"Our national check-writing habit is turning into an enormous problem" by Ron Lieber

Check fraud is growing rapidly, and there’s one big reason: Anyone with a smartphone can download an app and within minutes get access to bundles of stolen checks that thieves are selling in open forums.

Last week, I downloaded Telegram, a messaging app where fraudulent activity is particularly robust, and quickly found forums selling stolen checks. I called the people who had written the first 20 stolen checks that I found for sale to ask them if they were aware that they had become victims. They were not pleased.

So what’s the deal with this online market?

It starts with a pretty low-tech operation, after people pay bills, put checks in envelopes and drop them into a blue mailbox. At that point, criminals find ways to take them out. Or it’s an inside job at the post office, or elsewhere.

Next, the thieves choose from a number of paths that could involve selling the checks on Telegram, or keeping them. Either way, their next move is often to assume a fake identity in order to open a bank account where the check will end up. They typically will wash the ink off a stolen check, rewrite it to their new identity, deposit it, withdraw the money and then abandon the new account. Rinse and repeat.

 

It’s a fast-growing business. During the first year of the pandemic, the Postal Service received 299,020 mail theft complaints, an increase of 161 percent from the previous year, according to the Financial Crimes Enforcement Network. Financial institutions also reported triple-digit increases. Socure, a company that sells digital identity confirmation services to banks, says it believes there may be nearly 2.5 million so-called synthetic identity accounts out there in the world, sitting in wait for nefarious dealings.

The Telegram forums selling stolen checks are easy to find if you know the code words to search for. I didn’t, but bank security consultants do, and they provided me with a few to try. I spent just a few minutes looking and immediately lost count of the number of checks I found for sale.

 

“Telegram’s moderators actively monitor public parts of the platform and accept user reports in order to remove content that breaches our terms of service,” said Remi Vaughn, a Telegram spokesman. I didn’t buy any checks, but I did grab images of the account owner’s name when it was visible. (Sometimes, thieves blur that part when putting the checks up for sale.)

Right away, a few things were clear. Thieves often post batches of checks, and those checks often have something in common. One curious collection included four checks made out to the St. Simons Land Trust, a nonprofit that preserves open space and historical properties in St. Simons Island, Ga. They had round-number amounts that looked like donations, so I called or texted the people whose names were on the top left of the checks, the presumed donors.

Confusion ensued. Donors reported my inquiries to the trust. The next morning, I received an urgent message warning me that someone was using my name and contacting the trust’s donors. Its executive director eventually sent me a safe word (“coastalGA”) using the email address on my profile page on the New York Times website, and I confirmed that I was working on an article about stolen checks on the internet. 

In many instances, thieves steal checks before they reach their recipient. But in this instance, staff at the land trust received them, took them to the bank in person right away and deposited them. 

So how did the thieves get them? The trust does keep images of the checks it receives, which is a theoretical vulnerability, but it brought in consultants to scour its systems immediately after speaking with me and they saw no signs of a breach. 

Nevertheless, the trust has stopped scanning checks for now. I waited on hold for a while to speak to the manager at the land trust’s bank, Truist. Was someone stealing images of checks there? 

“Let’s work together to keep your account safe and protect you from fraud,” a recorded voice said, over a tinkly melody that sounded like a xylophone. The manager wouldn’t speak to me, and Kyle Tarrance, a senior vice president at Truist and director of media relations, declined to comment as well. 

Another group of checks I found were from the bank accounts of people who live in Bartlett, Tenn., or nearby. They wrote checks to TV Guide, Sears and the local water department, among other places. None of these checks seemed to have arrived at their intended destinations. One check writer told me that he had taken his envelope directly to the post office, but somehow his check showed up on Telegram anyway. Was it an inside job at that post office? 

A Postal Service spokesperson said inspectors were looking into reports of theft in the area, and would not provide more detail because of the active investigation. Other checks I found on Telegram seemed like one-offs — but turned out not to be. 

There was a single check that a couple in Bay Harbor Islands, Fla., had sent to the Center for the Advancement of Jewish Education. (One half of the couple, Violet Lagari-Libhaber, confirmed the facts with me after providing her own safe word, “bialy,” to make sure I wasn’t a criminal.) 

This check made it to the organization, which deposited it, but it still turned up for sale. Staff at the center do not know why, and this was the first it had heard of such a thing happening with checks made out to the organization. The couple called their bank, and the bank did its own search of online check fraud channels. 

There, it found an older check that the couple had made out to the same organization but that hadn’t been deposited. The banker told them that finding stolen checks online was common. They ended up with a new account number to protect their money. 

While my random sampling of stolen checks numbered just 20, the resulting confusion was enough to leave experts scratching their heads. “This is more convoluted than I even could have thought,” said Frank McKenna, chief fraud strategist at Point Predictive, which uses data to help clients prevent theft. 

He asked whether anyone had considered another possibility: that post office insiders steam open envelopes, remove checks, take pictures of them, reseal the envelopes, send the checks on their way and then go and sell the images of the checks. Nope, and so noted! Does Mr. McKenna write checks? “Absolutely not,” he said. “It has to be for something where they won’t take anything but a check.” 

 

NY Times: Ron Lieber has been the Your Moneycolumnist since 2008 and has written five books, most recently “The Price You Pay for College.” Tara Siegel Bernard contributed reporting. Susan Beachy contributed research.