A check is an instruction to a bank, drawn on an account, signed by the drawer — and every fraud type in this rail attacks one of the four fields the instruction carries: the account number, the amount, the payee name, or the signature. The paper looks obsolete until you count what still runs on it: rent, contractor payments, insurance payouts, tax refunds, payroll for a slice of the workforce that never switched to direct deposit. That residual volume is why check fraud remains a federal felony category with dedicated statutes, a nationwide deposit-image database, and bank security teams whose entire job is reading instruction fields for forgery signals. This is check fraud decoded: the five schemes that cover essentially all of it, how deposits actually get reviewed (the database every check enters), the felony and sentence math by scheme type, and the detection layer that catches kiting before the float window closes.
ROUTE MAP (PLAIN ENGLISH)
Check fraud splits into two families by what is being lied about. Counterfeit and forged checks lie about the instrument itself — the paper is fake, the account number belongs to someone else or no one, the signature is fabricated. Altered and kited checks use real instruments dishonestly — a genuine check gets its amount or payee rewritten, or real accounts get played against the float window between when a deposit shows available and when the bank actually collects the funds. The two families detect differently: counterfeits die at deposit-side verification (account existence, signature pattern, security-feature checks), while kiting dies at float-window arithmetic (deposits and withdrawals racing the collection clock across institutions).
The exposure math is statutory, not discretionary. Check fraud and bank fraud carry federal felony exposure — 30 years and $1 million on the bank-fraud statute alone where a scheme affects a federally insured institution, with check-specific and mail-fraud additions stacking where the instrument moved through the postal system. State charges add where local statutes apply. Sentences for first-time, low-dollar, cooperation-posture cases land in months-to-low-years; volume, repetition, or organized roles multiply from there. The instrument's paper face value is not the exposure ceiling — the scheme's aggregate is what gets charged.
STEP 1 - THE FIVE SCHEMES
STEP 2 - HOW DEPOSITS GET REVIEWED
STEP 3 - EXPOSURE MATH BY SCHEME
STEP 4 - THE DETECTION LAYER
WORKED EXAMPLE - THE KITING CYCLE
Two checking accounts, one at each of two institutions, each with modest real balances. Day one: a $4,000 check drawn on institution B is deposited to institution A — the deposit shows available same day or next morning, before B has actually collected. Against that shown balance, a $3,800 withdrawal or bill-pay goes out of A. Simultaneously a $4,000 check drawn on A is deposited to B, and against B's shown balance a similar withdrawal goes out. The cycle repeats with tightening amounts as both institutions' actual collections post — each institution sees its own account funded on paper while the actual collected position goes negative at both. Day six: institution A's float-exposure model flags the deposit-withdrawal mirror pattern (inflow from B, outflow near-equal, repeat) and the daily aggregation shows the account never once had actual positive collected balance while moving five figures; the account closes mid-cycle with the negative position charged back, and the pattern documentation — the deposit sequence, the withdrawal timing, the cross-institution mirror — is exactly the evidence shape the structuring and kiting statutes describe. The float window that looked like free money was a collection clock, and the clock's closing was automated the moment aggregation flagged.
WORKING SEQUENCE
QUICK ANSWERS
RELATED
Check fraud splits into two families by what is being lied about. Counterfeit and forged checks lie about the instrument itself — the paper is fake, the account number belongs to someone else or no one, the signature is fabricated. Altered and kited checks use real instruments dishonestly — a genuine check gets its amount or payee rewritten, or real accounts get played against the float window between when a deposit shows available and when the bank actually collects the funds. The two families detect differently: counterfeits die at deposit-side verification (account existence, signature pattern, security-feature checks), while kiting dies at float-window arithmetic (deposits and withdrawals racing the collection clock across institutions).
The exposure math is statutory, not discretionary. Check fraud and bank fraud carry federal felony exposure — 30 years and $1 million on the bank-fraud statute alone where a scheme affects a federally insured institution, with check-specific and mail-fraud additions stacking where the instrument moved through the postal system. State charges add where local statutes apply. Sentences for first-time, low-dollar, cooperation-posture cases land in months-to-low-years; volume, repetition, or organized roles multiply from there. The instrument's paper face value is not the exposure ceiling — the scheme's aggregate is what gets charged.
STEP 1 - THE FIVE SCHEMES
- Counterfeit checks: paper fabricated to look like a real instrument drawn on a real account — account numbers stolen from real victims, or randomly generated and hoped against weak verification; payee field left blank or set to the operator; deposited into accounts the operator controls. Dies when the bank's verification catches account-signature mismatch or the real account holder reports the unauthorized item.
- Forged endorsements and stolen checks: genuine checks intercepted in the mail (theft from residential mailboxes, the "arrow key" postal thefts, recycling-bin fishing) or stolen from businesses; the payee field names a real person; a forged endorsement converts it to the thief's account. Mail theft plus check fraud stacks federal mail-fraud counts on top of the bank-fraud count.
- Account-number alteration: a genuine check gets its amount or routing-account digits chemically or digitally rewritten — wash the amount field, print a new figure; or transpose the account digits to draw against a different account. The alteration shows under magnification and UV (ink mismatch, erasure ghosting) but often clears first-pass visual review at merchant-accepting endpoints.
- Check kiting: genuine accounts at two or more institutions played against the float — deposit a check drawn on institution B into account A (funds show available before B actually collects), withdraw against the shown balance, reverse the flow; the scheme lives entirely in the collection-clock gap and dies when one institution's actual collection catches the negative balance or when aggregated exposure trips review. Pure float arithmetic — no forged paper anywhere in it.
- Business email compromise variants: real invoices or payroll checks redirected — the payee field rewritten, or payment instructions spoofed so genuine checks route to the operator's account. The instrument is real; the instruction to the bank was lying about who should receive.
STEP 2 - HOW DEPOSITS GET REVIEWED
- The deposit-image database: every check deposited at a US bank gets imaged and enters a nationwide database (the Federal Reserve's check-processing system and the major banks' fraud databases) keyed on account number, amount, serial, and payee — a second deposit of the same instrument, or of an instrument with a known-bad account number, flags at the system layer before human review. The database is why "deposit one counterfeit at many banks" collapses: the image is already recorded the moment the first deposit posted.
- First-pass verification: account existence and status (open, closed, frozen), signature-pattern comparison where captured, security-feature checks on the paper (watermark, microprinting, toner adhesion under UV), and amount-reasonableness against account history. First-pass catches obvious counterfeits and gross alterations; sophisticated forgeries survive first pass and die at the image database or the account-holder report.
- The float window: deposits show available before the drawee institution actually collects (often 1-2 business days domestic, longer on out-of-area items) — this gap is kiting's entire operating space and also the space where a counterfeit deposit "succeeds" before the collection failure reverses it. Operators reading the float as profit window are racing a clock whose closing is automated.
- Account-holder reporting: the real account holder's statement review catches unauthorized items within the cycle — fraud claims on checks have long windows (often 60 days from statement for consumer accounts, longer for some business accounts), which means a "successful" counterfeit deposit can fully reverse months later with overdraft and fee damage cascading on the receiving account.
STEP 3 - EXPOSURE MATH BY SCHEME
- Federal stacking: bank fraud (30 years, $1M) where the scheme touched a federally insured institution; check-specific statutes adding counts per instrument; mail-fraud counts (20 years each) wherever the postal system carried an item; state charges on top where local statutes apply. One scheme with twenty counterfeit checks can read as twenty instrument counts plus the scheme count — the aggregation is what produces the sentence, not any single check's face value.
- First-time low-dollar posture: single-digit months to low years on plea, with restitution orders and supervised release; the mitigating variables are cooperation, repayment, and the absence of volume or organization — not the individual instrument's denomination.
- Volume multipliers: hundreds of instruments, organized roles (printers, depositors, recruiters — conspiracy enhancements), or cross-state operation push sentencing into the multi-year band regardless of first-offense status; the scheme's aggregate deposited amount becomes the loss figure the sentencing guidelines price.
- Collateral consequences beyond prison: restitution orders tracking the full scheme loss; ChexSystems and early-warning records blocking new accounts for years; supervised-release conditions requiring financial transparency; the banking-access destruction documented in the bank-drop lifecycle threads runs parallel to and outlasts the sentence.
STEP 4 - THE DETECTION LAYER
- Image-database matching: same instrument imaged twice, account numbers with prior fraud hits, amount-alteration artifacts visible in the deposit image — automated, nationwide, and the reason one-deposit-per-bank counterfeiting collapsed as a viable pattern years ago.
- Float-arithmetic monitoring: kiting signatures are pure math — deposits at institution A against unfunded items from B, withdrawals at B against items from A, negative actual balances masked by shown availability, cycle times tightening as the scheme accelerates; banks run float-exposure aggregation daily and close kiting accounts while the cycle is still "succeeding" on paper.
- Security-feature forensics: UV and magnification review catches toner adhesion failures, microprint blurring, watermark absence, and ink-mismatch on altered fields — physical-paper analysis that sophisticated digital forgeries still struggle to pass at the deposit endpoint.
- Behavioral flags: new accounts receiving third-party checks at volume, payee-field mismatches against account-holder names, deposits of high-face-value items with no account history of similar activity, out-of-area items clustering — each flag feeds review queues regardless of whether the instrument itself verifies clean.
WORKED EXAMPLE - THE KITING CYCLE
Two checking accounts, one at each of two institutions, each with modest real balances. Day one: a $4,000 check drawn on institution B is deposited to institution A — the deposit shows available same day or next morning, before B has actually collected. Against that shown balance, a $3,800 withdrawal or bill-pay goes out of A. Simultaneously a $4,000 check drawn on A is deposited to B, and against B's shown balance a similar withdrawal goes out. The cycle repeats with tightening amounts as both institutions' actual collections post — each institution sees its own account funded on paper while the actual collected position goes negative at both. Day six: institution A's float-exposure model flags the deposit-withdrawal mirror pattern (inflow from B, outflow near-equal, repeat) and the daily aggregation shows the account never once had actual positive collected balance while moving five figures; the account closes mid-cycle with the negative position charged back, and the pattern documentation — the deposit sequence, the withdrawal timing, the cross-institution mirror — is exactly the evidence shape the structuring and kiting statutes describe. The float window that looked like free money was a collection clock, and the clock's closing was automated the moment aggregation flagged.
WORKING SEQUENCE
Code:
check fraud map: instrument fields (account/amount/payee/signature) are the attack surface -> five schemes: counterfeit paper, stolen/forged endorsement, altered fields, pure float kiting, BEC redirect -> deposit review: nationwide image database + first-pass verification + float window + 60-day holder claims -> exposure: bank fraud 30y/$1M + per-instrument + mail fraud stacking, scheme aggregate drives guidelines -> kiting is pure float arithmetic, dies at daily aggregation and mirror-pattern models -> detection: image matches, UV/magnification forensics, behavioral flags on new accounts + third-party check volumeQUICK ANSWERS
- What is check fraud in simple terms? Any dishonesty about a check's four fields — account number, amount, payee, or signature — covering counterfeit paper, stolen-check forgery, altered instruments, float-window kiting, and payment-redirection schemes; a federal felony category wherever the instrument touched a federally insured institution.
- How much jail time for check fraud? Statutory exposure runs to 30 years and $1 million on the bank-fraud count alone where a federally insured institution is affected, with check-specific and mail-fraud additions stacking; actual first-time low-dollar sentences land in months-to-low-years with restitution; volume and organized roles push into multi-year bands regardless.
- How do banks catch bad checks? A nationwide deposit-image database records every check imaged (second-deposit and known-bad-account flags fire automatically), first-pass verification checks account status and security features, UV/magnification forensics catch alterations, and the account holder's 60-day statement-review window catches unauthorized items that survived everything else — the float window that deposits show is not the collection window that decides.
- What is check kiting specifically? Playing two or more accounts against the collection-clock gap — deposits show available before the drawee actually collects, withdrawals race the closing window; pure arithmetic, no forged paper required; banks run daily float-exposure aggregation and close kiting cycles while they still look successful on the shown-balance layer.
- Can altered checks be detected? At the deposit endpoint, yes under standard forensics — ink mismatch, erasure ghosting, toner adhesion failure under UV and magnification reveal amount and account-number rewrites; the alteration artifacts that survive a first-pass visual review are the ones the image database or holder claim catches later, which converts a "successful" alteration into a full reversal with fee damage.
- What happens after a counterfeit check deposit reverses? The deposit amount gets charged back against the receiving account, often with overdraft and returned-item fees cascading if the withdrawal against the float already spent the shown balance; the account gets flagged (early-warning records block new accounts for years), and the scheme's aggregate — every instrument that touched the account — becomes the loss figure in any proceeding.
RELATED