Subscribe

Get the best of Newspaper delivered to your inbox daily

Fill out my online form.

Most Viewed

Writing Paper Checks is Not Safe


By Rick Crandall, National Cybersecurity Center

You may not be aware that writing paper checks discloses information that criminals can use easily to empty your account — or worse, if you have overdraft privileges. This is because every check you write and send has your account number on it. 

All a forger needs are your bank routing number (public information), your name (also public) and your checking account number.

The key is your checking account number — you must treat this as confidential, which means stop writing and sending checks altogether — and inform your bank you want physical check writing eliminated as an account feature.

There is no standard for check appearance. Someone can easily use your bank account, name and routing numbers to create fake checks and use them to pay for goods and services. A criminal can also easily alter a real check, and your bank will cash that, too. Since checks can take days to clear, it may be some time before you realize you’ve been targeted.

Perhaps the most prevalent disclosure of check information arises from the dramatic rise in theft of mail from the U.S. Postal Service. Recently USPS conceded that mail theft was far outpacing earlier rates due to break-ins of USPS collection boxes and letter carriers being robbed while making their rounds.

According to USPS, in fiscal year 2022, 412 letter carriers were robbed on the job and 38,500 incidents of “high volume” mail theft were recorded. In the first half of fiscal 2023, USPS said it had already seen 305 carriers robbed and more than 25,000 thefts.

A Real Experience with a Fake Check

While reviewing my check transactions online, I saw a charge of $150.24 that I did not recognize. I looked at the check image online to study it further. It did not come from me, yet the bank had honored it. Phone calls that escalated to five people at the large national bank are summarized below:

Bank: “It says ‘OnLine Bill Payment Processing’ on the check.”

Me: “But OnLine Bill Pay history shows no such amount, and my signature is not on it.”

Bank: “It says ‘signature on file.’”

Me: “Anybody can print ‘signature on file.’ Whose file? Do you just believe it because it’s printed?”

Bank: “It says ‘this check has been authorized by your depositor.’”

Me: “What does that mean? Who is the depositor? Me? I did not authorize this, and you have no record of me authorizing this, either via Bill Pay or with a signature.”

Bank: “Our routing number and your account number are on the check.”

Me: “Really? That is what you used as evidence the check can be cashed? Even though Bill Pay has no record of it and my signature is not on the check?”

Bank: “Well, if you are saying it is a fraud, declare that to us and we will research it, but you must shut down this checking account and open a new one.”

Me: “OK, then I have to redo all the autopays set up to this account and enter them to the new account. Once I do that, can’t this happen again to the new account?”

Bank: “Well, yes.”

Me: “So you are saying that if I have a checking account with check-writing privileges it is vulnerable to anyone who has the account number?”

Bank: “Yes, and that is true of every bank. Be careful who you disclose your account number to.”

Me: “The account number is on every check.”

After going through the dialogue above, and spending countless hours, the bank basically said it was my problem, especially if I don’t notify them within 30 days of receiving a monthly statement. The responsibility for security falls on the consumer — it’s unfortunate, but a reality in today’s world.

Alternatives to Checks

Given the risks associated with writing checks, here are alternatives for conducting payments:

Credit Cards: These provide additional security, as they require a Card Verification Value or CVV number. Your card issuer protects the card and, although there may be a credit card fee, that is inexpensive insurance against losing all of your money.

Mobile Payment Apps: The rise of mobile payment apps, such as PayPal, Venmo and Zelle, offer a convenient way to transfer money without disclosing your account information.

Automated Clearing House (ACH) Payments: Increasingly, vendors are enabling ACH payments to be made online via secure portals. However, ACH can also be hacked if your account number gets into the wrong hands.

Which is Safer: ACH or Credit Card?

Paper checks are dangerous as they disclose your account number, which then can be used in less-secure ACH payments. Although payment by credit card incurs a fee, especially for larger charges, U.S. banks ensure a higher level of protection from credit card fraud. Another benefit is that a potential credit card fraud incident won’t directly deplete your operating capital.

However, if a criminal has your account number, name and bank routing number, they can institute ACH transfers. Portals enabling ACH transfers may use two-factor authentication, usually sending a text to your smart phone. Or they may not.

Will a Bank Protect You from Fraudulent Checks?

This is highly dependent on the bank’s policies and practices. Usually, there are requirements about how much time you have to report a fraudulent disbursement. A typical policy statement requires customers to notify the bank of any unauthorized transactions within 30 days of when the account statement is made available to the customer.

The Push to Online Payments

Despite the long history of checks, many banks have no good solutions for check-writing security issues, hence the push for online payments. However, payments have their own vulnerabilities such as your phone and/or laptop being hacked, which may allow access to your typing of account information to a bill pay, ACH portal or mobile payment. Improving your “cyber-hygiene” becomes even more important as you become more dependent on electronic payments.

A Few Other Options

  • Get an identity theft-protection service to monitor your bank accounts and alert you to suspicious withdrawals or information changes.
  • Use a credit card or a money-transfer app.
  • Be stingy with your banking information to avoid bank scams.
  • Go for multi-factor authentication (such as texts to smart phones) when banking online for an extra level of verification on top of your account password.
  • If you must write checks to people/vendors who have no ability to receive electronic funds, use online bill pay that will send a paper check without your account number on it.
  • Use a separate checking account with check-writing privileges and keep a low balance in that account. Log in and review it at least once each month for suspicious withdrawals, and do not sign up for overdraft privileges on it.
  • Some banks offer a “whitelisting” service; some are called “check positive” or “positive pay.” The service allows customers to register specific check recipients the bank will allow to cash a check from your account — and no one else. NCC advocates this feature and we take the position that all banks should offer it. Some banks also offer this feature for ACH digital transfers, which also protect direct bank transfers.

Subscribe

Read More

Coming Soon