# How could've this happened - checking scam **URL:** \ **Category:** In My Humble Opinion\ **Created:** [April 30, 2024, 6:03pm UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976 "2024-04-30T18:03:11Z")\ **Posts on this page:** 17\ **Page:** 2
**Author:** ![wguy123](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wguy123/32/3161_2.png) [@wguy123](https://boards.straightdope.com/u/wguy123)\ **Post date:** [May 2, 2024, 1:06am UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/21 "2024-05-02T01:06:07Z")
So, you are saying printed checks are an absolute liability to the account owner and there is nothing to do to stop others from stealing your money beyond possibly paying the bank more money to try to stop this? I wasn’t worried before because I have no debit card on my main checking account, but I am now. What the fuck? ---
**Author:** ![Railer13](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/railer13/32/9742_2.png) [@Railer13](https://boards.straightdope.com/u/Railer13)\ **Post date:** [May 2, 2024, 1:53am UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/22 "2024-05-02T01:53:16Z")
> [@Joey\_P](#): > > Go online, find a generic picture of a check, type your checking account info over it, print it, fill it out, deposit it via your phone and I bet it goes through. Highly, highly doubtful. If it were that easy, it would have been done a couple of quadrillion times. ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [May 2, 2024, 2:47am UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/23 "2024-05-02T02:47:37Z")
> [@wguy123](#): > > So, you are saying printed checks are an absolute liability to the account owner Which part of my post are you addressing? Not pushing back, just trying to make sure we’re on the same page. > [@Railer13](#): > > Highly, highly doubtful. If it were that easy, it would have been done a couple of quadrillion times. I mean, I have first hand experience. I’ve had checks clear my account that had my business name/address and my account info at the bottom, but other than that, it wasn’t even the same checks that we use. That is, they didn’t wash our checks and reuse them, they made new ones. How else would they have done this? Here’s a [blank business check](https://t4.ftcdn.net/jpg/05/09/50/83/360_F_509508345_Yp0VSVTfcdJVyHgomxiQat9vU0Y26FLn.jpg). If you had my checking account info, typed it across the bottom with a MICR\* font, filled in the rest of the info (our business name, bank name etc), printed it out and deposited it with your phone, what’s going to stop it from going through? The app will think it’s real and a human isn’t going to see it until it hits my account. I’m not trying to be snarky, but this has happened to me and I can’t think of another way it would have happened. \*If one were so inclined, you can buy MICR ink for an inkjet printer so the physical checks would work as well. ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [May 2, 2024, 2:53am UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/24 "2024-05-02T02:53:43Z")
> **[FBI Tech Tuesday: Beware of check cooking scams - Odessa American](https://www.oaoa.com/local-news/fbi-tech-tuesday-beware-of-check-cooking-scams/)** > > The Odessa American is the leading source of local news, information, entertainment and sports for the Permian Basin. > A scammer just needs to take a digital photo of a stolen check and then use commercially available software to alter it to make counterfeit checks. > **[Check Baking – Checkwashing Goes Digital in This New Check Fraud Scheme](https://www.parascript.com/blog/check-baking-checkwashing-goes-digital/)** > > Check Baking, aka Check Cooking, is a new checkwashing scheme targeting banks and financial institutions. Learn what to look for and prevent it. > What is Check Baking? > > Check baking repurposes portions of checks (account numbers, signatures, etc.) and pieces them together to generate check images using photo editing software. Those images are deposited through any remote deposit capture systems that accepts images of checks. > > Check baking is an effective tactic for fraudsters due to its inherent differences from checkwashing. Traditional checkwashing allows for the alteration of only one check at a time, necessitating the procurement of multiple checks to execute more fraudulent transactions. In contrast, check baking enables fraudsters to effortlessly produce numerous counterfeit checks and deposit them into various drop accounts (fake or temporary accounts set up specifically for fraudulent activities). ---
**Author:** ![Railer13](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/railer13/32/9742_2.png) [@Railer13](https://boards.straightdope.com/u/Railer13)\ **Post date:** [May 2, 2024, 3:01am UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/25 "2024-05-02T03:01:45Z")
Correct, you’ve identified how it could be done and how it was probably done in the OP, as well as to you and your business. These techniques are more sophisticated and complicated than what can be done by a casual user. And as you state, the bad guy would need your account info as well. Back to the OP, I’m wondering if somebody took a picture/copy of the check BEFORE it was presented to the OP’s wife, then used the method described in your first link. ---
**Author:** ![wguy123](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wguy123/32/3161_2.png) [@wguy123](https://boards.straightdope.com/u/wguy123)\ **Post date:** [May 2, 2024, 5:52am UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/26 "2024-05-02T05:52:32Z")
> [@Joey\_P](#): > > Which part of my post are you addressing? Not pushing back, just trying to make sure we’re on the same page. I believe you have confirmed that a photo of a check is all that is needed to steal money (or, the routing and account number from the bottom of a check). I’m still curious who is liable for money stolen in that fashion? If someone steals money using stolen credit card info, I believe it is on the CC company. What about if my routing and account number get out? Can I ask my bank to not process any checks on an account? A ton of people have handled my routing and account number over the years and they never change unlike my CC info. ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [May 2, 2024, 11:50am UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/27 "2024-05-02T11:50:58Z")
> [@wguy123](#): > > I’m still curious who is liable for money stolen in that fashion? That’s almost literally the exact topic I’ve been meaning to start forever and just never got around to it. If you or someone else wants to start it, I’m interested. I go through each and every check that hits our bank every single morning, Monday-Saturday, so I was able to catch and report these within an hour of the bank opening. The bank told me that makes it _a lot_ easier for them since the money hasn’t actually left their possession yet and it’s easier to not transfer it than to try and claw it back. The check that was deposited and not caught until much later (because the actual check that I actually wrote, with no changes, was deposited by an unknown 3rd party, so it looked fine on my end), is 2ish months in the process of trying to get it back. In any case, I am curious about this as well. Presumably the account holder has no responsibility here. I don’t see why they would either. All they did was use a check as intended (mailing it). In the end, it’s likely my bank’s responsibility since, ultimately, they’re the ones that are supposed to be safeguarding my money against exactly this. In fact, after I pulled all my business accounts out of the bank that allowed all the fake (not washed, fake) checks, I still had some lingering personal accounts there. A few months later one of those accounts had it’s debit card used. I reported it, they said ‘nope, it was totally you’, even after I tried to explain that this card would never, ever have been used at that store (and on Easter Sunday), they wouldn’t refund it. After that, I closed out my 3 remaining personal accounts. And while talking to the banker, I made it clear that one of my reasons for leaving the bank, and I don’t think this was an exaggeration, was that my money is, very clearly, not safe here. They’ve proven time and time again that they’ll just hand it out to anyone that asks. > [@wguy123](#): > > If someone steals money using stolen credit card info, I believe it is on the CC company. It’s generally on the CC company, but in some circumstances that liability shifts to the merchant. That seems to be less and less the case (at least IME) as we’ve moved away from swiping your card and signing on a piece of paper. > [@wguy123](#): > > Can I ask my bank to not process any checks on an account I’m not sure, but it’s a good question. One of my concerns would be that checks (or eChecks) are intertwined into the ACH system and that could cause problems. I have no idea if that’s a valid concern though. > [@wguy123](#): > > A ton of people have handled my routing and account number over the years and they never change unlike my CC info. Up until the last few years, your CC number and month of the expiration date were likely static. That’s generally all that’s needed to get the card to go through. I have keyed in thousands of credit card numbers over the years. Keeping in mind these were all transactions for customers I personally knew, no fraud involved, and I always made sure to get the updated info the next time I talked to them. I could generally work around a missing or wrong CVV or zip code and if the card was expired, using the same month and moving the year a few years into the future worked more often than it didn’t. But with that (or simultaneously to that), that changing credit card info is usually pushed to businesses that keep it on file (not locally, with their processor). I rarely have to update cards I have on file. When was the last time you got a new card and had to update Netflix or Amazon? It’s convenient, but it also means that business that you used once or twice 5 years ago may still have your _current_ CC info. For a number of reasons, I’d often prefer if that info stopped working after a while. ---
**Author:** ![filmore](https://avatars.discourse-cdn.com/v4/letter/f/7993a0/32.png) [@filmore](https://boards.straightdope.com/u/filmore)\ **Post date:** [May 2, 2024, 12:07pm UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/28 "2024-05-02T12:07:08Z")
If it was done by printing a photo of a check, I would think that the account holder would realize the fake check in his hand was different than the checks in his checkbook. I would image that the feel of the paper would be different, the security pattern would be blurry, and other physical aspects would be different. I can see how the bank would accept a forged check, but it seems like it would be obvious that the check was a copy if you could compare it to the real checks. And I wouldn’t think the forger would have any reason to print a check from a photo or try to create an exact photocopy. All that’s needed is the routing/account numbers. They could just print their own checks with those numbers and they can write as many checks as they like. ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [May 2, 2024, 12:11pm UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/29 "2024-05-02T12:11:10Z")
> [@filmore](#): > > If it was done by printing a photo of a check, The person who deposited it (may or may not have) used a picture to create a physical check, but the account owner probably just had an image from the bank on their phone or printout of it. ---
**Author:** ![Dewey\_Finn](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dewey_finn/32/4222_2.png) [@Dewey\_Finn](https://boards.straightdope.com/u/Dewey_Finn)\ **Post date:** [May 2, 2024, 12:18pm UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/30 "2024-05-02T12:18:40Z")
> [@Joey\_P](#): > > \*If one were so inclined, you can buy MICR ink for an inkjet printer so the physical checks would work as well. Just wondering; is MICR ink even needed any longer? Aren’t checks processed by being scanned nowadays? ---
**Author:** ![Railer13](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/railer13/32/9742_2.png) [@Railer13](https://boards.straightdope.com/u/Railer13)\ **Post date:** [May 2, 2024, 12:46pm UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/31 "2024-05-02T12:46:07Z")
> [@Dewey\_Finn](#): > > is MICR ink even needed any longer? Aren’t checks processed by being scanned nowadays? Correct, but I believe you would still need a MICR font, which are easily obtained, as @Joey_P has mentioned. ---
**Author:** ![Omar\_Little](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/omar_little/32/269_2.png) [@Omar\_Little](https://boards.straightdope.com/u/Omar_Little)\ **Post date:** [May 2, 2024, 4:54pm UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/32 "2024-05-02T16:54:18Z")
> [@Lucas\_Jackson](#): > > He just doesn’t have the money to pay this month. His credit union should make him whole on the fraud. It’s their responsibility to ensure that documents presented for payment are true and correct. It’s not his responsibility to go around and investigate with his vendors and payees of checks and implying they are responsible. ---
**Author:** ![Railer13](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/railer13/32/9742_2.png) [@Railer13](https://boards.straightdope.com/u/Railer13)\ **Post date:** [May 2, 2024, 5:18pm UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/33 "2024-05-02T17:18:22Z")
> [@Omar\_Little](#): > > His credit union should make him whole on the fraud. It’s their responsibility to ensure that documents presented for payment are true and correct. This, exactly. If he has a copy of the fraudulent check (presumably from his statement), he should have a copy of the valid check as well. Presenting both of those copies to somebody in the CU should convince them that they are at fault. ---
**Author:** ![Spiderman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/spiderman/32/230_2.png) [@Spiderman](https://boards.straightdope.com/u/Spiderman)\ **Post date:** [May 2, 2024, 5:18pm UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/34 "2024-05-02T17:18:41Z")
> [@Joey\_P](#): > > I’m not sure, but it’s a good question. One of my concerns would be that checks (or eChecks) are intertwined into the ACH system and that could cause problems. I have no idea if that’s a valid concern though. There are typically\* four parties to an ACH, much like a check; however, unlike a check there may be two directions, debit & credits. The origininator - the party who initiates the ACH, the ODFI (Originating Depository Financial Institution, aka, the originator’s bank), the RDFI (Receiving Depository Financial Institution), & the receiver. If you, Joe Consumer, initiate a txn via your bank’s bill pay system to pay your utility bill you are the originator, your bank is the ODFI, the utility company’s bank is the RDFI, & utility('s payments acct) is the receiver. In this case you are initiating a credit. However, if you give your utility authorization to deduct funds from your acct, either one time or recurring, then they are the initiator, their bank is the ODFI, your bank is the RDFI & you are the receiver & they are initiating a debit to your acct. Consumer accounts can typically can only initiate credits, meaning you can send someone else money but you can’t take it from them. Corporate accts, OTOH, can sign up to issue both debits & credits. The utility initiates debits to their customers but credits to their employees (direct deposit) on payday. Every day there are ACH returns, there’s something like 80 separate & unique return codes/reasons. Some are kind of obvious based on what information is sent, & yes, there is some technical hair splitting between some of the codes. Codes include: R01 - NSF R02 - Acct closed R03 - No acct / unable to locate, which is slightly different than R04 - Invalid Account Number R07 - Authorization Revoked by Customer R10 - Customer Advises Not Authorized Anyone who can initiate debits _can_ take funds from your acct. If you notice an unauthorized debit, you can go to your bank (or possibly their website or app) & initiate a dispute for the item(s) in question. Your bank _may_ give you provisional credit but they also go back to the ODFI who goes back to their originator & says, “prove it”. If they don’t have proper documetation / recordings of you allowing them to debit you the ODFI takes back the credit given to the originator & puts a black mark in their file; if the originator gets enough black marks (as a percentage, by reg it’s ½% but many banks make it much lower than that) & they will be banned by their bank from initiating any more ACHs & quite possibly have their accts closed so they wouldn’t get away with it / away with it for very long if they tried. .\* There can be three parties if you both the originator & receiver happen to bank at the same institution, then the bank is both the ODFI & RDFI & typically treat it as an ‘on-us’ transaction typically processed internally but everything else is still the same. ---
**Author:** ![Lucas\_Jackson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lucas_jackson/32/303_2.png) [@Lucas\_Jackson](https://boards.straightdope.com/u/Lucas_Jackson)\ **Post date:** [May 2, 2024, 6:55pm UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/35 "2024-05-02T18:55:44Z")
> [@Railer13](#): > > I believe you would still need a MICR font, which are easily obtained > **[MICR Encoding Font · 1001 Fonts](https://www.1001fonts.com/micr-encoding-font.html)** > > Download MICR Encoding Font · Free for commercial use · © 1998 Digital Graphic Labs - All Rights Reserved ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [May 2, 2024, 9:30pm UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/36 "2024-05-02T21:30:23Z")
> [@Dewey\_Finn](#): > > Just wondering; is MICR ink even needed any longer? Aren’t checks processed by being scanned nowadays? No idea. The only reason I’m even aware of is because I had been entertaining the thought (about 15 years ago) of printing my own checks and I ran across it. If you search for it on Amazon, it appears to still be selling, so someone’s using it. ---
**Author:** ![EddyTeddyFreddy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/eddyteddyfreddy/32/18796_2.png) [@EddyTeddyFreddy](https://boards.straightdope.com/u/EddyTeddyFreddy)\ **Post date:** [May 3, 2024, 12:35am UTC](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976/37 "2024-05-03T00:35:54Z")
I’m still using it to print checks with software that ties into Quicken. I run the system on an elderly Windows XP computer no longer connected to the Internet, just to its dedicated little inkjet printer. [Previous page](https://boards.straightdope.com/t/how-couldve-this-happened-checking-scam/1000976.md?page=1)