How do banks detect check fraud? Test the tools with planted checks

Banks detect check fraud in layers: image review that looks for alterations on each deposited item, positive pay that matches presented checks against the issuer's own list, duplicate matching across deposit channels, rules on the depositor's account history, and trained staff at the counter and in the back office. Which layer catches what at your institution is a question only a test can answer, and the tools behind those layers should be tested the way an auditor tests a control: by planting known failures among real work and counting what the control catches. Take a few thousand of your own cleared checks across every deposit channel, plant a set of known altered, counterfeit, fraudulently signed and duplicated items in the proportions FinCEN reports, run each tool over the mix, and count three things: frauds caught, frauds missed, and holds placed on good checks. A vendor's backtest on its own data cannot tell you any of that about your deposits. This is the test we would ask any buyer to run on Botminds' Check Fraud Detection, and the rest of this page sets out how to build it, how many planted checks it needs, and how to read the result.

Where the page shows the solution's own outputs, they come from a fictional sample: Norrell Federal Credit Union, whose September review is shown below.

How do banks detect check fraud?

With several controls, because no single one sees every kind of fraud. At the teller line and in remote deposit, people and image checks look for the marks of alteration: a payee line that has been washed or written over, an amount that differs in words and figures, a missing or mismatched endorsement, check stock that does not match the issuer's. Behind that, positive pay compares each check presented for payment with the file of checks the business customer actually wrote, so a changed payee or amount is stopped before it is paid. Duplicate matching compares each deposited image with items already deposited by mobile, at an ATM or in a branch. And account rules watch new accounts, unusual deposit sizes and fast withdrawals against the depositor's own history.

When a deposited check looks wrong, the bank's main lever is time. Regulation CC lets it delay the funds beyond the normal schedule on facts about that item, stated in a notice, which is the subject of what a reasonable cause exception hold needs. Institutions are also adding automated image analysis to the stack: in the Federal Reserve Financial Services 2026 risk officer survey, respondents put AI analysis of check images first among their solutions for check fraud losses, ahead of positive pay and manual review (FRFS Risk Officer Survey, 2026). Each layer has a miss rate and a cost in good checks held, and neither is printed on a vendor's brochure. That is why the rest of this guide is about testing.

How do you test check fraud detection software?

You test it on a seeded set: real, cleared checks whose outcome you already know, mixed with planted fraudulent items whose type you know, presented to the tool as if they were today's deposits. Because you know the answer for every item, every result can be scored. Because the good checks are your own, the test measures holds on good checks at your institution, not at the vendor's reference customer.

The reason to insist on it is in the regulators' own description of the market. The agencies' 2025 request for information on payments fraud says that "Products and services to detect altered or forged checks during the clearing process have varying degrees of effectiveness given that checks do not inherently include explicit security features" (OCC, Federal Reserve and FDIC, 90 FR 26293, June 2025). Varying effectiveness is a statement that the only number worth having is the one measured on your own checks.

A seeded test has four parts, and each has a trap. The good checks must be representative, or the hold rate is meaningless. The planted items must look like the frauds you actually receive, or the catch rate is flattering. The count must be large enough to separate tools, or the difference is noise. And the scoring must be per check and per dollar, or a tool that flags everything looks perfect.

What types of check fraud should a test include?

A test should include the types that reach deposit fraud teams, in roughly the proportions they arrive: altered checks most, then counterfeits, then fraudulently signed items, plus duplicates. FinCEN's review of mail theft-related check fraud reports gives the best public mix: by its manual review, altered checks appeared in about 44% of reports, counterfeits in 26% and fraudulently signed checks in 20% (FinCEN Financial Trend Analysis, 2024).

Within each type, plant a range of difficulty. FinCEN sorted the methods it saw into three tiers: unsophisticated (a crossed-out payee, changed letters or numbers, correction fluid), moderately sophisticated (chemical washing, counterfeits printed from a stolen check) and sophisticated (new accounts opened online to receive stolen checks, checks routed through romance and employment scams, insider help). A test with only crude alterations measures the easy tier, where any tool and most tellers succeed.

The Federal Reserve's 2026 risk officer survey suggests what else belongs in the set. Respondents reported experiencing payee forgery (89%), endorsement forgery (84%) and check washing (83%), and 32% reported counterfeiting increasing (FRFS Risk Officer Survey, 2026). Endorsement forgery is easy to forget because it leaves the front untouched; a test that never plants a forged endorsement cannot tell you whether a tool reads the back of the check at all. The survey describes itself as "not independent academic research", with a margin of error of plus or minus 6%.

Build the planted set from your own cleared checks

The good checks should be a recent, random draw of your own paid items, weighted by channel the way your deposits actually arrive. On the sample credit union's Tuesday, 53% of 16,480 checks came by mobile, 24% at the teller line, 14% at ATMs and 9% by business remote deposit; a test drawn mostly from branch deposits would measure the wrong images. Items that were later returned unpaid for fraud are not good checks and must be excluded or moved to the planted side.

The planted items are harder. The most faithful source is your own confirmed fraud: images of altered, counterfeit and forged items from your past cases, which carry the real artefacts of your capture devices. A second source is constructed items: paid checks altered for the test by your own team, under controls, with every alteration written down before the run. Mix them in without telling the tool, or the vendor, which items are planted.

Two controls keep the test honest. The person who builds the set does not operate the tool, and the answer key stays with internal audit or the fraud manager until the run is complete. And every planted item gets a type, a tier and a dollar amount in the key, so results can be cut by each.

How many test checks do you need?

You need enough planted items of each type that the catch rate you measure is tighter than the difference you care about. With 50 planted altered checks, a tool that catches 45 has an observed rate of 90%, but the 95% interval runs from about 79% to 96%: wide enough to hide a real difference between two tools. At 200 it narrows to about 85% to 93%.

The arithmetic points to a practical design. Most institutions cannot plant 400 counterfeits, so plant enough of the dominant types, altered and counterfeit, to read them separately, and pool the rest. A tool that misses none of the planted items still has an uncertain miss rate: zero misses in 61 confirmed frauds is consistent, at 95% confidence, with a true miss rate up to about 5%, by the statisticians' rule of three.

How do you measure false holds?

Measure false holds as holds placed on checks that were later paid, per confirmed fraud and per thousand good checks, never as a share of alerts. An alert that a person clears before the availability run costs minutes; a hold costs a member access to money, a notice under Reg CC, and often a call to a branch. The two belong in different columns.

The sample shows why the ratio matters. In September the credit union's agents flagged 2,940 checks; analysts held 735, and 61 were confirmed as fraud, with $176,400 attempted. The other 674 holds, 92% of all holds, landed on checks that were paid in full: about eleven holds on good checks for every confirmed fraud. A tool that halves that ratio while catching the same 61 is worth more than one that catches 62 and doubles it.

A month of outcomes, counted the way a seeded test should be

A wrong hold also has a legal edge. If a reasonable-cause hold is placed without written notice at the time of deposit and the check is then paid, Reg CC bars overdraft and returned-check fees that would not have happened but for the delay, unless the notice told the customer about refunds and the bank refunds on request (12 CFR 229.13(e)(2)). A test that counts holds on good checks is counting future refund requests too. The full cost is worked through in check fraud losses in 2025, and the cost of a wrong hold.

What is a good catch rate for check fraud?

There is no published benchmark, so a good catch rate is one stated three ways and measured on your own checks: by count, by dollars, and by type. Count alone can hide a tool that catches many small frauds and misses the few large ones; dollars alone can hide a tool that misses most counterfeits because the ones you planted happened to be small. FinCEN's figures show how skewed amounts are: across the mail-theft reports the average activity amount was $44,774 and the median $14,215.

Set the bar from your own losses, not from a vendor sheet. The solution's design target is 90% of attempted check fraud dollars stopped before release. That is a target to be measured in a live deployment, and it is stated in dollars on purpose: the dollars that leave before a decision are the ones that become losses.

Why a vendor's backtest is not a seeded test

A backtest replays past items whose outcome is already known, usually items the institution itself investigated. Its weakness is the label: frauds that were never caught are labelled good, so a backtest cannot see the misses that matter most. Research on payment fraud names the problem. Dal Pozzolo and colleagues name two of the problems fraud detection faces: genuine transactions vastly outnumber frauds, and investigators confirm the outcome of only a small share of transactions in time to learn from them (IEEE Transactions on Neural Networks and Learning Systems). Their data were card transactions, but both effects apply to checks: outcomes exist only for what someone checked.

The solution's tuning agent runs backtests every month, and they are useful for what they are: a quick check that a proposed threshold would not have released last month's confirmed fraud. They are not a substitute for a seeded test before go-live, and the solution does not present them as one.

What does a check fraud vendor need to prove?

A vendor needs to prove four things on your seeded set: what it caught by type and tier, what it missed, how many good checks it would have held, and why it flagged each item it flagged. The last is the one buyers forget. A flag that cannot be explained cannot become the reason in a Reg CC notice, and the analyst ends up writing the reason from scratch.

Model risk guidance adds a reason to keep the paperwork. The revised interagency guidance of April 2026 treats a statistical tool that turns inputs into estimates as a model, and describes model testing, validation and monitoring, including outcomes analyses, with separate considerations for vendor products (OCC Bulletin 2026-13). A seeded test, written up, is that testing. How the image agent itself reaches its findings is covered in AI check fraud detection: inside the image forensics agent.

Can you test check fraud tools on your own data?

Yes, and you should, with the same controls you apply to any customer data. Check images carry the payor's name, address, account and routing number and signature, which is why the agencies' RFI notes that checks "contain sensitive information" usable for other fraud. Run the test in an environment with role-based access, masked account numbers in anything exported, a written retention period and deletion at the end.

In the solution, named roles open check images, account numbers are masked to the last four digits, every image view is logged, and decisions, images and notices are kept for the institution's chosen period: seven years in the sample, never less than the five years Bank Secrecy Act records require. A test set should be held the same way, and destroyed when the evaluation closes.

Every image view and decision on a trail nobody can edit

One practical point decides how fast the test runs: access to the archive. The duplicate and image comparisons need the payor's earlier checks, so the test needs the same archive connection the live service would use. A vendor that wants your images copied to its own environment for the test is telling you how the live service will work too. Which items the solution searched, and how the agents' readings were combined, is visible on each item; to see that flow on one sample deposit, start from Check Fraud Detection. Why the altered and counterfeit categories need separate scoring is set out in counterfeit check vs altered check.

Questions people ask

How long should a check fraud tool evaluation run?

Long enough to cover the deposit patterns that matter: at least one full month, so the set includes month-end business deposits, payroll weeks and a holiday-shortened week. The September sample in the solution covers 21 business days. A shorter test risks a set that reflects one unusual week rather than the institution's normal flow.

Should a test include checks that look suspicious but are good?

Yes: those are what drive holds on good checks. Include large first deposits from new accounts, business checks above the $6,725 large-deposit line inside a customer's normal range, and redeposited items. In the sample, a business member's $8,400 remote deposit was over $6,725 but inside its usual $6,000 to $11,000 range, and the right answer was release.

What is the difference between a catch rate and a hit rate?

A catch rate is the share of frauds the tool flags; a hit rate, or precision, is the share of flags that turn out to be fraud. In the sample month, 61 of 735 holds were confirmed fraud, a hit rate of about 8% on holds. A tool can raise one by sacrificing the other, which is why both belong in the result.

Can a seeded test include duplicate deposits?

It should. Present the same paid check twice, once by mobile and once at a branch or ATM, a few days apart, and see whether the tool links them on more than the serial number. The sample's duplicate agent matches serial, routing number, account, amount and an image fingerprint, and never closes a duplicate on the serial alone.

Who should own the answer key in a check fraud test?

Someone who does not operate the tool, typically internal audit or the fraud manager. The key lists every planted item with its type, tier and amount, and stays sealed until the run is complete, so neither the vendor nor the analysts can tune to it.