Check fraud detection that pins every finding on the check and drafts the Reg CC hold a person signs
Bad checks stopped before the money leaves; good deposits released the same day.
See one case, screen by screen ↓Check fraud detection is the work of screening deposited checks for counterfeits, alterations, washing and duplicate deposits before the funds are released. In Check Fraud Detection, three agents read each flagged check independently and pin their findings on the check image with the source they read; a deposit fraud analyst decides, and a supervisor co-signs large holds and restrictions.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
Check fraud detection starts with a score. A credit union takes thousands of checks a day at the teller line, in its ATMs, by mobile deposit and by business remote deposit, and an engine flags the suspect ones. Then a deposit fraud analyst opens each flagged item in the check image archive, the core, the remote deposit platform and a case tool, and looks by eye for a counterfeit, an altered amount, a washed payee or a check already deposited somewhere else.
She has until the evening availability run. If she holds a check, the member is owed a notice with the reason and the date the funds will be available, counted around Federal Reserve holidays. Most flagged checks are good, so every needless hold is a member waiting and a call to the branch; every missed duplicate is money gone. And a new member with a counterfeit check may be the victim of a job or overpayment scam, not the one who made it.
Estimated split of one flagged check's working minutes, by hand and with the agents: our estimate, kept modest. The decision itself stays with the analyst and takes about as long either way.
Three agents read each flagged check on their own and pin what they find on the image; an analyst decides and a supervisor co-signs.
Tuesday, October 20, at Norrell Federal Credit Union. Dalton Reese, a member for 23 days, deposits check 10442 from Halvorsen Roofing LLC by mobile at 9:12 AM. Here is how the agents read it and the people decide it.
16,480 checks came in since last night's cutoff: 3,910 at the teller line, 2,240 in ATMs, 8,770 by mobile and 1,560 by business remote deposit. The agents flagged 138; 92 look clean on a second look and 46 need a person before the 6:00 PM cutoff. A banner says the check image archive was slow from 7:40 to 8:05 AM and that six partial duplicate searches were run again.
The check fills the screen, front above back, with five numbered callouts: payee line, amount field, MICR serial, signature line and endorsement. Callout 1: the payee line is printed at 61% of the toner density of the date and amount lines, while the rest of the front matches the archive original at 97%. The image forensics and duplicate presentment agents read the check as not good; the depositor behavior agent rates the member medium and writes out why.
“This reads like a member who was sent the check, in a job or overpayment scam, more than one who made it. Call before you restrict.”
The agent searched the credit union's own item archive across branch, ATM, mobile and business remote deposit. Check 10442 was deposited at the Westfield branch ATM on Sunday, October 11 at 4:51 PM by Kessler Gutter & Supply and paid on October 13, nine days before this mobile deposit. The finding cites archive item 1011-2290 at confidence 0.99.
Field by field, six agree: serial, routing number, paying account, amount, date and memo. The payee differs and the signature line has no microprint. The agent also linked check 10443 from the same paying account, $3,960.00, presented at the Brookline teller line at 9:40 AM by a 20-day-old member.
The duplicate presentment agent never closes a duplicate on the serial alone.
The verdict is one sentence: “Hold $4,850 under Reg CC 229.13(e) reasonable cause until Thursday, October 29.” Renata approves with reason code HR-01, the item was already presented and paid, and adds the agents' proposed 30-day pause on mobile deposit, until November 19. A restriction always needs a second approver.
Banking day of deposit Tuesday, October 20; normal availability Thursday, October 22 under 12 CFR 229.12(b); plus five business days under 229.13(h)(4), with no Federal Reserve holiday in the window. The notice states the account, the date and amount of the deposit, the reason and the date the funds will be available, and is due by Wednesday, October 21. A pre-send check confirms there is no SAR, referral or case wording and no internal item ID.
Dorian co-signs the hold and the mobile deposit pause. The analyst who decided cannot sign twice, and a restriction on an account always needs a second approver.
“I sign what I can see the reason for. I never sign my own.”
The notice goes to online banking and by mail, and the hold posts to the core. In the app Dalton sees $4,850.00 on hold until October 29 and the reason in plain words. There is no case number, no referral and no internal wording.
The paying bank's fraud desk, called at the number in the bank directory and never the number on the check, confirms that 10442 was paid on October 13 and that the drawer issued no second check. Renata confirms the item as counterfeit at 1:34 PM and Dorian co-signs the reversal of the provisional credit at 1:41 PM. Loss $0; $4,850 prevented. The behavior agent's reading travels with the case, with a call script that never mentions a referral.
Checks 10442 and 10443 total $8,810, over the $5,000 threshold for a known suspect (12 CFR 748.1(c), 31 CFR 1020.320). The agent drafts the facts, each sentence citing a record, and sends the referral to Tomasz Brenner, BSA Officer, who decides by November 19, 30 calendar days from detection. Branch staff, member notices, online banking and statements never see it.
The agent drafts the facts. It never files.
The same $4,850 deposit, seen by the people who carry it: what their day looked like, and what it looks like now.
Three agents read each flagged check on their own and pin what they find on the image; an analyst decides and a supervisor co-signs.
Brings each flagged check to the three readers, keeps the cutoff clock and writes the verdict sentence from their readings.
Reads the front and back: ink and toner density, washing, the amount field, check stock and microprint, the MICR line and the endorsement, and pins each finding to its region.
Reads account age, deposit history, velocity, channel, device and address, and says when a member reads as a victim rather than a maker.
Searches the credit union's own item archive across branch, ATM, mobile and business remote deposit by serial, routing, account, amount and image fingerprint, and links sibling items.
Chooses the Reg CC exception, computes the release date against the Federal Reserve holiday calendar, drafts the notice with the stated reason, and checks every member-facing word.
After confirmed fraud, drafts the reversal or chargeback, the warranty claim and the general ledger entries, and tracks the recovery.
Tests the SAR thresholds, adds up linked items, and drafts the facts and dates for the BSA team.
Reviews each month's hold outcomes and backtests threshold changes against the month's confirmed fraud.
Approves with a reason; a supervisor co-signs. The agents propose; a named person decides.
The analyst can ask about the check in front of her, a member, a hold or a rule. Each answer cites the archive item, the callout or the regulation it rests on, and opens the screen it talks about.
Why hold this check instead of returning it?
Because Norrell is the depositary here: it cannot return a check that has not been sent back to it, but it can delay availability with a stated reason. Two agents found that check 10442 was already paid on October 13 and that the payee line is a reprint, which is reasonable cause under 12 CFR 229.13(e). If Corvane National Bank confirms the duplicate, the credit is reversed with two signatures.
Where else has check 10442 been presented?
Once before: at the Westfield branch ATM WF-02 on Sunday, October 11 at 4:51 PM, by Kessler Gutter & Supply, paid on October 13. Serial, routing number, account, amount and the image outside the payee line all agree. The next number, 10443, came to the Brookline teller today at 9:40 AM from another new member.
Which holds release tomorrow, and does any cross a holiday?
31 holds release tomorrow, Wednesday, October 21, on the date each notice states. One crossed a holiday: CK-1009-0577, $2,180, deposited Friday, October 9; Columbus Day was skipped. None of today's holds reach Veterans Day on November 11.
Draft the BSA referral for the Halvorsen Roofing checks
Drafted. Checks 10442 and 10443 come from the same paying account and total $8,810, over the $5,000 threshold for a known suspect. Detection was October 20, so the BSA officer decides by November 19. The behavior agent's note that one member may be a victim is in the facts. Nothing in it reaches a member; Tomasz Brenner decides whether to file.
13 screens from the working solution, on its sample data. Pick one to see it large.
Every setting is the credit union's own, versioned and written to the audit trail. Only the Fraud Manager changes them; a stepper shows the effect on today's list before it is saved.
| Setting | Default | Choose from |
|---|---|---|
| Second approver for holds over | $5,000 | $1,000 to $10,000, in steps of $1,000; always for restrictions, returns, chargebacks and member record changes |
| Decision cutoff | 6:00 PM | 5:00 PM, 6:00 PM or 7:00 PM, before the 8:00 PM availability run |
| Escalate to the supervisor at | 4:00 PM | 3:00 PM, 4:00 PM or 5:00 PM |
| Reasonable-cause extension | 5 business days | 1 to 5 business days beyond the normal schedule |
| Holiday calendar | Federal Reserve 2026 | Federal Reserve 2026, or 2027 from January 1 |
| Channels screened | All four channels | All four channels, or mobile and ATM only |
| Image forensics confidence floor | 0.80 | 0.60 to 0.95, in steps of 0.05; below it a finding is a question, not a callout |
| Keep decisions, images and notices for | 7 years | 5, 7 or 10 years |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (FinCEN SAR data reported by Thomson Reuters: about 682,000 check fraud reports in 2024; FinCEN Financial Trend Analysis on mail theft-related check fraud, September 2024: 44% altered and deposited, more than $688 million in six months) · Rules: 12 CFR 229.12 and 229.13 (exception holds, notice and reasonable extension), Reg CC amounts effective July 1, 2025 (Federal Register 2024-10844), 12 CFR 748.1(c) and 31 CFR 1020.320 (SARs), 31 CFR 1010.430 (record retention). Norrell Federal Credit Union, its members, the businesses, checks, accounts and routing numbers, the paying bank and the people named on this page are fictional — characters and sample data in the working solution.
Check fraud detection is the work of screening deposited checks for counterfeits, alterations, washing and duplicate deposits before the funds are released. In Check Fraud Detection, three agents read each flagged check independently and pin their findings on the check image with the source they read; a deposit fraud analyst decides, and a supervisor co-signs large holds and restrictions.
The duplicate presentment agent searches the institution's own item archive across teller, ATM, mobile and business remote deposit by serial, routing number, account, amount and image fingerprint. It never closes a duplicate on the serial alone, links sibling checks from the same paying account into one case, and marks a search as partial and runs it again when the archive is slow.
Regulation CC allows exception holds for new accounts, large deposits (the amount over $6,725 since July 1, 2025), redeposited checks, repeated overdrafts, reasonable cause to doubt collectibility and emergency conditions (12 CFR 229.13). In the solution each hold carries one of the credit union's eight reason codes, and the hold and notice agent proposes the exception the facts support.
The notice states the account, the date and amount of the deposit, the reason the exception was invoked and when the funds will be available; for a deposit not made in person it is due by the first business day after the banking day of deposit (12 CFR 229.13(g)). Reg CC treats an extension of up to five business days beyond the normal schedule as reasonable for most checks (229.13(h)(4)). The agent drafts the notice and counts the date around Federal Reserve holidays; a person approves and sends it.
No. The depositor behavior agent reads the member separately from the check and says when a member reads as a victim of a job or overpayment scam rather than the maker. When the agents disagree, the screen writes out the dissent instead of blending it into a score, and the case carries a call script that never mentions a referral.
No. Member notices, online banking, statements and branch screens never carry referral, SAR or case wording, and a pre-send check looks for it in every member-facing word. Referrals are visible to the fraud and BSA roles only, and the BSA referral agent drafts the facts but never files.
Yes. The agents read, cite and draft; a named analyst decides every flagged check, and releasing against the agents needs an override code and a note. A second, different person signs holds over $5,000, account restrictions, returns and chargebacks, and every step is on an audit trail nobody can edit.
The Agentic Solution Engine builds and deploys it from your requirements and documents: your reason codes, notice templates, thresholds, holiday calendar and connections to the core, the check image archive and the remote deposit platform. It goes live once every quality gate has passed.
Bad accounts restricted before the first big deposit clears, with partners told on time.
1-min demoMoney Mule DetectionMule accounts frozen while the money is still there, and every victim's bank told.
1-min demoAccount Takeover Fraud PreventionTakeover transfers held before they leave; the real customer called on a trusted number.
1-min demoWe'll run Check Fraud Detection on a sample of your own flagged checks and hold notices.