What Can You Learn from a Check?

Copyright © 2005, William H. Black

All Rights Reserved

http://billblackcpa.com

This discussion summarizes and reviews some of the more valuable information a check or a checkbook can provide to a forensic accountant or fraud examiner

Introduction

    Business Perspective

    Fraud Examiner’s Perspective

Types of Information

    Check

    Figure 1 - Sample Check (Front)

    Figure 2 - Endorsed Check (back)

    Check register

    Bank statement

Information to look for

    Identity

    Amount

    Timing

    Existence

Approaches to finding information

    Hands and eyes

    Database review

    Cross-referencing

Why obtaining information is harder today

    Check 21

    Desktop publishing

    Electronic Transfers

Why obtaining information is easier today

    Check 21

    Technology

    Internet

Reference Tools

    Routing number validation

    Check 21 information

    Company directories

    Other fraud-related topics

About the Author

 

Introduction

Business Perspective

 Business is about money. Exchanges of funds are the life blood of business. Checks are still the most common method for exchanging funds. A check is a promise to pay – it implies that the writer is aware of the debt, acknowledges the validity of the debt, and has funds in the bank to cover the check on presentment. Checks are more permanent and less tempting than cash. A check (or equivalent) initiates a payment transaction, records the institutions involved in processing the transaction, and provides a lasting record of the transaction.

 Federal Reserve statistics estimate that more than 81.2 noncash payments were made during 2003, up 3.8% annually since 2000.[1] While checks accounted for less than 50% of noncash payments for the first time ever, they still accounted for more than 36.7 billion transactions in 2003. The records available for other noncash payments will also be discussed below, but the primary focus of this discussion remains the check.  There are still a lot of checks being written in the United States.

 

Fraud Examiner’s Perspective

 

• The fraud examiner is not necessarily a document examiner or a specialist in forgery detection
• Fraud examiners do not conduct fishing expeditions
• Fraud examinations are nonrecurring
• Fraud examinations are conducted only with sufficient predication
• Fraud examinations are conducted to resolve specific allegations
• The goals are to determine whether fraud has occurred or is occurring, and to determine who is responsible
• Fraud examinations are adversarial
• Fraud examiners are looking for proof[2]

 

Checks can provide proof, or can be a major component of the mosaic of proof. But checks can serve as an information source as well. You can draw inferences from a check about spending habits, asset existence, travel patterns, and even the sophistication of the person writing the check. You can observe how someone keeps records, and use that to evaluate the chances that they are likely to have “made an honest mistake.”

My mother-in-law went to a new store a few years ago, and paid by check. She was pulling out her drivers’ license when the clerk said, “I don’t need to see that.”  She asked him why, and he responded that someone who was writing checks numbered in the 18 thousands was likely to have learned how to manage their money by that point. He evaluated her trustworthiness and the stability of her banking relationships based on one data item found on a check. The converse is also true – many vendors will not accept “starter checks”, and apply extra scrutiny to checks with low numbers.

 

Types of Information

The following listing provides shorthand reference to the types of information that can typically be gathered from documents.

Check

Permanent data:

• Name of the person
• Address
• Phone number
• Bank name
• Bank city
• Check number
• Account number
• Routing number[3]
• Fractional routing number[4]

 Changeable data:

• Check amount
• Payee
• Date
• Description
• Signature
• Endorsement data (sometimes)

 

Figure 1 - Sample Check (Front)

            This sample check is presented as a teaching aid, and is clearly not valid for a number of reasons. It is not signed[5], the amount exceeds the indicated validity limit, and it is more than 180 days old. There are substantial problems with the check itself. In just the account name, block, look at the name of the account holder, the incomplete address (there are dozens of streets in Atlanta named Peachtree), the bad ZIP code, the phone number from a non-Atlanta area code and the possibly bogus pattern of phone digits. In the bank name block, to my knowledge there is no such institution, Grady County is more than 200 miles away from Atlanta, Peachtree is again a vague address, and the ZIP code does not belong to Atlanta. The routing number (456700226) complies with the check-digit validation algorithm, but does not comply with the Federal Reserve district numbering scheme and accordingly identifies a nonexistent Federal Reserve bank. The fractional routing number (74-9876/4321) does not correspond to the routing number at the bottom of the check as it should. 4321 is the fractional routing number should be the same as 4567 in the routing number, and 9876 should correspond to 0022 after stripping out leading zeros. The first two digits (74) refer to a bank in Michigan, not Georgia. If Sunny South were a real bank, you might be able to validate the account number (9012345678) with them, but in the meantime consider the odds against an account number consisting of the digits 0-9 in sequential order.

 (On Back):

• Endorsement name
• Endorsement account number
• Clearing bank(s)
• Clearing date(s)
• Bank transaction identification numbers

 

Figure 2 - Endorsed Check (back)

You can be sure that the endorsements in Figure 2 do not correspond to the bogus check in Figure 1. The routing number can be used to identify the bank(s) that processed the check, including the institution in which the check was originally deposited, intermediate banks serving as check clearing houses, and the bank against which the check is presented. Directories and online services can be used to decode the routing numbers to find the name, location and contact information for banks involved in the transaction., The examiner can trace the dates on which the check is processed, and may be able to use the endorsement information to gain additional insight into the transaction consummated by the check. Note that Federal Reserve numbers are not necessarily the same as Automated Clearing House (ACH) routing numbers, and you may have to consult additional information sources to figure out what bank the routing number references.

 In Figure 2, the processing began on July 7^th, in the Bank of America operation in Seattle. Only July 8^th, the check was moved to the Bank of America operation in Chicago, and on July 9^th, the check moved to the Bank of America operation in Atlanta. It was presented to the drawer’s bank, SunTrust in Atlanta, on July 9^th. Note that there is no specific payee endorsement on this check: the mechanically generated number at the middle of the page is substituted for the traditional rubber stamp or signature endorsement. Also, when the bank routing numbers are confirmed through RoutingTool.com, all the Bank of America numbers now return the same address in Richmond, Virginia and two of the three return the same phone number, apparently reflecting organizational changes in the Bank of America. Information changes over time, and if you are looking for clues about events in the past you might have to go back to published directories for that time rather than relying on current data on the Internet.

 

Check register

 

• Numerical sequence of checks (helps identify checks that may be missing from the document production).
• Payee
• Amount
• Date
• Purpose (possibly)
• Other checks written at about the same time
• Checks from previous months that don’t appear this month (possible indication that other bank accounts exist)
• Credit card payments
• Deposits

 

Does the account holder maintain a check register at all? Is it neat and orderly? Does it appear to be complete? Are there indications that bank reconciliations have been performed regularly as a normal part of business?

In a fraud examination, one suspect had received a cash advance of several thousand dollars for business travel out of the country, and had submitted receipts that more or less agreed with the amount of funds received. However, a review of the check register revealed that another individual had received a cash advance of the same amount as the very next check in sequence. That individual went along on the business trip, but the documentation of their expenses was much less complete. As a result, the scope of the examination expanded to consider the actions of the second individual as well.

 

Bank statement

 

• Dollar amount of transactions
• Number of transactions
• Date of transactions
• Location of transactions (for ATM or POS)
• Wire transfers
• Automatic teller machine transactions
• Electronic funds transfers
• Point of sale transactions
• Correlation to check register
• Deposits

Many bank statements list transaction information a number of different ways. Some include a list of transactions by check number, along with an identifying mark when a check number is missing from the numerical sequence of checks. Sometimes, the bank statement is the only record of electronic funds transfers, point of sale transactions or ATM deposits and withdrawals.

 

Information to look for

Identity

Who signed the check? Who endorsed the check? Where was the check deposited? Do the identities agree? Review the routing information to trace where and when the check was processed.

 

Amount

What is the amount? Do the amounts on the check, the check register, and the bank statement agree? Is there any significance to the amount (just under a critical review threshold, unusual for the type of transaction, similar to previous transactions)?

 

For example, if additional approvals are required for the purchase of business services over $5,000, there may be additional significance to a large number of payments to the same vendor in the $4,500 - $4,999 range.

 

Timing

Is the check on that is written every month at about the same time? Does the timing make sense (end of the month for a mortgage payment, for example)? Are checks immediately written against deposits (may indicate cash flow difficulties, or existence of a kiting scheme)?

 

Existence

Does the payee name represent a real person or business? Is the payee address consistent with a real business operation? If the check pays a credit card or other debt, does the examiner or the client know about those liabilities and have appropriate documentation to evaluate their validity? If the check pays for property taxes, mortgage or utilities, does the examiner or the client know about the existence of the related assets and have appropriate documentation to evaluate their validity? Does the check reveal the existence of investments, related business ventures or other business dealings of interest? If it is a payroll check, does the company have appropriate documentation of the immigration and tax status of the employee? Is the transaction part of a pattern that reveals the existence of otherwise hidden relationships?

 

In a divorce case, every other Wednesday the husband habitually withdrew several hundred dollars at an automatic teller machine or grocery store in a resort community more than an hour from his home. Surveillance in that resort revealed an ongoing relationship with a woman not his wife, and a settlement was reached before trial.

 

Approaches to finding information

Hands and eyes

Sometimes there is no real substitute for looking at the check (or check image). Some of the points you might observe when looking at the check include:

 

• If the check purports to be from a business, does it look like a business check?
• Is it handwritten when you might expect it to be machine-generated?
• Does the handwriting or signature look familiar? (You don’t have to be a handwriting expert qualified to testify in court to notice similarities in handwriting.)
• If it is a personal check, is it computer-generated? (This might alert you to the existence of a computer which may have interesting data if you can retrieve it in the scope of your examination.
• Are there visible erasure, correction fluid, or alterations to payee or amount?
• Are the fraud-protection features common in checks present, and if so, do they raise any questions?
• Do the checks show signs of age (fading, dust, rotting rubber band marks) if they purport to be several years old?

NOTE: Check 21 (further discussed below) has curtailed the number of physical checks for review, but inspection of Check 21 imagines can still yield valuable insights.

 

Database review

You can design an analytical database to capture the information you are interested in from the checks, and search for patterns for gaps in formation. You may also be able to capture electronic data and eliminate data entry, but the examiner must be able to validate the completeness and consistency of the electronic data. It is a good idea to capture as much data as you can do efficiently, because if you have to go back later to grab something you didn’t initially think was important it will be costly and time-consuming. One-pass data entry is typically the most cost-effective way to gather data.

 

For example, in “Arbitraging Dogfood”, we captured a great deal of transaction information. Wire transfer codes helped us develop a geographic map of transactions and relationships, and helped follow the cash as it was squandered. But one interesting finding came about because we capture telephone numbers. It turned out that there were a large number of supposedly independent businesses who reported the same telephone number, which we traced to a garage in Puerto Rico and used to identify several additional confederates. We didn’t know at the outset that the telephone number would be useful, but it was relatively easy to capture it as we got the rest of the data from the transaction. We probably would not have had time to go back and look for telephone numbers after the original data entry pass.

 

Cross-referencing

Is the payee on the face of the check the same name as recorded in the disbursements register? Are the items listed in the “Memo” field types of items that it makes sense for the company to buy? Do the amounts match up? Does the information on the check correlate to the information in the vendor master file? Data mining tools permit automated shifting of large volumes of data to answer questions like these, but manual or semi-automated review is frequently necessary to provide a basis for seasoned judgment and inference.

 

Why obtaining information is harder today

Check 21

The Check Clearing for the 21^st Century Act (Check 21) was passed in October 2003 and became effective at the end of October 2004. Check 21 allows banks to dispense with physical processing and transport of paper checks after initial data capture, and instead to transmit electronic images of checks through the check clearing process. In almost all cases, banks will no longer return original checks to the account holder in the monthly bank statement, but can provide substitute checks, check images or online access to check images. Many banks have established processes to destroy the original documents after initial processing, and the law permits banks to use substitute checks (printouts of check images meeting specific requirements) instead of original checks when their agreement with the customer calls for returning cancelled checks in the bank statement. Accordingly, proving forgery or check alteration becomes substantially more difficult. An expert may have to review a picture of a check instead of the original document, and will not be able to test for fingerprints or physical characteristics of the document (paper, ink, pressure points).

 

Desktop publishing

Advances in technology have made the creation of authentic-looking documents far easier than ever before. Color copiers have become so good that the United States Treasury was forced to redesign the currency to thwart counterfeiters. Creation of a business check used to require sophisticated printing equipment and specialized paper stock, outside the reach of most of us. And when image editing software permits instantaneous head transplants for amusing or ridiculous pictures, that same technology ca be used to capture and transfer check images or signatures that are difficult to distinguish from the original.

 

Check creation software is broadly available in computer stores and office supply houses. The check image above in Figure 1 shows a thoroughly bogus check that was created in less than 5 minutes using commercial check printing software that cost less than $30. The same system that created this check has been used by thousands of small businesses for many years to reduce their costs of producing checks.

 

Along with desktop publishing of checks came a decline in magnetic ink printing (MICR). The funny-looking numbers at the bottom of checks were designed many years ago for use in conjunction with magnetic ink. Each digit or symbol has a different magnetic signature, permitting rapid data recognition with equipment far less sophisticated than is available today. However, much check processing today uses optical character recognition technology rather than or in addition to MICR reading. Technically, desktop-published checks are still supposed to include magnetic ink characters along the bottom edge of the check, but most businesses and individuals in my experience have no difficulty passing and cashing checks with no magnetic ink at all.

Image editing and creation software permits taking a picture of a signature from one document and applying it to a check or similar document. Some check creation software even permits the storage and use of picture files as a substitute for handwritten signatures. One more traditional safeguard no longer provides as much assurance as it used to be.

 

Electronic Transfers

With the proliferation of electronic funds transfer vehicles today (online bill payment, ATM cards, debit cards at stores, stored value cards), the traditional paper trail has thinned out a great deal. Now you don’t need to write a check to execute a transaction. In many instances, you don’t even need to have a magnetic stripe card to transfer money if you know the account numbers and access codes. Proving that a particular individual was responsible for a particular electronic transaction is more difficult now that we may not have their fingerprints on a piece of paper.

 

Why obtaining information is easier today

Check 21

Anyone who has spent their summer flipping through banker’s boxes of checks to review questioned disbursements can tell you that reviewing check images instead of paper documents is likely to be faster, cleaner and healthier (it is hard to get a paper cut from on on-screen image). Duplicating electronic check images is easier and most cost-effective than photocopying checks (getting fronts and backs on the same sheet of paper is mind-numbingly tedious work), and it may pose less risk of clerical error. Check 21 permits standardization of image processing and may allow more efficiency in data review.

 

Technology

Flash drives, inexpensive scanners, fast and cheap DVD burners and many flavors of analytical software make information capture, storage, exchange and analysis faster and cheaper than it ever has before. Forensic auditing tools permit recovery of data that has been “erased” from computers. Electronic mail adds further to the volume of data available for review. Technology has had an impact on data examination, and much of it has been positive.

 

Internet

You can find almost any information on the Internet today: Some of it is even true. Internet research capabilities can supplement or replace traditional library-based methods, and a knowledgeable researcher can produce a staggering amount of data in a short period of time. Once more, the examiner must be able to confirm and validate the information they have received before making decisions based on that information.

There are even Internet services to validate a check you have been given. At www.routingtool.com, you can sign up for their BetterCheck™ service, which for a small fee let you get an answer online and in real-time to questions like:

·        Is the account open?

·        Is any money available?

·        Is there a stop payment?

·        Will this check likely clear?

RoutingTool also provides free lookup services to help you identify the institution associated with a particular routing number. Other routing number verification services are listed in the reference tools section. Someone who is conducting a number of routing validation searches should consider the additional capabilities available from paid services or directories.

 

Reference Tools

Routing number validation

ABA routing number policy:

http://www.aba.com/Products/PS98_Routing.htm

or http://www.tfp.com/aba.html to obtain a PDF copy of the ABA policy.

 

Search for banks via routing number:

Federal Reserve:  http://www.fedwiredirectory.frb.org/search.cfm

 

Thomson Financial Publishing publishes a director of all ABA routing numbers. That directory can be purchased at http://www.tfp.com/order_US.shtml

 

RoutingTool.com allows free searching for individual institutions, although the site requires (free) registration. Batch searching and check validation can be done at the site for a fee. http://routingtool.com

 

Check 21 information

Federal Reserve discussion of Check 21 legal requirements and processing methods: http://www.federalreserve.gov/paymentsystem/truncation/faqs.htm

 

Intuit White Paper on Check 21 requirements and implications:

http://whitepapers/zdnet.com/abstract.aspx?promo=50002&docid=138125

 

Company directories

ThomasNet®, the online access point for Thomas Register and Thomas Regional data provides directory information on companies, products and brand names. It can be accessed at http://www.thomasnet.com/index.html

 Hoovers is another online data source that has a wealth of company and executive information. Much of the Hoovers data is reserved for subscribers, but there is still substantial free information available at http://www.hoovers.com/free/tools/bcl

 

Other fraud-related topics

Search a wide range of fraud-related topics and other resources at the Association of Certified Fraud Examiners web site: http://www.cfenet.com/resources/resources.asp

 

About the Author

Bill Black has been a CFE since the early 90’s as part of his independent forensic accounting and litigation support practice. His is a CPA, with experience working in industry as well as half of the largest accounting firms (4 of the Big 8, 3 of the Big 6, or 2 of the Final 4) before starting his independent practice. Black also worked on the research staff of the Financial Accounting Standards Board back in the 1980’s.

Black’s fraud investigation experience ranges from finding out what happened to 3,000 vanishing boilers, to unraveling a $600 million Ponzi scheme Forbes called “Arbitraging Dogfood”, to more mundane matters like embezzlement, uncovering insolvency, and proving or rebutting business damages. He has not kept an exact count during more than 25 years as an accountant, but he has seen fronts and backs of many hundreds of thousands of checks during his career.

 You can find out more about Black’s credentials at http://billblackcpa.com .

 

---