'Like wildfire': Rising check fraud pits small banks against big banks

MARCOS OSORIO/OSORIOartist - stock.adobe.com

Check fraud is wreaking havoc on community banks, which are urging the Office of the Comptroller of the Currency to crack down on their large bank competitors for failing to comply with rules meant to stop criminals from opening accounts. 

Small banks say they're taking hits to earnings and face negative impacts on their business customers. Many bankers say that check fraud is so rampant that it is leading to a loss of faith in the banking system and the U.S. Postal Service. 

"Check fraud is out of hand," said Chris Doyle, president and CEO of the $2.2 billion-asset Texas First Bank, in Texas City, Texas. "It's an all-out war and we have people fighting it every day at our bank. The capture and washing of checks is out of control. There's no security around checks. It's too easy to wash them and commit fraud."

Community banks are laying the blame for check fraud mostly on seven large banks, including JPMorgan Chase, Bank of America and Wells Fargo, for not doing enough to police new account openings. Checks are intercepted by criminals through the mail, altered by check washing, and then deposited in so-called drop accounts or mule accounts, which are later emptied. Small banks end up repaying their customers whose checks are stolen, but it can take months for them to get reimbursed by large banks in contravention of longstanding Uniform Commercial Code rules. 

David G. Schroeder, senior vice president at the Community Bankers Association of Illinois, is leading the effort to get regulators to take action. He says check fraud is "increasing like wildfire," while "the regulatory response is moving at a glacial pace." 

Schroeder sent a 16-page letter last month to acting Comptroller of the Currency Michael  Hsu, Federal Deposit Insurance Corp. Chair Martin Gruenberg and Federal Reserve Chair Jerome Powell that asks for joint supervisory guidance and rigorous examination and enforcement of the largest banks' compliance with "know your customer" rules. State bank trade groups want regulators to clearly identify best practices and expectations around fraudulent checks, including prompt reimbursement to small banks that currently take months to resolve.

Bankers also want regulators to shift the liability for check fraud losses to the so-called banks of first deposit, which tend to be the largest banks. 

"The core problem is that the largest banks in the nation — which includes BofA, Chase and Wells Fargo — are allowing fraudulent accounts to be opened with mobile devices or online into which fraudulent checks are deposited," said Schroeder.  "Checks that clear back to community banks are funding thriving criminal enterprises." 

The OCC acknowledged in a statement that check fraud "is a serious issue" that may expose banks to increased Bank Secrecy Act and related anti-money-laundering laws.

Payments

Where check fraud is driving businesses to adopt digital payments

April 23, 2024 9:01 AM

"The OCC regularly discusses fraud-related issues with the banks it supervises, including specific communications with large banks about their responsiveness to fraud claim complaints from community banks," the OCC said in an emailed statement. "In addition, the OCC has issued guidance on fraud risk management principles that banks can use to ensure their fraud controls are appropriate to their risk profile."

Though the Federal Reserve is the main regulator over check clearing, only 30% to 40% of checks are processed through the Fed's system. The remaining 60% of checks are processed through private-sector platforms, including the core processors Jack Henry and Fiserv, or are exchanged directly by banks.

Both the Fed and the FDIC declined to comment. 

Banks say criminals have become more brazen. Some cited stolen checks in amounts ranging from $40,000 to $200,000. The checks are washed — with the names of the payee erased or crossed out, and then replaced with a fraudulent business name — and then deposited into accounts opened by fraudsters or mules. To escape detection and prosecution, criminals typically steal and deposit fraudulent checks in small amounts of around $1,000, bankers say. 

Doyle said that police typically aren't interested in pursuing criminals.  

"Quite honestly, there are very [few] results when you capture people that are doing it," he said. "The authorities aren't interested in going through the process of capturing people and putting them in jail unless it's an outfit doing it on a larger scale and they can prove it." 

Bankers also say that states and the Internal Revenue Service have made it too easy for criminals to obtain online documentation to create fake businesses or apply for employer identification numbers that are used to open bank accounts. 

Schroeder said that his trade group of 265 Illinois banks found that check fraud losses jumped 50% last year compared with 2022, with an average loss of $47,000, up from $30,000 a year earlier. Other state bank trade groups are conducting similar surveys in the months ahead. 

Kelly Goulart, senior regulatory compliance manager at the Independent Bankers Association of Texas, said the speed and automation in which checks are processed and flouting of anti-money-laundering rules has exacerbated the problem. Though the Uniform Commercial Code imposes strict liability on a bank to return fraudulent checks by or before midnight of the day after the check is presented for payment, large banks are not following the UCC rules, Goulart said. 

"Both the bank of first deposit and the paying bank are dependent on each other to police the system and one isn't doing their job, and that's the problem," he said. "The large banks game the system, their 'know your customer,' [compliance] isn't up to snuff, and they are less than enthusiastic about responding to community banks' issues about presentment warranty," which is the implied promise of prompt repayment. Breach of warranty claims are resolved at the state level. 

The rationale behind KYC rules is to prevent criminals — from sanctioned Russian oligarchs to drug kingpins — from creating layers of corporate entities to disguise and obscure their ownership of assets. Banks are required to identify their customers and must review accounts for suspicious transactions and illegal activity. 

"If the paying bank doesn't return the check to the 'bank of first deposit' by the midnight deadline, that liability is on [their] back," said Goulart. "Because of the volume and speed, it makes it difficult to look at every item," especially for fraudulent and counterfeit checks that don't bear the real signature of the payee or if the name is scrubbed but the amount remains the same. 

Jim Amundson, president and CEO of BankIn Minnesota, the state bank trade association, said it is tough to get large banks to respond despite warranties that they are required to do so. 

"The upstream warranty applies to those altered checks," Amundson said. "But asserting this upstream warranty to these large financial institutions, it's difficult to get their attention or to find someone that is able to help or even interested in helping. Ultimately it comes back to: Why are these accounts being opened and why are [the big banks] not following 'know your customer' procedures or complying with the law? If it happens on a big scale, it impacts earnings." 

Too few postal police

Aza Bittinger Jr., president and CEO of the Community Bankers Association of Ohio, cited two failures that have caused the problem of check fraud to snowball: the failure to protect the U.S. mail and banks complying with customer identification rules. 

"Large banks are regularly failing to practice minimum due diligence to protect the integrity of our financial system [and] and this lack of care is a reflection of 'too big to fail,'" Bittinger said. "The second contributing factor lies within our mail delivery system."

Frank Albergo, president of the Postal Police Officers Association, said check fraud has proliferated due to drastic cuts in postal police officers and a shift in strategy by the U.S. Postal Inspection Service, the law enforcement arm of the U.S. Postal Service.

"The inspection service has decimated our ranks," said Albergo, citing a 22% drop in postal police officers to 450 in 2023, down from 581 in 2019. The USPIS has an authorized budget for more than 700 postal police officers but is operating at 60% of capacity, he said. 

In September, the Postal Service's inspector general released an audit on the service's response to mail theft. It found "challenges with staffing" and a failure to assess the resources needed to address check fraud. It also said that the Postal Service "lacks accountability for their arrow keys, which are often a target in carrier robberies and are used to commit mail theft." 

"While Postal Inspection Service headquarters management says mail theft is prioritized within each division, we found that they have not assessed and assigned personnel resources nationally to address mail theft," the OIG said in its report. 

To combat mail theft and violent crimes against postal carriers, the Postal Inspection Service launched a program last year called Project Safe Delivery. Michael Martel, a spokesperson for USPIS, said postal-related robberies in the first six months of 2024 are down 21%. He also cited 213 arrests by postal inspectors since the launch of the program nearly a year ago, and 1,025 arrests associated with mail theft. 

CAMELS failure

In the letter to regulators, Schroeder highlighted the intersection between check fraud and a bank's CAMELS rating, the system that banking regulators use to assess the strength of a bank in six categories: capital, assets, management capability, earnings, liquidity and sensitivity to market risk. 

The failure of big banks to reasonably address check fraud "is a clear indication that they are not properly managing this process — the M in CAMELS," Schroeder wrote in the letter. The letter cited the laundry list of rules including "know your customer," Bank Secrecy Act, customer-due-diligence and customer-identification compliance responsibilities.

Bankers are wasting management resources that "are harming the earnings (the E in CAMELS) of community banks and their capital (the C in CAMELS)," Schroeder wrote.

The letter named seven large banks that routinely fail to promptly reimburse Illinois community banks. The banks include JPMorgan Chase, Bank of America, Wells Fargo, Regions Bank, U.S. Bank, Citibank and BMO Harris. The banks all declined to comment individually and cited check fraud as an industrywide problem that has been particularly tough to address. 

"Check fraud is a crime that hurts banks of all sizes, and as an industry we need to stay focused on fighting back against the real bad actors in this story — the fraudsters taking advantage of bank customers," said Sarah Grano, a spokesperson for the American Bankers Association. "We are helping all banks resolve check fraud claims as quickly and efficiently as possible." 

Grano said ABA, which represents banks of all sizes, is working to combat check fraud on multiple fronts. She cited an anti-check-fraud PR campaign with the Postal Inspection Service and ABA's Check Fraud Claim Directory that provides participating banks with contacts at other institutions to resolve disputes. 

Scott Anchin, vice president of operational risk and payments policy at the Independent Community Bankers of America, said that fighting check fraud is "a shared responsibility" and financial institutions "can't do it on their own."

Reimbursement continues to be a very difficult issue, he said, adding: "I don't think there's been an improvement in actual recoveries and these things end up in queues. Oftentimes the only recourse available is litigation."

Bankers say criminals are so sophisticated that they have found a way to circumvent banks' automated services designed to catch fraud, known as "positive pay,'' in which a bank compares checks against a list provided by business customers. Some banks are even crafting language to shift liability to businesses that use positive pay in an effort to avert losses from check fraud, Goulart said. 

Consumers can also be on the hook for check fraud if they fail to notify a bank about a fraudulent check within 30 or 60 days. 

"If a customer doesn't check their bank statements and raise concerns outside the 30- to 60-day time frame of most deposit contracts, then it's going to be a problem and the liability is on the customer," Goulart said. 

Many bankers have resolved to hire more people to put more eyes on the problem, which drives up costs.

"Checks aren't going away and they're not getting any more secure, so we have to police it better," Doyle said. "If we don't, nobody's going to do it."