The Art of the Steal

2

[LOOKING FOR

MR. GOODCHECK]

A few years ago, a man double-parked his rental car in Miami and was given a parking ticket. He was from Argentina, visiting on vacation. He stuck the parking ticket in his briefcase and it went back with him to Argentina. While he was unpacking his luggage, he came across the ticket. The fine was twenty dollars. He searched around in his pockets and found that he still had some leftover U.S. currency. He stuffed a twenty-dollar bill and two singles in the envelope along with the ticket, sealed it, and mailed it to the Miami city clerk.

When the city clerk opened the envelope, he noted that the man had overpaid by $2.00. Instead of sending him the $2.00 back, the city mailed him a check for $2.00. When the man opened the envelope and found the check, he thought it was too good to be true. He took that check, scanned it into his computer and changed the amount to what he deemed was a more appreciative refund—$1.45 million. He printed out the corrected check and deposited it in a bank in Argentina. The city of Miami dispenses many checks for more than $1 million, and so it was paid without question. Because we don’t have extradition rights with Argentina, the man got away with it. He became a millionaire from a twenty-dollar parking ticket.

Since he was never caught, I can only speculate on the actual mindset of the Argentinian. But I happen to think the guy was doing this little caper as a lark, just to see if he could get away with it. Obviously, since he knew the mechanics of how to forge a check, he had to be at least a little bit crooked. But I sort of doubt that he ever imagined he could succeed at something so outrageous; he just couldn’t believe that forgery had become so easy.

Oh, but it has.

THE TRULY NOTEWORTHY NEWS

Despite the fact that we read a lot of stories in the newspapers about someone downloading credit card numbers from a website, or manufacturing phony Visa cards in some warehouse in Queens, the truth is, check fraud is much more prevalent. And although the average value of a fraudulent check is less than one thousand dollars, the Office of the Comptroller of the Currency estimates that total check fraud losses exceed $19 billion a year (and if we start giving out more parking tickets it might get a lot worse). Visa and MasterCard losses are less than 10 percent of that. And bank robbers, by contrast, got away with a relatively paltry $68 million in 1999.

Payment by check is far and away the most popular form of payment in the United States, easily exceeding payments by cash and credit card combined. Americans wrote 69 billion checks in 1999, and every year they write a billion more. No one knows that better than criminals. That’s why worthless checks are one of the most serious white-collar crimes affecting businesses today. Every day, American banks, savings banks, and credit unions return 1.3 million worthless checks. That’s $27 million of bad checks, every single day.

But only about 2 percent of bad check passers are arrested, and only about 62 percent of all bad checks are ever collected. And the conviction rate for bad check passers is lamentably low.

A SLIPPERY SLOPE

Things have changed so much since my days as a check forger. Years ago, when a forger came to a city, there was a great deal of preparation involved if he wanted to forge checks. First, he would have to rent an apartment to establish a physical address. He’d try to find a place he could rent by the month so he wouldn’t have to bother with a lease. Still, he’d have to pay the first month’s rent along with a security deposit.

Then he’d go down to the County Bureau of Vital Statistics and search through the death records for the year of his birth. He’d find an infant who was born around when he was born and died shortly afterward. He’d copy the vital information off the infant’s death certificate—the mother’s name, the father’s name, and so forth. Armed with this information, he could apply for a birth certificate. After he got the certificate, he’d go down to the Motor Vehicles Department and get a driver’s license. Then he’d go to the bank and open an account. That was the risky part, because he had to identify himself to the teller to fill out a new account card and a signature card. Then he had to wait ten days for checks to be printed up. That gave the bank ten days to run a credit bureau report, ten days to check on where he said he was employed, and ten days to contact his previous bank to see how he maintained his account.

None of this is necessary today. You just buy your checks through TV Guide, one of the Sunday magazines you find in newspapers, or over the telephone. Anybody can order anybody’s checks. We’ve made it so easy for people to steal from us. In fact, we’re the only country in the world that does make it so easy. In every other country, you have to pick up your checks at the bank. In Australia, for instance, if you want to reorder checks, you have to physically go to your bank branch and place the order. When the checks arrive, you have to return to the bank and get them. Only recently have a few banks in Australia begun to entertain the idea of mailing reordered checks to customers.

This whole notion of ordering checks directly from vendors started in an entirely innocent fashion. About fifteen years ago, a woman in Colorado Springs, Colo., named Miriam Loo had a greeting card and gift company called Current, which she started in the basement of her home. She had the idea of selling novelty checks, personal checks with special designs on them. She began with dogs. There were so many dog-crazed people, she figured they’d get a kick out of putting their dog on their checks. Sure enough, orders flowed in for checks with Beagles and Cocker Spaniels. Then she expanded beyond dogs into sailboats, cars, birds, flowers, whatever you wanted. It was a nice little business.

The DeLuxe Corporation in Minneapolis, the king of checks, found out about this and said, hey, she’s encroaching on our turf. DeLuxe went and bought her company and entered the personal check business. At first, DeLuxe sold only to banks. Then it began to sell directly to individuals by mail. Banks didn’t like the idea, but DeLuxe didn’t back off. The three other check companies said, well, we’d never do that. But one by one, they entered the business. Since the late 1980s, advertisements like this have appeared in newspapers and in direct mail: “Get two hundred checks for just $3.95. Or get one hundred fifty duplicate checks for only $4.95.” There are more than 200 companies that sell checks through magazines and the Internet. And there are no controls over them. It’s all perfectly legal.

People can get anyone’s check. All they have to do is see it. Criminals nowadays will drive around until they find a ritzy neighborhood with million-dollar homes. They’ll knock on a door. When someone answers, they’ll say, “Boy, you’ve got a lot of leaves lying on your lawn. What’d you got, an acre here? I’ll tell you what, my buddy and I will clean up your leaves, leave the place immaculate, and it’ll cost you just seventy-five dollars.” The guy thinks it’s a great deal, the crooks clean up the leaves, and the owner pays them with a check for seventy-five dollars. That’s all they came for: the check. Then they go to the Internet and order the checks of a guy from a million-dollar home, forge them, and start cashing them. Next time, the guy will rake his own leaves.

Or forgers drive to a wealthy neighborhood and park in a grocery store parking lot. They wait until you pull in in your Porsche or your Jaguar and they follow you into the store. You buy groceries. You have to write your check on a little pad that’s sticking up on the counter. They’re right next to you, loading items onto the counter. They look over your shoulder—most of them are women—and they can memorize your check in eight seconds. All they have to do is glance over your shoulder. You haven’t gotten past writing the date, and they’ve memorized it. Everything on it. They go back and fill out an order coupon. Name and address you’d like on the check? They put your name and address on the check. Style of check? You’ve got flags on your check, so they order checks with flags. How many? Two hundred. Last question: if you’d like these checks sent to an address other than the printed address on the face of the check, so state here. They fill in a P.O. Box. Ten days later, they’ve got your checks.

And don’t think these activities are limited to personal checks. A Fortune 500 company in Chicago got ripped off when somebody outside the organization ordered the company’s business checks through a catalogue—and all he gave them to put on the check was the company’s name and address. He didn’t know where the company banked. He didn’t have an account number. He didn’t know who signed the checks. The person ordered two hundred of the company’s checks and had them sent to him. Then he went to all the grocery stores he could get to and cashed them, because the company was a household word and employed thousands of people. Its checks were gold.

Not long ago, a company in Long Beach, Calif., got a disturbing invoice in the mail from its check printer. The company’s checks were being shipped to 110th Street in Los Angeles. The problem was, the company didn’t have an office there. Someone had reordered the company’s checks and changed the ship-to location to 110th Street. The printer had gotten the reorder with an address change and had simply processed it. One way things like this happen is that criminals recruit company employees to steal check reorder forms. Or they buy them. A stolen check reorder form is worth one hundred dollars on the street.

WHAT TO DO

The solution is to order checks through your bank, not a mail-order catalogue. A crook can’t waltz into Chase or Citibank and try to order your checks. And when you buy checks through a bank, they usually have more security features on them to prevent forgeries. Mail-order houses don’t bother with these things, and that’s why their prices are lower. [Although prices may soar if other states follow Illinois’s example: Illinois, to my knowledge, is the first state to pass a law actually making it a felony to order someone else’s checks. If you live in Illinois and a catalogue sells your checks to a crook you can sue the catalogue company.] Businesses also ought to order their checks through a bank, or else directly from one of the major business check-printing companies, which dispatch a salesman and follow strict ordering procedures to keep your checks from falling into the wrong hands.

HEARD OF THAT SPERM BANK?

A big reason for the proliferation of forged checks is that the tellers and clerks who cash them don’t pay close attention to the IDs they get handed. Even if they do, it’s so easy today for criminals to obtain bogus IDs that look genuine. Recently, a man showed up in Salt Lake City and went around to local banks claiming to be a Russian official doing preparatory work for the Russian Olympic team in advance of the 2002 Winter Games. He had a fake passport and other well-crafted fraudulent documents, and as an added precaution he brought along a young female accomplice who posed as his interpreter. In just three days, banks cashed $90,000 worth of worthless checks for him.

For the less creative forger, there are numerous check cashing stores that require no ID whatsoever, which is the reason they charge steep commissions. But the criminal doesn’t care; the fee’s not coming out of his account.

Too often, tellers and salespeople ignore an important precept, which is to be impressed with the check, not the person. Once, to demonstrate the point before a hidden television camera, I put on an expensive suit and drove up to a bank in a Rolls-Royce, where I managed to successfully cash a fifty-dollar check written on a cocktail napkin because the bank teller was more impressed by my appearance than by what I had handed her. Remember, the way someone looks, what he drives, or how friendly he is has no bearing on whether a check is good. It’s all part of the scam.

I went into a store recently, and if this hadn’t happened I wouldn’t have believed it. I bought a piece of luggage and wrote a check for it. Within a moment, the saleswoman handed me the luggage on the counter and gave me my check back. I looked puzzled, and she said, “Oh, we have a new program. It’s called e-check, from TeleCheck.” I asked her how it worked, and she said, “Well, you wrote me a check, and I put it through this machine that looks like a Scotch tape dispenser. It read your account number off the bottom of it. Then I keyed in the amount of the purchase and it sent all of that data electronically to TeleCheck’s file. Three days from now, the money is automatically deducted from your bank account and it shows up on your statement as an electronic deduction. In the meantime, your check is your receipt.”

I was flabbergasted. I couldn’t resist asking her, “What if I’m not Frank Abagnale? Since you didn’t ask me for any identification, what if I happened to have forged this check? Where’s your evidence?” This is a forger’s dream come true. I write you a check, you give me the merchandise, and you give me the check back. When the police show up and ask for the forged check, you have to say, “Oh, we gave it to the forger.” It’s absolutely amazing. I’d like to know where this was thirty-five years ago when I needed it.

The truth is, people who cash checks today are often so blasé about it, that a forger hardly has to even try. You wouldn’t believe some of the ludicrous checks I’ve run across that stores saw fit to cash. One check cashed in a grocery store in Houston, Texas, for fifty dollars, was literally signed, “I Screwed You.” The bank wrote back, “unauthorized signature.” I guess so. Another check was signed, “U. R. Stuck.” A clerk took that one, too. Another check listed an ordinary person’s name in the upper left-hand corner along with an address. The address read, “Your City, U.S.A.” The bank was listed as National State Bank, also located in Your City, U.S.A. Still another check for ten dollars was cashed at a liquor store in Denver that was drawn off “The Sperm Bank of America.” Must be a new financial institution. The television show, “Dateline,” for a report on check fraud, managed to get a bank to cash a one-thousand-dollar check that had “void” written all over it and the message, “Please Don’t Pay Me. I Am A Counterfeit Check!”

HOT CHECKS

The most common type of bad check is the proverbial “hot” check. A hot check is a check drawn from a legitimate checking account that lacks the funds to cover the amount, or has been written off of an account previously closed.

There are a number of ways to detect a hot check, but many people who cash checks fail to know the easiest one of all. Ninety percent of hot checks are numbered in check sequence between 101 and 200. A check numbered 118 would represent an account about three weeks old. A check number of 1315 suggests an account that’s about three years old. Hence, many retailers over the years have become very leery of cashing so-called new account checks with numbers less than 200.

To circumvent this, bad check passers, when they set up accounts, try to obtain the highest possible check number they can get. This is usually done by asking the new accounts department to start their checks with a sequence number like 800. In many cases, they are denied. Most banks use a standard starter number of 101 for new checking accounts. Unfortunately, in recent years many new accounts departments have become very lax and, to oblige customers, will let them start their account with any number they request. Or they don’t pay attention to unusual reorder activity, even though criminals reorder checks every twenty or thirty days so they can get a higher sequence number. If all else fails, a criminal can buy checks through the mail, requesting any sequence number he wants.

For this reason, you can’t depend on the check number alone, but it’s a good tip-off for when you should use discretion. If you get a low-numbered check, that would be the time to ask for additional identification, to call the bank if it’s a large purchase, or to use a check verification company to guarantee the check. Remember: 90 percent of worthless checks are numbered between 101 and 200.

WHAT CAN BE DONE?

Over twenty years ago, a technique was developed that is referred to in banking as “date coding.” A date code is a tiny three-digit or four-digit number that appears on the front of a check to indicate when the account was opened. For example, the number 879 would mean that this checking account was opened in August of 1979. This coding is done automatically by the check printer. No matter how many checks a customer orders or reorders, this number will always appear on the face of the check. The date code helps you determine the stability and credibility of the person writing the check. Even checks ordered through the mail from a catalogue will have a date code on them if it’s required by the state where the person lives.

I recommend that all institutions date code checks. And I recommend that retailers teach employees how to read date codes on checks. The date code is sometimes found above the signature line or above the “pay to the order” provision, but most commonly next to the customer’s name. The older the date code, the more established the person who has written the checks.

THOSE HANDY DEPOSIT SLIPS

I was speaking one day with a new acquaintance, and I asked him for a business card so I could stay in touch. After fumbling around in his pockets, he could only come up with a deposit slip from his personal checking account. He handed it to me with a smile. I smiled back and told him, “I’m the last person you want to give this to.”

Deposit slips seem harmless enough. That’s why most people write grocery lists on them, hand them out as business cards, or simply discard them when they run out of checks. But a deposit slip is actually an exceedingly valuable slip of paper. To a forger, a deposit slip is worth ten times more than a blank check.

The slips are used in a common scam called “less cash deposit” or “split deposit.” After obtaining a blank deposit slip, the criminal will write a forged check to the person named on the deposit slip. He’ll then proceed to the bank listed on the front of the deposit slip, and deposit a check in the amount of, say, six hundred dollars. In the line “less cash received,” he’ll write three hundred dollars back. The teller, especially a busy one, will think, Why should I bother to ask for ID? The person is obviously a customer of our bank and has enough funds in the account to cover the check. Plus, he’s depositing more than he’s withdrawing. She hands over the cash and the check writer drives away three hundred dollars richer. The bank is stuck with a worthless check. Less cash deposit scams occur more than two thousand times a day at drive-up windows of banks, savings and loan institutions, and credit unions.

WHAT TO DO

I advise tellers to pay very close attention to less cash deposits. Anytime you return more than twenty-five dollars to anyone you don’t know, ask for identification. Deposit slips also have date codes on them. Look at them, because they can give you an idea of the stability and credibility of the account. And I tell everyone, don’t give out blank deposit slips at the bar instead of business cards, or leave them in the grocery store cart.

STOP PAYMENT START-UPS

Many companies and municipalities have been burned by stale-dated stop payment orders. In these cases, dishonest recipients receive a check, then tell the issuer that it never arrived. So the company will place a stop payment order on the check and issue a new one. The second check is immediately cashed. The original check is saved for a rainy day, which usually comes about six months later.

Shrewd con artists know that stop payments at most banks are good for only 180 days. After that, they expire. At that point, they have to be renewed for another 180 days. The trouble is, few companies bother to renew them. The con artist will patiently bide his time for 181 days before negotiating the second check, which will pay almost every time.

WHAT TO DO

A little extra investment on the part of the company can easily prevent this scam. Put an extended stop payment period on the check, like 999 days. The bank’s limit for a stop payment period needs to be a three-digit number, and 999 fits as easily as 180. Even the most patient con artist doesn’t have that much patience. At most banks, stop payments cost between a dollar and two dollars a month. Many companies have dozens or even hundreds of stop payment orders in effect at any one time. Although the cost can add up, the exposure for loss is far greater.

FORGERY: HOURS OF FUN

Now, let’s take a look at forgery. Forgery has increased considerably since 1975. The major reason for this is technology.

Twenty-five years ago, it used to take me twelve weeks to create a check. A truly sophisticated forger needed a four-color printing press that cost a quarter of a million dollars. Today, I can create a check with a laptop computer, a laser printer, and a scanner in my hotel room in twelve minutes. The New York Times once calculated that a forger can buy everything he needs for about five thousand dollars. Of course, it doesn’t cost him anything. He pays by check.

A number of years ago, a business writer submitted an article to Forbes magazine, and the editors printed it, paid him, and also sent him a check in the amount of $333.33 to cover his expenses. The writer lived in a one-bedroom apartment in Boston, and he owned an old Apple computer, a printer, and a scanner. As an experiment, and with the blessings of his editors, he decided to try to demonstrate how easily he could transform that meager check into some real money. So he laid the check on the scanner and brought it up on the screen. Once it was on the screen, he could do anything he wanted to it.

He zoomed in on the amount box, locked on it, and removed the dollar amount of the check with his mouse. Then he went to the written legal amount of the check and deleted it. Then he asked the computer to identify the fonts. Back then, a home computer could match 122 fonts. Today, computers can match thousands of fonts. In just a few seconds, he was able to pretty closely match the font at the printer at the accounts payable department at Forbes magazine. Using that font, he typed in a new amount number. He put the machine on pause and went out to a stationary store. He asked for green basketweave check paper, which anyone can buy at Office Depot, and bought enough to serve his needs. He also picked up a mechanical number stamp and some red ink.

He went home with his supplies, took the white paper out of the printer, inserted the green basketweave paper, and printed out the new check. He forged the two signatures it required using two different pens. He needed the number stamp so he could reconstruct the ink of the check number in red. Using an Exacto knife, he cut the check out of the 81⁄2 x 11 sheet so he could bring it down to the appropriate size. Once he was finished, he ended up with a check for $3O,333.33, which he felt much better reflected the value of his services.

He deposited the check by opening up an account at Bank Boston. They told him there was a five-day hold period, and he said that was no problem. He didn’t return for twelve days, at which time he withdrew all but a hundred dollars. Sixty-two days later, an auditor at Forbes caught the forged check, but by then it was a little late. The writer then crafted a story for Forbes about check fraud, in which he revealed the details of his own little charade. Forbes put a picture of the fraudulent check on its cover.

This little caper is called scanning, and it’s one of the most popular forms of forgery and certainly the simplest. Scanning started to emerge as a problem in the early 1990s, and it has really caught on significantly in recent years.

In Springfield, Mass., a man changed a $3.00 refund check from L.L. Bean into one for $30,000. Then he changed a $2.39 bakery refund check for stale cinnamon buns to one for $15,552.39. In North Carolina, a well-dressed young man convinced an automobile dealer to accept a cashier’s check for $50,000 from Wachovia Bank, in exchange for a new Mercedes 300SC. It happened to be six in the evening, when the bank was closed, but the dealer was not about to turn away a nice piece of business. Little did he know that the cashier’s check had originally been made out for $5.00 and altered to $50,000, and that before the bank opened the next day the car would be two states away, with fake license plates and a new paint job.

DO YOUR BANKING WITH THE IRS

And sometimes, you don’t even need all that technology. For example, people always seem to require extra cash around tax time, and criminals are no exception. So they get it from you. Say you’ve had your tax returns prepared and, like most of us, you owe the IRS some additional money. For argument’s sake, let’s say it’s $1,500. You sign your return, insert a check made out to the IRS for $1,500, and drop it in the mail. As far as you’re concerned, that ends the pain for another twelve months.

Not quite. The pain actually just doubled. Your package was “lifted” while in transit to the IRS. Envelopes to the IRS are common targets because of where they’re going. The check was removed and the rest of the return trashed. With a few pen strokes, the thief easily altered the check so that it was made out to a Mrs. Smith, and deposited it into a fake account. All he did was change “IRS” to “MRS” and add “Smith” to the payee line. Not only did you lose the $1,500, but you still owe the IRS another $1,500, plus late charges. Talk about double taxation.

WHAT TO DO

The easy solution is to fill out the entire payee line. If you had written “Internal Revenue Service” instead of “IRS,” this scam would not have worked.

SURE, YOU CAN TRY THIS AT HOME

Today, forgers drive around in industrial parks where there are big office buildings, and look into those large mailboxes standing in the parking lot. They’ll tell you that five years ago, they used to have to fish into those mailboxes, sending a line down and yanking the mail out, but they don’t have to anymore. Today, they drive up at a little after five in the afternoon, and there’s so much mail stuffed inside that it’s literally flowing out of the box. They just reach out of the car window and scoop it up. Any reasonable quantity of mail will always contain at least one envelope with a window in it that says, “Pay to.” Inside is a check payable to a construction company or a public relations firm—it doesn’t really matter who it’s addressed to. It’s not going to them anymore.

The odds are it’s a laser check, and that’s just what forgers want. Just about every company in America, no matter how big or small, has moved from a matrix printer to a laser printer to disperse payroll and accounts payable checks. It’s faster, it’s cleaner, and it’s more efficient. With a laser printer, these companies can buy blank check paper, lay it in the cassette, and actually print the entire check—the company logo, the bank’s logo, the routing numbers, the account number, even the signature.

Now a laser printer is a non-impact printer—in other words, there’s no ink put into the paper. A matrix printer shoots ink into the paper. A jet printer puts ink into the paper. A typewriter puts ink into the paper via the ribbon. With a laser printer, toner is applied to the paper by heat, so the toner is sitting on top of the paper. Which is why we call it non-impact printing.

Years ago, when criminals stole, say, a thirty-thousand-dollar check made out to a construction company, they would bring it to a forger and explain that they wanted the forger to get rid of the payee name, so they could type in a new name and cash the check. Fine, the forger said, it’ll be done in two weeks. The criminal was aghast. Two weeks? The forger said, hey, you’re asking me to move ink off of paper. He had to extract the ink using bleaches, solvents, acetones, hydrochlorides, polarized chemicals, non-polarized chemicals. He had to take each letter, and do it slowly, or else the check would become abrasive and you’d notice it.

With today’s laser checks, criminals have devised a new methodology. They take a piece of Scotch tape—the gray, cloudy kind that doesn’t rip the paper when you peel it off—and put it over the dollar amount and over the payee name. They use a fingernail to rub it down hard over the check, and then lift the tape off. The dollar amount and the name and the address will come off on the tape. The toner attaches to the Scotch tape and gets pulled from the fiber of the paper. If there’s any laser toner residue left over, a little high-polymer plastic eraser will take care of that. Sometimes forgers use dental picks, razor blades, or dry ice to remove the toner, but Scotch tape works quite nicely.

People are shocked when I tell them this, and then they go back and try it and sure enough that’s what happens. So any idiot can take a strip of tape and remove the nine dollars off a check and type in nine thousand or ninety thousand.

And that’s what the forger collecting the mail does. He uses tape to remove the payee’s name and address, and of course, the amount. He types in his name and the amount he wants, and deposits it at the bank. Sixty days later, the construction company that was supposed to get the check calls the payer and says that it hasn’t gotten its money. The payer calls the bank, but it’s too late. The money is long gone.

It’s that simple, because we make it that simple.

REVENGE OF THE SCIENCE GEEK

Forgers must have all had chemistry sets as kids, because another thing they love to do is to chemically alter checks. It used to be that the only chemical banks had to worry about was bleach. If banks used bleach-sensitive paper, they’d be protected. Today no forger uses bleach. Instead, all sorts of simple chemicals, like acetone, are used to modify checks. What’s the product of choice from which to get acetone? Nail polish remover. It’s 99 percent acetone.

If someone mails me a check today for nine dollars, but they’re a Fortune 500 company and I know that they have a bit more than that in the bank, I do a little chemistry experiment. I take that check, put Scotch tape over the signature of the controller, put tape on the back of the check where the signature would be on the front, lay that check in a cake pan, take some nail polish—no other ingredient—and pour that bottle of nail polish over the check. In a matter of seconds, everything that was put there by a typewriter, laser printer, jet printer, matrix printer, ballpoint pen, or flair pen is off the check. Because acetone removes anything that’s not a base ink. So the company’s logo, the bank name, the check number, and the borders of the check will stay. But anything that’s typed on or printed on by a laser printer disappears within fifteen minutes. It’s called washing the check.

I take the check and dry it with a blow-dryer. I remove the Scotch tape which prevented the acetone from getting into the controller’s signature. What’s left is a nice dry blank check signed by the controller of a Fortune 500 company. I call the bank that the check is drawn on, and ask, “Would this account clear a check for twenty-thousand dollars?” “Oh, sure, the funds are available,” I’m told. I stick the check in the typewriter, fill it out for twenty-thousand dollars, go down to the bank, they check the signature, and they give me the money.

A couple of years ago, four thieves cruised around the more prosperous neighborhoods in South Bend, Ind., as well as communities just over the border in Michigan, looking for mailboxes that had their flags up. The guy riding in the passenger seat opened the boxes and sifted through the outgoing mail. When he found someone who had paid their telephone bill or electric bill, he removed those checks from their envelopes and took them. The thieves washed them in nail polish remover, blow-dried them, filled in new names and much higher amounts, and cashed them at local banks. This mailbox caper goes on every day all over the country, usually near the last day of the month when the odds are best of finding checks. Since people generally leave outgoing mail in their mailbox before heading to work, criminals will steal checks in the morning, wash them, and cash them by the afternoon. A lot of the check washers are drug addicts. The same chemicals that they use to cook their drugs, they use to wash checks.

HOW BUYING TIME BUYS YOU MONEY

Often a forger needs to buy time to get away with passing fraudulent checks, and so he resorts to some other little modifications. First of all, every good forger alters the numbers along the bottom of the check. Inside a set of brackets is a nine-digit number. That’s the bank’s routing number, and it’s like a zip code. When you cash the check, that number allows the check to be sent back to the bank where your account is. The first two digits of that number signify the Federal Reserve Bank in your jurisdiction. For example, New York would be 02. There are twelve federal reserve banks scattered around the country; like a dozen eggs, there are a dozen banks. The numbers are assigned from east to west: for instance, 01 is Boston, 03 is Philadelphia, 08 is St. Louis, and 11 is Dallas.

Let’s say you have a company check from a bank in New York and the company is in New York. You can color-copy fifty of them. That’s quite simple. But if you start cashing them today at supermarkets in the New York area, by tomorrow the bank knows about it and the company will complain that these are forged checks. They call the police, and they send out a bulletin that you’re out there passing bad checks. How many places could you get to in a day? Ten? If you got on the New Jersey Turnpike with all its traffic, you wouldn’t get to the next exit.

But what if I drop the “0” and replace it with a “1”? When I cash the check, the clerk at the courtesy booth at the supermarket will look at the name of the bank and recognize that it’s a New York bank, so it’s a local check and he has no problem cashing it. But when the store deposits the check, by changing that number, just as if I had altered a zip code, I force that check to go all the way across the country to Hawaii to clear. When it gets to Hawaii, someone notices that the routing number is incorrect and puts a white strip called a Lundy strip across the bottom of the check over the old routing number and sends it back. But by the time that happens, two weeks will have passed. So I have fourteen days instead of one day to wander all over New York cashing bad checks. Forgers live on the theory that stall creates float and float equals profit.

WHAT TO DO

I always train people to know their Federal Reserve code numbers. If a teller in New York sees a New York check, that should have 02. If she sees 12, that tells her she’s looking at a forged check.

Any government check always has as its routing number, “000000518.” Forgers who forge government checks remove the first three zeroes and encode the check with the code of a bank in another state. That way the computer treats the check as an ordinary business check, and routes it to a destination other than the U.S. Treasury.

IN ADDITION, BE SUSPICIOUS IF . . .

Most forged checks don’t have perforated edges. Real checks do. The only exception to this rule are United States Government Treasury checks. Forgers could create checks with perforated edges, but few bother as it’s expensive. When forgers buy check paper, they usually buy standard 81⁄2 x 11 sheets. They print out three checks on a sheet of paper and then cut them apart. When you’re handed one of their checks, there is no perforated edge anywhere on the check. It’s smooth on all four sides. That’s usually a dead giveaway that it’s a forgery.

Most forgers don’t use magnetic ink to do the routing numbers. It’s not because they aren’t able to. Anyone can go into an office supplies or computer store, and buy a magnetic ink cartridge for their printer. Forgers don’t do it because of the float. Meaning, if I put magnetic ink on the check and cashed it at a grocery store, the bank computers would read it overnight and reject it. But if I use regular blank ink, the computer in the clearing house can’t read it. The next day, the check will have a Lundy strip put over the routing number. They’ll reencode it with magnetic ink, but they’ll still use the routing number that I put on the check. It’ll still go to Hawaii, but now I’ve bought two more days. If you’re passing six- hundred-dollar checks and you’re doing ten a day, that’s twelve thousand dollars more profit.

DON’T KEEP IT SIMPLE, STUPID

One of the main reasons forgers are so successful today is because we give away so much information. Businesses commonly establish an M.D.A., or maximum dollar allowed amount, for their checks. That puts a cap on the amount a check can be written for. A company, for instance, might set up its checking account with instructions that checks are not to exceed $1,500. The bank will lock that into their software, and if a check comes in for $1,500.01, it will reject it. It’s a great feature, except many companies print those instructions right on every check: “Not valid over $1,500.” That tells every forger, if you’re going to forge this check, you better stay under $1,500. Why are you telling the forger how to defraud you?

Or a forger will pick up a check that says right on the face, “Two signatures required on checks over ten thousand dollars.” He’ll simply make sure he puts a second forged signature on the check.

Here’s another way that companies unwittingly assist criminals in robbing them. If you look at the annual report of any Fortune 500 company, on page two or three is the signature of the chairman of the board, the chief financial officer, the treasurer, the controller, all in camera-ready art. That’s where most forgers get their signatures for fraudulent checks, straight out of annual reports. A forger digitizes that signature, puts it on a check or letter of credit, and he’s in business. Your business.

When you prepare an annual report, put in a picture of the officer, put in the name of the officer, and put in the title of the officer. But don’t put in the signature. If you feel some obligation to show a signature, have an artist do a rendition of it rather than the true signature. If you do include the real signature, that signature is going to show up on a check that you won’t be happy paying.

Except on large checks, what’s remarkable is a forger doesn’t even need a signature anymore. On most checks, banks don’t bother looking at signatures, because everything is automated. Banks process 69 billion checks a year, and nobody really sees most of those checks. Banks practice “selective check inspection,” whereby they set a limit below which they will clear checks without examining their signatures. It’s rare nowadays for a major bank to look at any check for less than twenty-five thousand dollars. These checks whisk through a high-speed bank check sorter at a rate of two thousand items per minute, or forty checks a second. When the checks go down the sorter rails, they’re traveling at a speed in excess of four hundred miles an hour! The machines could do it quicker, but the checks would catch on fire.

Thus, if the check is under a designated amount, no human eye looks at the signature. If I scribble an “X” or write “Elvis Presley” on a one- thousand-dollar check, or don’t sign it at all, the check is still going to clear the bank as long as the funds are in the account. “Dateline,” during its report on check fraud, had no difficulty cashing small checks signed by “Porky Pig,” “Bugs Bunny,” “Attila the Hun,” and “Bill Clinton.”

On those checks, you can’t fault bank employees for missing suspicious signatures. But you can on higher amounts. At many institutions, there are rules for when someone from the site review area must verify signatures. At most community banks today, it’s $5,000. At most mid-sized banks, it’s $10,000. At the nation’s top fifty banks, it’s $15,000 to $25,000 before any human being in site review looks at that check. But here we run into another problem: there’s not much emphasis on training anymore. Years ago, for instance, every city used to have a chapter of the American Institute of Banking, which was the educational arm of the American Bankers Association. When banks started to merge and began to create multiple branches, however, bank managers said, “I don’t want to send my teller out to some training program that I’m not controlling, so I’ll train my own tellers.” A lot of banks teach the teller how to handle all the money in the window, but don’t tell them anything about how you recognize a counterfeit bill or how you recognize a fraudulent check. And smaller banks simply don’t have the resources to train their personnel. New hires get trained by whoever is standing at the next window. What that person doesn’t know, new tellers will never know.

DON’T GET YOUR WIRES CROSSED

When someone wants to forge a company’s check, one of the most promising ways that he gathers the pertinent information is by calling his victim and asking for it. When the company switchboard answers, he asks for the accounts receivable department. He tells them that he’s getting ready to wire the company some funds, and asks for the wiring instructions. He could call up any company in the world, and as soon as he says that he’s going to wire them some money, the company will tell him where it banks, on what street, in what city, what the account number is, and what the transit number is. What more could you ask for? What the forger is essentially asking is, how do I write drafts on your bank account? And you’re the one telling him. Ten years ago, you had to corner someone in the parking lot and bribe him to write down that information on a piece of paper. Now you can get it for free with a simple telephone call.

WHAT TO DO

Obviously, any company getting wires every day has to give out the information over the phone, in order to allow people to electronically transfer money to its accounts. But there’s a way to prevent this kind of fraud. All you have to do is open up what’s known as a non-negotiable incoming wire account to receive your wire transfers. So when people call up and ask for that information, that’s the account you give them. Funds that come into that account by wire can’t be withdrawn, can’t be taken out verbally, and can’t be taken out electronically. The only thing you can do is put money into the account. Those funds are held there until the end of the bank day, at which point they’re moved to the account that you write checks on.

THE BUCK STOPS WITH YOU—SO YOU’D

BETTER GET THE CHECK RIGHT

In the old days, the bank was entirely liable if it paid a forged check. At that point, companies would say, well, I don’t care about my checks. If somebody forges a check, I’ll catch it in my audit, take it down to the bank, and they’ll give me my money back. And if they don’t, I’ll find another bank to do business with.

Because of changes in the law, it doesn’t work that way anymore. If the bank can prove that you were negligent in any way, then they don’t owe you the money. Say you work in accounts payable and asked a clerk to cut you a check for $63,000 to pay an invoice. The clerk cut the check and then brought it to you. It was five o’clock, time to go home. You were going to mail it with some papers, but you say, oh, I’ll just do it tomorrow. So you put it all in your out box and go home. The janitor comes in, takes the check, cashes it, and it clears the bank. You ask the bank for your money back. Forget about it. You were negligent in leaving the check lying there, and your negligence led to that forgery.

Due to the shift in liability, businesses need to make their checks more secure. There are an array of security features to do just that. I do a lot of check designing, and I advocate the use of a technique called layering, in which a number of features are added to the same check. Why? Because different protection features respond differently to fraud methods. By combining several features, attempting to circumvent one security feature can enhance the protection provided by another.

WHAT TO DO

First of all, you need to use a check that’s difficult to forge or alter. Too many companies just use that familiar green or blue basketweave check paper, because it’s the cheapest. The companies run it off on the laser printer and they have no controls at all on the paper.

To guard against forgers who use chemicals to alter checks, you need to order chemically sensitive paper. You have to ask the printer, If someone touches it with bleach or ink eradicators, what’s going to happen? Good paper stock is sensitive to at least nineteen chemicals—chemicals like bleach, acetone, solvents, and hydrochlorides. Whenever these are used to alter a check, the word “void” appears in the background of the paper in three languages, English, Spanish, and French. The word should just appear right from behind the paper as soon as you touch it with any of those substances. At the very minimum, the check should change color. It should go from a blue check to a green spot or a brown spot on the check.

So if someone is issued a check and tries to chemically alter the amount, he’s out of luck. He can’t go back to you and say, “Look I tried to forge your check and this void showed up all over.”

I told you about how forgers use Scotch tape to remove information off laser-printed checks. To solve this problem, when you buy laser paper for your checks you need to ask the supplier if it has “toner anchorage.” Sometimes this is called “LaserLock” or “Toner Lock.” This is a chemical that is put in the paper during the paper-making process to ensure that documents printed on a laser printer are secure. When the toner is applied, the chemical that is already in the paper is activated by the heat process and when the chemical and the toner mix, the toner is locked to the paper. It’s impossible to scrape it off and tape won’t remove it.

When you print checks, you should remember to use a font that is 12-point or higher. If you use small type, there’s a lot less toner to take off. It’s easier to remove with a piece of tape. If there’s some residue, a forger just uses a bigger font to cover it up. A large font is less likely to be tampered with. It would take a forger all day with Scotch tape to remove the toner, and the process would leave a bigger area to cover up if anything does remain.

There are so-called “secure-number fonts” that make tampering with check dollar amounts impossible. Secure-number fonts are software that is loaded into your printer so that the dollar amounts print in a style that can’t be altered. For instance, in the dollar amount box, the program reverses the toner, sending it to the back of the paper, so that numbers print white against a black background, and the toner background is permanent. The program will also print each numeral of a number in a different style, so that numerals can’t be moved to change the amount. A secure-number payee font that does the same thing for the payee name is available as well.

A lot of times we number checks with a red ink or a black ink, and ink is removable. So I number checks with dye. It bleeds through the paper to the back of the check, and it stays on the check for the life of the check. This is known as dual-image numbering (in Canada, it’s called halo numbering), because you can see the number on both sides of the check, and it makes alteration nearly impossible.

Very often, I encounter companies that are more interested in company image than inventory control. All they have is blank-check stock with their company logo printed on the paper, handsomely done in four color up on the left-hand corner. Everything else is blank.

I always say to the company representatives, “What if I put one of these blank pieces of paper in my pocket? How would you know I had it?”

“Uh, we wouldn’t.”

“Well, think about that,” I say. “I’ve just walked out of your company with your check. I’ve got a laser printer at home. All I’ve got to do is run it through the printer.”

If all your company is going to do is have its logo on blank-check stock, you should ensure that inventory check numbers are on the back of each page. That number will allow you to control your unprinted check inventory.

One of the most basic and effective security features you can build into your checks is called a “void pantograph,” which is printed in the background of a check. The way it works is the word “void” is put into the background in a dot pattern that isn’t visible to the human eye. However, when a check with a void pantograph is copied or scanned, the word “void” appears along with it.

Look closely at some checks and you’ll see what are called laid lines, which are evenly spaced lines on the back of the paper. I always put them on checks I design, because if someone takes a razor and slices the check and alters it, I want to know about it. Enhanced laid lines were introduced in 1997 that are similar in intent, but they use unevenly spaced lines and afford an even higher level of protection.

Another relatively new security feature is thermochromic inks, which disappear or, in some cases, change color when they react to heat and moisture. They will actually fade and then reappear again. Thermochromic ink can be found on the back of a check in a pink strip beneath the endorsement. Or it can be found on the front of the check in a corporate logo or seal. Run your finger over it and the heat from your finger will cause it to vanish. Let go, it comes right back. Day after day, year after year, just touch it and it disappears and then comes right back.

Other worthwhile antifraud techniques include artificial watermarks, messages that are visible only when the check is held at a 45-degree angle and aren’t picked up by copiers and scanners; warning bands, which are statements printed on checks that point out design elements to look for (no warning band is any good unless you add the words, “Do not cash,” “Do not accept,” or “Do not negotiate” before or after the warning); and microprinting, a technique where words or phrases added onto the check in letters so small they are legible only under a magnifying glass. It used to be that microprinting could only be done in a straight line, but circular microprinting is now possible so you can put messages in as logos, or pictures.

Companies always ask me, “Well, we buy two hundred thousand checks a year, or a million checks a year, or two million, how much more will these things cost me if I incorporate them?” The answer is very little. With that kind of volume, adding these features won’t add much cost. One other thing that I tell businesses is you need to secure all of your checks, not just some of them. All the time, I encounter companies that use secure features in payroll checks and accounts payable checks, but not in refund checks.

“Why not?” I ask them.

“Oh, they’re always for small amounts,” they say.

Their policy should be the exact opposite. Payroll checks go to employees who you know. Accounts payable checks go to vendors who you know. But refund checks go to complete strangers. They’re the checks most in need of protection. Unfortunately, what criminals do today doesn’t enter a comptroller’s mind until his company suffers a loss.

BUT DO THEY WORK?

Believe me, these features really work. In 1993, Imperial Bank in California hired me to redesign its company check. The bank was having big problems with check fraud—to the tune of $3 million a year. I came in, and working with the printer, gave them some security features and helped them tighten their internal controls. The bank began to offer the new check to its customers at the same price as its regular check. It looks just like a regular check, and comes in a lot of colors and styles. The check-fraud losses fell to about $120,000 by 1996, a 96 percent decrease after three years of using the new check. This check is called SafeCheck, and is manufactured by a company that goes by the same name.

People often come up to me and say, You design these secure checks for corporations, why don’t you design a check for me, the consumer? So I’m working to produce a secure consumer check. It will have twelve security features, including paper that reacts to twenty-four different chemicals, high resolution borders that are difficult to duplicate, white “chemical-wash detection boxes” that change colors with chemical tampering, and embedded fibers that glow under ultraviolet lights. But I’ve also told the manufacturers that whenever it takes an order, it has to verify the order with the person’s bank. If someone changes his address, that has to be verified. It makes no sense to create a secure check if any criminal can order it.

When I design a check, I follow a little routine. I send a sample to three places: a graphics house in Australia, an Australian forensic document examiner, and a U.S. institute of technology. I ask each of them to create their best replica, so I can test how secure it is. At the institute, they select a smart student and give him access to the most sophisticated computer equipment, literally millions of dollars of gear. The last check I sent there, the student took a month’s worth of manhours to produce a good replica. That told me I had a great check. As I’ve said, nothing is foolproof, but if it takes a clever student a month with millions of dollars of equipment to produce a counterfeit, I know few criminals have a prayer.

The other thing I learn is which features work best. Lately, I’ve been working with prismatic printing, which puts a multicolored, rainbow-like background on the check. It’s very difficult to photocopy.

YOUR FIRST LINE OF DEFENSE IS YOU

If we’re ever going to stop fraud, everyone has got to become a bit more vigilant. My guess would be that half of all Americans don’t bother to reconcile their bank statements. They don’t even open them. And what they don’t realize is that they’re liable for errors, because they generally have thirty days to notify their bank of a discrepancy, and sometimes less than that. Let’s say I did get hold of your check and I filled it out for $2,000, and you never bothered to look at your bank statement. A month or two later, your husband says, “Hey, we’re overdrawn at the bank.” You say, “That’s impossible. I’ve got $2,000 in the account.” The bank says, “Oh no you don’t, you’re overdrawn.” Now you go back and open that envelope and discover a check for $2,000 that you didn’t write. You didn’t sign it. Guess what? It’s too late. The bank is not going to restore your money. But most people don’t realize this until it happens to them.

A Wisconsin man named Borowski had two checking accounts with Firststar Bank. One was his personal account and one was for his father’s estate. Borowski said that his fiancée stole $50,000 from his account, and $100,000 from the estate account. She did it with forged checks and unauthorized telephone transfers. She even left forged handwritten notes in the bank’s night depository box requesting cashier’s checks. When the monthly bank statements and $20,000 in cashier’s checks were sent to Borowski, his fiancée intercepted them. When Borowski discovered the theft, he sued the bank to get his money back. Presumably, he also called off his impending marriage.

The case went to court. The bank pointed out that Borowski’s signature card agreements required notification to the bank of unauthorized checks within fourteen days of the statement date. Borowski said he hadn’t received the statements, because his fiancée got hold of them and lied about them.

The court ruled in favor of the bank. It said that as long as the bank had mailed the statements to the customer’s proper address, it had upheld its part of the bargain. The court did rule in favor of Borowski on the $20,000 in cashier’s checks, however, because the bank didn’t include the handwritten notes with the bank statement.

GET GOOD BACKUP: POSITIVE PAY

There is a product out in the marketplace, and already about 60 percent of the nation’s major banks offer it. It’s called positive pay. I feel that positive pay is the greatest concept available to deal with the problem of forgery or fraud. In most cases, the bank provides it for a minimal fee. If it doesn’t, look on it as an insurance premium to guard against losses from fraud.

The product is really quite simple. Say I’m a company and I write fifty checks a day. I could write five a day or five thousand a day, it doesn’t matter. At the end of each day, I download a list to the bank over my modem of all the checks I wrote that day and sent out in the mail. The list, called an issue file, simply runs through each check number and the amount of the check. The bank doesn’t want to know who I wrote the check to.

The file goes down to the bank and is stored in a program called positive pay. The checks go out in the mail and, lo and behold, a forged check shows up. I wrote a check to a guy for $250 and he color-copied fifty of them. I don’t care. I’m on positive pay. I wrote a guy a check for $200 and he altered it to $2,000. I don’t care. I’m on positive pay. The point is, when the forger goes to cash that check, it will go to the first bank of deposit, and then it will come to your bank. But because that check doesn’t match a check on your list, it will be rejected. No match, no pay. If you didn’t write it, the bank isn’t going to pay it. The computer will say, I have one refund check for $250, but I don’t have fifty, so I’ll pay one and return forty-nine. I have one check for $200, but I’ve searched the file and I don’t have one for $2,000, so it returns the check unpaid.

Now there are some small businesses that love the idea of positive pay, but they don’t have a computer. I ask them, Do you have a fax machine? Yeah, they have that. Well, your bank can put you on reverse positive pay. At eight-thirty in the morning, your bank will fax you a list of all the checks written by you that came into the bank last night to be paid today. You’ll have until two-thirty that afternoon to look over that list. If everything looks fine, you don’t have to do anything, just throw the list away. But if you find a discrepancy, you call the bank and tell them to fax you that check. If you look at it and it’s not your check, you tell the bank not to pay it.

This product literally does away with the threat of forged checks, altered checks, stolen checks, and counterfeit checks. And positive pay is also on the bank’s teller line. So if I had taken your checks and they were drawn on, say, the Chase Bank, I would obviously go to a Chase branch to try to cash it. But when I go up to a teller at a Chase Bank and present a check, the teller would pull it up on the screen and say, “Sir, this check was never issued as of noon today. The company never wrote this check, so what is this?” So you’re stopped cold right at the teller.

One of the most common questions I get about positive pay is, what if I send Frank Abagnale a check for five thousand dollars but a postal employee steals the check and Frank Abagnale never gets it? The employee types above my name, Bill Clark, and goes and cashes the check. The check number is the same and the amount of the check is unchanged. How will positive pay catch that?

It won’t, but it’s not meant to. That’s because that is an altered payee, and under banking law, altered payee checks are the liability of the first bank of deposit, not your liability or your bank’s liability.

Like any technology, positive pay is not foolproof. I recommend companies use both positive pay and a very secure check to close the loop, lock the lock, and throw away the key.

WAITING FOR THE PAPERLESS TOILET

A lot of companies and consumers figure, why worry too much about checks? With computers and debit cards, they won’t be with us that much longer. Well, anyone who thinks that checks are going away is dead wrong. People are always asking me, “When are we going to see the paperless society?” I tell them, “When you see the paperless toilet. No time soon.”

I’ll be long dead, even if I live to a ripe old age, before checks will ever disappear. The amount of checks we write is growing at a rate of more than a billion checks a year. So they’re not even declining in use. They’re growing. I remember fifteen years ago, when we were writing 40 billion checks a year, people said it would never reach 50 billion, and now we’re at almost 70 billion.

People happen to like checks. They’re familiar. Many consumers will say, “I like this check. It has some float to it. I like that much better than when the bank immediately goes into my checking account and takes the money out. I also like the idea that I can get the check back and see who I wrote it to and have a record of it.” And we have a very large generation that is not comfortable with smart cards and electronics. They’re leery of new ways of payments, and they don’t fully grasp them.

Electronic banking is still much more of an unknown frontier. And there’s no forgetting the billions of dollars that banks have invested in electronic readers, sorters, and other check processing equipment. We’re not going to just scrap it and plow money into home banking. There are banks out there pushing electronics, but there are a lot of other banks that would just as soon stay with checks.

So if we’re going to continue to use checks, you had better learn how to protect yourself. After all, awareness is 99 percent of solving the problem. The moment you accept the fact that fraud and forgery are so easy to accomplish, that’s the moment you’ve taken the first step toward combating it.