Fraudacity is a six-episode video series featuring SentiLink Head of Fraud Insights David Maimon.
In this episode, Dr. Maimon traces how stolen checks make their way from USPS collection boxes to Telegram and darknet marketplaces. He also covers how fraudsters have moved from washing checks to “cooking” high-quality counterfeits, and why a stolen check can now lead to identity theft as well as an emptied bank account.
Future episodes of Fraudacity will be released here on the SentiLink blog, and also on Youtube. A lightly-edited transcript of the video is available below:
You know who still writes paper checks? Fraudsters. Check fraud has been one of the fastest-growing online crimes since 2021.
In this episode, we’ll trace the chain from mailboxes to Telegram marketplaces, with all the clever steps in between. If you work in fraud or risk, you need to see this.
Check fraud has been available on darknet markets and text message applications for a long time. When we saw checks being offered for sale on those text message applications, usually before 2021, what we saw were templates of checks that the criminals had essentially uploaded for us to see what they were capable of doing.
We were seeing a lot of videos of them bragging about their labs, which allowed them to create those fraudulent checks. But we didn’t really see high volumes of those templates. But then came June of 2021, and we saw a lot of checks that were uploaded by the criminals and were obviously stolen from different places.
We saw handwritten checks. We saw checks sent by the Department of the Treasury to consumers in the United States, and we saw a lot of business checks as well. That was extremely interesting for me as a scholar, and for my team, so we decided to dive in and try to figure out where these checks were coming from and what the modus operandi was of the criminals who were uploading those checks on text message applications and offering them for sale at a wide range of prices.
So we dove in, and we realized quite quickly that the checks we were seeing on text message applications were essentially coming from our USPS collection boxes. What we realized was that starting in mid-2021, criminals were targeting our mailboxes, harvesting all the mail from them, and then chauffeuring the mail to hideout locations where the rest of the gang waited. They supported the operation by sorting through the mail and finding the checks and debit cards the criminals were looking for, so the criminals could cash them, as well as sell them to different actors across the ecosystem to use in their fraudulent operations.
From that point, you had to have someone more familiar with how financial institutions operate in order to actually work with the checks that criminals were able to harvest from our USPS collection boxes. And so into that operation came the washers: individuals who were able to take the checks, soak them in nail polish remover or any other liquid that would allow them to remove the original content, dry the checks, and then either offer those checks to their mules to deposit, write their own amounts on the checks and deposit them in their drop accounts, or simply offer those checks for sale on text message applications the criminals were operating.
So if you were a consumer interested in those checks, you could simply go to Telegram or darknet markets, browse through the list, actually see the checks you were interested in purchasing (sometimes including the amounts on the checks), and purchase a check. During the last five years or so, criminals have been hitting a lot of mailboxes and harvesting a lot of checks.
In terms of developments in the online ecosystem that supports the sale of those checks, we’re seeing several interesting things. First, the price of checks has dropped significantly. At the beginning of this crisis, we were able to purchase a personal check for $125 and a business check for $250.
At the height of this epidemic, we were able to purchase a personal check for $250 and a business check for $650. Nowadays, the price of checks has dropped dramatically, and you can actually purchase a check for an amount of up to $1,000 for as little as $20. Another really interesting development we’re seeing in the ecosystem is the shift from washing checks to cooking checks.
Cooking checks essentially means that folks scan the stolen checks to their computers, scan the signature of the check’s original, legitimate owner to their computers, and then manufacture fake checks, print them, and use them in their fraudulent operations. Unfortunately, we’re seeing very high-quality checks offered for sale in the ecosystem, with all the security controls and watermarks on them.
So that’s definitely something we need to be aware of. The last thing we need to be aware of is the correlation we’re finding between check theft and identity theft. At the beginning of this crisis, we believed that once a check was stolen, the only thing you needed to worry about was the balance in your bank account.
And even that wasn’t necessarily something folks needed to worry about. Oftentimes, if you realized someone stole your check within the relevant time period, the bank would reimburse you for the amount that was stolen from your account. But what we started to see in our own research was a correlation between check theft and identity theft here in the United States.
And that kind of makes sense, because in addition to the amount folks write on the checks they send to their loved ones or to the companies whose bills they’re paying, their personal information is also in the top left corner of the check. And so, unfortunately, we’re seeing a lot of criminals using this information to steal consumer identities and use those identities to try to open new bank accounts, take out new loans, or even get into new apartments here in the United States.
That concludes today’s episode on the fraudulent check ecosystem. Thanks for watching.
Learn more: Anatomy of a Fraudulent Deposit: Account Activity Patterns Behind America’s Check Fraud Surge
.png)
