What is actually changed, and in what order of frequency. FinCEN's analysis of mail-theft-related check fraud reports found that "the payee line was the most frequently altered section, followed by the amount, which is typically made higher than the intended amount," and that perpetrators "also forged signatures and altered issuer information, which often requires washing the checks first." The alert adds that during check washing "these illicit actors also often increase the dollar amount on the check, sometimes by hundreds or thousands of dollars."
That ordering explains why the victim usually finds out from the wrong direction. A check whose amount was left alone but whose payee was changed clears for exactly the sum the writer expected, so nothing looks wrong on the statement. What surfaces is that the intended recipient says they were never paid.
Why the mail is the supply. FinCEN describes criminals targeting "USPS blue collection boxes, unsecured residential mailboxes, and privately owned cluster box units at apartment complexes, planned neighborhoods, and high-density commercial buildings," through forced entry, "the use of makeshift fishing devices," and increasingly "the use of authentic or counterfeit USPS master keys, known as Arrow Keys." Its Financial Trend Analysis records that the Postal Inspection Service "received 299,020 mail theft complaints between March 2020 and February 2021, a 161 percent increase compared with the previous 12 months."
Washing is one job inside a division of labor. FinCEN describes the organized version of this crime as involving "organized criminal groups comprised of the organizers of the criminal scheme, recruiters, check washers, and money mules." A washed check is worth nothing until somebody deposits it into an account, and the person who does that is often a recruited third party with a real bank account and, frequently, no clear idea of what they are participating in. That is a separate role with its own page.
The washed check is also a template. One of the most damaging features of this crime is that the original stolen check keeps producing losses after it has been negotiated. FinCEN notes that fraudsters "may also copy and print multiple washed checks for future use or to sell to third-party criminals," and that "victim checks are also counterfeited using routing and account information from the original, stolen check." Those numbers are printed on the face of every check the account holder ever writes, so a single stolen envelope can produce a stream of items nobody can associate with it.
How it gets deposited without anyone looking at it. FinCEN's key findings include a "reliance on avoiding human contact: many perpetrators utilized methods that avoid human contact, including check deposits via remote deposit capture (RDC) or at automated teller machines (ATMs) and opening accounts online rather than in person." The report also describes perpetrators who "opened a new account at a financial institution that had either the same name as the intended recipient or a nearly identical name and deposited the check," with those accounts "typically opened online with fraudulent or stolen identification information." That is the answer to the question people ask first, which is how a check written to a plumbing company gets deposited by a stranger.
The prevention that is actually documented is about the mail, not the pen. The Postal Inspection Service's own advice on this page is to "deposit your outgoing mail in blue collection boxes before the last pickup or at your local Post Office," to "never leave your mail in your mailbox overnight," and, when traveling, to "have your mail held at the Post Office or have it picked up by a friend or neighbor." USPIS also states, on the same page, that "Postal Inspectors recover more than $1 billion in counterfeit checks and money orders every year" — a recovery figure about counterfeits, not a measure of consumer losses, and useful mainly as an indication of scale.
What follows a discovery is not a Regulation E dispute. A check is a paper instrument, and the federal electronic-transfer rule excludes transfers originated by check from its scope entirely, so the liability ceilings and error-resolution deadlines that apply to a debit card do not apply here. The governing law is state commercial law adopted from the Uniform Commercial Code, as each state enacted it, together with the deposit agreement, and the statement-examination deadlines that come with it are on the bank statement page. The practical implication is that speed matters and the account itself, rather than the single item, is usually the thing to deal with: the account and routing numbers on the stolen check keep working until the account is closed.
