What Can You Learn from a Check?
This discussion summarizes and reviews some of the more
valuable information a check or a checkbook can provide to a forensic
accountant or fraud examiner
Fraud Examiner’s Perspective
Figure 1 - Sample Check (Front)
Figure 2 - Endorsed Check (back)
Hands and eyes
Routing number validation
Check 21 information
Other fraud-related topics
Business is about money. Exchanges of funds are the life
blood of business. Checks are still the most common method for exchanging
funds. A check is a promise to pay – it implies that the writer is aware of the
debt, acknowledges the validity of the debt, and has funds in the bank to cover
the check on presentment. Checks are more permanent and less tempting than
cash. A check (or equivalent) initiates a payment transaction, records the
institutions involved in processing the transaction, and provides a lasting
record of the transaction.
Federal Reserve statistics estimate that more than 81.2
noncash payments were made during 2003, up 3.8% annually since 2000.
While checks accounted for less than 50% of noncash payments for the first time
ever, they still accounted for more than 36.7 billion transactions in 2003. The
records available for other noncash payments will also be discussed below, but
the primary focus of this discussion remains the check. There are still a lot of checks being written
in the United States.
fraud examiner is not necessarily a document examiner or a specialist in
examiners do not conduct fishing expeditions
examinations are nonrecurring
examinations are conducted only with sufficient predication
examinations are conducted to resolve specific allegations
goals are to determine whether fraud has occurred or is occurring, and to
determine who is responsible
examinations are adversarial
examiners are looking for proof
Checks can provide proof, or can be a major component of the
mosaic of proof. But checks can serve as an information source as well. You can
draw inferences from a check about spending habits, asset existence, travel
patterns, and even the sophistication of the person writing the check. You can
observe how someone keeps records, and use that to evaluate the chances that
they are likely to have “made an honest mistake.”
My mother-in-law went to a new store a few years ago, and
paid by check. She was pulling out her drivers’ license when the clerk said, “I
don’t need to see that.” She asked him
why, and he responded that someone who was writing checks numbered in the 18
thousands was likely to have learned how to manage their money by that point.
He evaluated her trustworthiness and the stability of her banking relationships
based on one data item found on a check. The converse is also true – many
vendors will not accept “starter checks”, and apply extra scrutiny to checks
with low numbers.
The following listing provides shorthand reference to the
types of information that can typically be gathered from documents.
of the person
Figure 1 - Sample
check is presented as a teaching aid, and is clearly not valid for a number of
reasons. It is not signed,
the amount exceeds the indicated validity limit, and it is more than 180 days
old. There are substantial problems with the check itself. In just the account
name, block, look at the name of the account holder, the incomplete address
(there are dozens of streets in Atlanta
named Peachtree), the bad ZIP code, the phone number from a non-Atlanta area
code and the possibly bogus pattern of phone digits. In the bank name block, to
my knowledge there is no such institution, Grady
County is more than 200 miles away
from Atlanta, Peachtree is again a vague
address, and the ZIP code does not belong to Atlanta. The routing number (456700226)
complies with the check-digit validation algorithm, but does not comply with
the Federal Reserve district numbering scheme and accordingly identifies a
nonexistent Federal Reserve bank. The fractional routing number (74-9876/4321)
does not correspond to the routing number at the bottom of the check as it
should. 4321 is the fractional routing number should be the same as 4567 in the
routing number, and 9876 should correspond to 0022 after stripping out leading
zeros. The first two digits (74) refer to a bank in Michigan,
If Sunny South were a real bank, you might be able to validate the account
number (9012345678) with them, but in the meantime consider the odds against an
account number consisting of the digits 0-9 in sequential order.
transaction identification numbers
Figure 2 - Endorsed Check (back)
You can be sure that the endorsements in Figure 2 do not
correspond to the bogus check in Figure 1. The routing number can be used to
identify the bank(s) that processed the check, including the institution in
which the check was originally deposited, intermediate banks serving as check
clearing houses, and the bank against which the check is presented. Directories
and online services can be used to decode the routing numbers to find the name,
location and contact information for banks involved in the transaction., The
examiner can trace the dates on which the check is processed, and may be able
to use the endorsement information to gain additional insight into the
transaction consummated by the check. Note that Federal Reserve numbers are not
necessarily the same as Automated Clearing House (ACH) routing numbers, and you
may have to consult additional information sources to figure out what bank the
routing number references.
In Figure 2, the processing began on July 7th, in
the Bank of America operation in Seattle.
Only July 8th, the check was moved to the Bank of America operation
in Chicago, and on July 9th, the
check moved to the Bank of America operation in Atlanta. It was presented to the drawer’s
bank, SunTrust in Atlanta,
on July 9th. Note that there is no specific payee endorsement on
this check: the mechanically generated number at the middle of the page is
substituted for the traditional rubber stamp or signature endorsement. Also,
when the bank routing numbers are confirmed through RoutingTool.com, all the
Bank of America numbers now return the same address in Richmond, Virginia
and two of the three return the same phone number, apparently reflecting
organizational changes in the Bank of America. Information changes over time,
and if you are looking for clues about events in the past you might have to go
back to published directories for that time rather than relying on current data
on the Internet.
sequence of checks (helps identify checks that may be missing from the
checks written at about the same time
from previous months that don’t appear this month (possible indication
that other bank accounts exist)
Does the account holder maintain a
check register at all? Is it neat and orderly? Does it appear to be complete?
Are there indications that bank reconciliations have been performed regularly
as a normal part of business?
In a fraud examination, one
suspect had received a cash advance of several thousand dollars for business
travel out of the country, and had submitted receipts that more or less agreed
with the amount of funds received. However, a review of the check register
revealed that another individual had received a cash advance of the same amount
as the very next check in sequence. That individual went along on the business
trip, but the documentation of their expenses was much less complete. As a
result, the scope of the examination expanded to consider the actions of the
second individual as well.
amount of transactions
of transactions (for ATM or POS)
teller machine transactions
of sale transactions
to check register
Many bank statements list
transaction information a number of different ways. Some include a list of
transactions by check number, along with an identifying mark when a check
number is missing from the numerical sequence of checks. Sometimes, the bank
statement is the only record of electronic funds transfers, point of sale
transactions or ATM deposits and withdrawals.
Who signed the check? Who endorsed the check? Where was the
check deposited? Do the identities agree? Review the routing information to
trace where and when the check was processed.
What is the amount? Do the amounts on the check, the check
register, and the bank statement agree? Is there any significance to the amount
(just under a critical review threshold, unusual for the type of transaction,
similar to previous transactions)?
For example, if additional approvals are required for the
purchase of business services over $5,000, there may be additional significance
to a large number of payments to the same vendor in the $4,500 - $4,999 range.
Is the check on that is written every month at about the
same time? Does the timing make sense (end of the month for a mortgage payment,
for example)? Are checks immediately written against deposits (may indicate
cash flow difficulties, or existence of a kiting scheme)?
Does the payee name represent a real person or business? Is
the payee address consistent with a real business operation? If the check pays
a credit card or other debt, does the examiner or the client know about those
liabilities and have appropriate documentation to evaluate their validity? If
the check pays for property taxes, mortgage or utilities, does the examiner or
the client know about the existence of the related assets and have appropriate
documentation to evaluate their validity? Does the check reveal the existence
of investments, related business ventures or other business dealings of interest?
If it is a payroll check, does the company have appropriate documentation of
the immigration and tax status of the employee? Is the transaction part of a
pattern that reveals the existence of otherwise hidden relationships?
In a divorce case, every other Wednesday the husband
habitually withdrew several hundred dollars at an automatic teller machine or
grocery store in a resort community more than an hour from his home.
Surveillance in that resort revealed an ongoing relationship with a woman not
his wife, and a settlement was reached before trial.
Sometimes there is no real substitute for looking at the
check (or check image). Some of the points you might observe when looking at
the check include:
- If the
check purports to be from a business, does it look like a business check?
- Is it
handwritten when you might expect it to be machine-generated?
the handwriting or signature look familiar? (You don’t have to be a
handwriting expert qualified to testify in court to notice similarities in
- If it
is a personal check, is it computer-generated? (This might alert you to
the existence of a computer which may have interesting data if you can
retrieve it in the scope of your examination.
there visible erasure, correction fluid, or alterations to payee or
the fraud-protection features common in checks present, and if so, do they
raise any questions?
the checks show signs of age (fading, dust, rotting rubber band marks) if
they purport to be several years old?
NOTE: Check 21 (further discussed below) has curtailed the number of
physical checks for review, but inspection of Check 21 imagines can still yield
You can design an analytical database to capture the
information you are interested in from the checks, and search for patterns for
gaps in formation. You may also be able to capture electronic data and
eliminate data entry, but the examiner must be able to validate the
completeness and consistency of the electronic data. It is a good idea to
capture as much data as you can do efficiently, because if you have to go back
later to grab something you didn’t initially think was important it will be
costly and time-consuming. One-pass data entry is typically the most
cost-effective way to gather data.
For example, in “Arbitraging Dogfood”, we captured a great
deal of transaction information. Wire transfer codes helped us develop a
geographic map of transactions and relationships, and helped follow the cash as
it was squandered. But one interesting finding came about because we capture
telephone numbers. It turned out that there were a large number of supposedly
independent businesses who reported the same telephone number, which we traced
to a garage in Puerto Rico and used to
identify several additional confederates. We didn’t know at the outset that the
telephone number would be useful, but it was relatively easy to capture it as
we got the rest of the data from the transaction. We probably would not have
had time to go back and look for telephone numbers after the original data
Is the payee on the face of the check the same name as
recorded in the disbursements register? Are the items listed in the “Memo”
field types of items that it makes sense for the company to buy? Do the amounts
match up? Does the information on the check correlate to the information in the
vendor master file? Data mining tools permit automated shifting of large
volumes of data to answer questions like these, but manual or semi-automated
review is frequently necessary to provide a basis for seasoned judgment and
The Check Clearing for the 21st Century Act
(Check 21) was passed in October 2003 and became effective at the end of
October 2004. Check 21 allows banks to dispense with physical processing and
transport of paper checks after initial data capture, and instead to transmit
electronic images of checks through the check clearing process. In almost all
cases, banks will no longer return original checks to the account holder in the
monthly bank statement, but can provide substitute checks, check images or
online access to check images. Many banks have established processes to destroy
the original documents after initial processing, and the law permits banks to
use substitute checks (printouts of check images meeting specific requirements)
instead of original checks when their agreement with the customer calls for
returning cancelled checks in the bank statement. Accordingly, proving forgery
or check alteration becomes substantially more difficult. An expert may have to
review a picture of a check instead of the original document, and will not be
able to test for fingerprints or physical characteristics of the document
(paper, ink, pressure points).
Advances in technology have made the creation of
authentic-looking documents far easier than ever before. Color copiers have
become so good that the United States Treasury was forced to redesign the
currency to thwart counterfeiters. Creation of a business check used to require
sophisticated printing equipment and specialized paper stock, outside the reach
of most of us. And when image editing software permits instantaneous head transplants
for amusing or ridiculous pictures, that same technology ca be used to capture
and transfer check images or signatures that are difficult to distinguish from
Check creation software is broadly available in computer
stores and office supply houses. The check image above in Figure 1 shows a
thoroughly bogus check that was created in less than 5 minutes using commercial
check printing software that cost less than $30. The same system that created
this check has been used by thousands of small businesses for many years to
reduce their costs of producing checks.
Along with desktop publishing of checks came a decline in
magnetic ink printing (MICR). The funny-looking numbers at the bottom of checks
were designed many years ago for use in conjunction with magnetic ink. Each
digit or symbol has a different magnetic signature, permitting rapid data
recognition with equipment far less sophisticated than is available today.
However, much check processing today uses optical character recognition technology
rather than or in addition to MICR reading. Technically, desktop-published
checks are still supposed to include magnetic ink characters along the bottom
edge of the check, but most businesses and individuals in my experience have no
difficulty passing and cashing checks with no magnetic ink at all.
Image editing and creation software permits taking a picture
of a signature from one document and applying it to a check or similar
document. Some check creation software even permits the storage and use of
picture files as a substitute for handwritten signatures. One more traditional
safeguard no longer provides as much assurance as it used to be.
With the proliferation of electronic funds transfer vehicles
today (online bill payment, ATM cards, debit cards at stores, stored value
cards), the traditional paper trail has thinned out a great deal. Now you don’t
need to write a check to execute a transaction. In many instances, you don’t
even need to have a magnetic stripe card to transfer money if you know the
account numbers and access codes. Proving that a particular individual was
responsible for a particular electronic transaction is more difficult now that
we may not have their fingerprints on a piece of paper.
Anyone who has spent their summer flipping through banker’s
boxes of checks to review questioned disbursements can tell you that reviewing
check images instead of paper documents is likely to be faster, cleaner and
healthier (it is hard to get a paper cut from on on-screen image). Duplicating
electronic check images is easier and most cost-effective than photocopying
checks (getting fronts and backs on the same sheet of paper is mind-numbingly
tedious work), and it may pose less risk of clerical error. Check 21 permits
standardization of image processing and may allow more efficiency in data
Flash drives, inexpensive scanners, fast and cheap DVD
burners and many flavors of analytical software make information capture,
storage, exchange and analysis faster and cheaper than it ever has before.
Forensic auditing tools permit recovery of data that has been “erased” from
computers. Electronic mail adds further to the volume of data available for
review. Technology has had an impact on data examination, and much of it has
You can find almost any information on the Internet today:
Some of it is even true. Internet research capabilities can supplement or
replace traditional library-based methods, and a knowledgeable researcher can
produce a staggering amount of data in a short period of time. Once more, the
examiner must be able to confirm and validate the information they have
received before making decisions based on that information.
There are even Internet services to validate a check you
have been given. At www.routingtool.com,
you can sign up for their BetterCheck™ service, which for a small fee let you
get an answer online and in real-time to questions like:
Is the account open?
Is any money available?
Is there a stop payment?
Will this check likely clear?
RoutingTool also provides free lookup services to help you
identify the institution associated with a particular routing number. Other
routing number verification services are listed in the reference tools section.
Someone who is conducting a number of routing validation searches should
consider the additional capabilities available from paid services or
routing number policy:
to obtain a PDF copy of the ABA
Search for banks via routing number:
Federal Reserve: http://www.fedwiredirectory.frb.org/search.cfm
Thomson Financial Publishing publishes a director of all ABA routing numbers. That
directory can be purchased at http://www.tfp.com/order_US.shtml
RoutingTool.com allows free searching for individual
institutions, although the site requires (free) registration. Batch searching
and check validation can be done at the site for a fee. http://routingtool.com
Federal Reserve discussion of Check 21 legal requirements
and processing methods: http://www.federalreserve.gov/paymentsystem/truncation/faqs.htm
Intuit White Paper on Check 21 requirements and
ThomasNet®, the online access point for Thomas Register and
Thomas Regional data provides directory information on companies, products and
brand names. It can be accessed at http://www.thomasnet.com/index.html
is another online data source that has a wealth of company and executive
information. Much of the Hoovers
data is reserved for subscribers, but there is still substantial free
information available at http://www.hoovers.com/free/tools/bcl
Search a wide range of fraud-related topics and other
resources at the Association of Certified Fraud Examiners web site: http://www.cfenet.com/resources/resources.asp
Bill Black has been a CFE since the early 90’s as part of
his independent forensic accounting and litigation support practice. His is a
CPA, with experience working in industry as well as half of the largest
accounting firms (4 of the Big 8, 3 of the Big 6, or 2 of the Final 4) before
starting his independent practice. Black also worked on the research staff of
the Financial Accounting Standards Board back in the 1980’s.
Black’s fraud investigation experience ranges from finding
out what happened to 3,000 vanishing boilers, to unraveling a $600 million Ponzi scheme Forbes called “Arbitraging Dogfood”, to more mundane matters like
embezzlement, uncovering insolvency, and proving or rebutting business damages.
He has not kept an exact count during more than 25 years as an accountant, but
he has seen fronts and backs of many hundreds of thousands of checks during his
You can find out more about Black’s credentials at http://billblackcpa.com .
 “The 2004 Federal Reserve Payments Study: Analysis of
Noncash Payments Trends in the United States 2000 – 2003”, Federal Reserve
System, Updated December 15, 2004.
 Joseph T. Wells, “Sherlock Holmes, CPA, Part 1”,
Journal of Accountancy, August 2003.
Published by American Institute of Certified Public Accountants. © 2003 Joseph
T. Wells. http://www.cfenet.com/resources/articles/ViewArticle.asp?ArticleID=29
numbers along the bottom edge of the check include bank account information and
bank routing information. Each bank maintains its own account number assignment
process, and their validation algorithms are kept secret. The American Banking
Association (ABA) assigns routing numbers to banks. The first four numbers
designate the Federal Reserve routing assignment: the first two digits indicate
the Federal Reserve District (01-12 for banks, 21-32 for thrift institutions)
while the second pair of digits indicates the city within the district. The
fifth through eighth digits identify the
institution number of the bank the check is drawn on. The final digit is a
checksum digit, calculated according to the following algorithm: Multiply the
first digit by 3, the second digit by 7, the third digit by 1, the fourth digit
by 3, the fifth digit by 7, the sixth digit by 1, the seventh digit by 3, the
eighth digit by 7 and the final digit by 1. Add the resulting products
together. The final digit is set to make the sum of the products equal to an
integer multiple of 10
The fractional routing number is a way to restate the
routing number from the bottom of the check. The fractional routing number
provides an alternative way to identify the bank if the bottom edge data cannot
be read. A fractional routing number shows two numbers separated by a dash,
then a division symbol, then an additional number (AA-BBBB/CCCC). AA represents the banks’ city or state. )1 through 49 were assigned to 49 big cities
by the Federal Reserve, while 50-99 represent states. BBBB is the bank
identifier in the routing number described above (fifth through eighth digits,
although leading zeros are dropped in the fractional routing number). CCCC is
the Federal Reserve District identifier in the routing number described above
(first through fourth digits, although leading zeros are dropped in the
fractional routing number.)
Many people believe that their banks compare the
signature on their checks to the authorized signature(s) on the account
signature cards. According to an
publication, this signature comparison process is labor intensive,
one-dimensional, problematic with decision accuracy and often ineffective for
fraud detection. (“Industry Practices: Risk Based Fraud Detection System”,
adopted by the Deposit Account Fraud Committee, American Bankers Association,
April 12, 2005). It requires review of thousands of items in order to detect
and confirm a single fraudulent item. With nearly 40 billion checks written
annually, many of the largest depository institutions have moved to a
risk-based fraud detection system which in many cases is more effective at
monitoring risk and preventing fraud.
Risk-based fraud prevention
systems provide depository institutions with a multi-dimensional tool that
allows them to limit their review to those checks that pose the greatest risk
to the customer and the bank. Depository institutions can review as few as
several hundred items to find a single fraudulent item, a vast improvement over
the single criteria review process. To
read the entire article, use the following address:
For More Information Contact:
William H. Black, PC