC indemnity provisions](https://www.ecfr.gov/current/title-12/chapter-II/subchapter-A/part-229/subpart-C/section-229.34) include conditions concerning acceptance of the original check and restrictive endorsements. A duplicate alert alone does not establish that an indemnity claim is available.

Account controls address the depositor and the proceeds. Authentication, risk-based deposit limits and monitoring of unusual deposit and withdrawal activity address risks an image cannot resolve. A legitimate account can be compromised, used by a willing participant or used by someone deceived into depositing a fraudulent check. Those possibilities need different customer conversations and investigation paths.

FinCEN's [mail-theft fraud alert](https://www.fincen.gov/system/files/shared/FinCEN%20Alert%20Mail%20Theft-Related%20Check%20Fraud%20FINAL%20508.pdf) highlights unusual check deposits followed by rapid withdrawals or transfers. It also cautions that a single red flag does not determine suspicious activity. The customer's history and surrounding facts remain part of the assessment.

## Keep a case packet another reviewer can reconstruct

A useful packet connects the observation to the action without overstating either. It includes:

- The item as received: front and back images, source channel, original-file identifiers and links to any derived views.
- The event trail: deposit attempts, presentments, payment or return status, timestamps and processing references.
- The specific concern: the disputed field, suspected scheme, comparison item and any image-analysis result, including unsupported or missing analysis.
- Corroboration: issue records, authenticated responses, account history and customer statements, with their sources and unresolved contradictions.
- The decision record: action, authorized owner, policy basis, relevant cutoff and rationale, including benign explanations considered.
- Follow-through: assigned claims or recovery work, customer communication and compliance escalation under the institution's procedures.

Consider an illustrative payee-alteration case. A business reports that its supplier never received a check. The presented check number and amount match the issue record, but the payee differs. Image analysis produces no strong alteration signal.

The case still contains a substantive discrepancy. Treasury services obtains the authorized customer's response against the retained issue record. Fraud operations investigates the payee and deposit relationship while payment operations handles the available action. The packet records the source mismatch and the image result separately. It does not label the check authentic because the detector found nothing, or label the depositor culpable because the payee changed.

![Illustrative payee mismatch requiring review despite no strong image-alteration signal.](https://trustable.ai/assets/articles/check-fraud/payee-discrepancy.ae8afc3019a1.webp)

[Open full-size diagram](https://trustable.ai/assets/articles/check-fraud/payee-discrepancy.ae8afc3019a1.webp)

Suspicious activity reporting remains a separate compliance decision under the Bank Secrecy Act (BSA). The BSA team determines whether a Suspicious Activity Report (SAR) is required under the applicable rules. An image alert is not an automatic filing instruction, and a return or recovery outcome does not replace that assessment.

## Put authenticity analysis at the right boundary

Supporting-document analysis adds an authenticity question before the bank relies on customer-supplied paperwork. The bank retains its issuer checks, account investigation, deposit controls and accountable decision owners. Our document checks do not replace check verification, positive pay or clearing controls.

[Book a demo](https://cal.com/scamai/20min?utm_source=trustable.ai&utm_medium=website&utm_campaign=book_demo&utm_content=insight-check-fraud-evidence-and-controls-body) to discuss where Trustable document checks fit in your bank's supporting-PDF review.

Trustable

## See it on a sample file.

Book a 20-minute demo. We agree on data handling before you share anything.

[Book a demo](https://cal.com/scamai/20min?utm_source=trustable.ai&utm_medium=website&utm_campaign=book_demo&utm_content=insight-check-fraud-evidence-and-controls)