Respond to check fraud fast enough to recover funds

This is your top priority -- stop the bleeding before you do anything else. Place an immediate hold on the account so no more money goes out. If it looks like an account takeover, block online and mobile banking access right away. Flag the account so that any transaction attempt triggers extra verification. From experience, here's what catches people off guard: fraudsters often test with a small check first, then hit you with a big one within 24-48 hours. So don't just freeze what's already happened -- watch for what's coming next. Order new checks and debit cards for the customer, and make sure the old ones are fully deactivated (not just flagged). Write down every action you take and when you took it. This timeline becomes your best friend later when you're filing claims or talking to law enforcement. If you can't place a full hold for some reason, escalate immediately -- don't sit on a half-secured account.

Now that the account is secured, it's time to build your case. Pull everything you can: front and back images of the suspicious check, the customer's signature card on file, transaction logs showing when the check was deposited and cleared, and any surveillance footage from the branch or ATM if available. Create a clear timeline of events -- when was the check written, deposited, cleared, and when did someone notice the fraud? This timeline is what makes or breaks your recovery claims later. For counterfeit checks, put them side by side with genuine checks from the same account. You're looking for differences in paper quality, font, check number sequences, MICR line formatting, and watermarks. Experienced investigators will tell you that counterfeit checks often get the routing number right but mess up small details like spacing in the address block. For forged signatures, compare against at least 3-5 known genuine signatures -- one sample isn't enough since people's handwriting varies day to day. If the comparison is inconclusive, don't force a judgment. Note it as inconclusive and move forward. Get a written statement from the customer as soon as possible while their memory is fresh. Ask them specifically: did they write this check, did they authorize anyone else to, and have they noticed any missing checks from their checkbook?

This is where you try to get the money back, and timing matters a lot here. If another bank paid out on a fraudulent check drawn on your customer's account, file a warranty claim or return the item through the appropriate clearing channel. The UCC gives you specific windows for these claims, so don't let them slip. If someone deposited a fraudulent check into an account at your bank, pursue the depositor directly. Freeze their account if there are still funds available -- you will often find that the money has already been withdrawn, but it's worth checking. Here's something that trips up newer investigators: make sure you're filing through the right channel. Check returns go through the Fed or clearing house. Warranty claims under UCC 4-208 are different from encoding warranty claims. If you're not sure which applies, ask your operations team before filing -- a wrong claim type wastes everyone's time. Keep careful records of every claim number, the date you filed it, who you spoke with at the other bank, and what response you received. Track your expected recovery amount against what you actually get back. Banks that track this well tend to recover much more over time because they learn which approaches work best.

You're in the home stretch, but don't rush the regulatory reporting -- getting a SAR wrong can cause real problems. If the fraud amount is over $5,000, you're required to file a Suspicious Activity Report with FinCEN within 30 days of discovering the activity. Even under $5,000, consider filing if there's a pattern or if the same person appears in multiple cases. When filling out the SAR, be specific and factual. Describe exactly what happened, include dollar amounts, dates, account numbers, and any suspect information you have. Avoid opinions or conclusions -- just lay out the facts and let the narrative speak for itself. Remember: you can't tell the customer that a SAR has been filed. That's a federal violation. File a police report if the customer requests one or if your bank's policy requires it for the fraud amount involved. Give the police your evidence package -- they'll often need the check images, timeline, and customer statement. Get the police report number for your records. Update your internal fraud tracking system with all the details: fraud type, amount, how it was detected, recovery status, and any suspect information. This data is useful -- it helps you spot patterns and catch repeat offenders. Close out the investigation with a final summary that covers the total loss, what you recovered, what's still pending, and any recommendations for preventing similar fraud. If you spotted a gap in your controls -- like missing Positive Pay on a commercial account -- flag it so the relationship manager can follow up.