Check fraud training for tellers should start from an uncomfortable fact: most stolen checks never reach a teller. FinCEN's review of mail theft-related check fraud found that criminals prefer remote deposit capture and ATMs precisely because no employee looks at the item, so the teller now sees the in-person remainder: the non-customer cashing a large check, the payee written over another name, the stock that feels wrong in the hand. Good training teaches that encounter from FinCEN's own red flags, tells the teller what to do and say, and puts what the teller saw into the deposit fraud analyst's file the same day. Botminds' Check Fraud Detection is built around that analyst. Its agents read every flagged check from all four channels, and a teller's observation arrives as one more piece of evidence on the item, beside the image and the archive.
The examples on this page come from a fictional sample: Norrell Federal Credit Union on Tuesday, October 20, as it runs through the solution. The figures on fraud come from FinCEN, the Federal Reserve and the Department of Labor, linked where they appear.
Most stolen checks never reach a teller
The teller line is now the smallest door for a stolen check, and criminals choose it last. In its September 2024 analysis of 15,417 reports filed under its mail-theft alert, FinCEN put it plainly: "Many perpetrators utilized methods that avoid human contact, including check deposits via remote deposit capture (RDC) or at automated teller machines (ATMs) and opening accounts online rather than in person" (FinCEN Financial Trend Analysis, 2024).
The same report says why. Depositing without a person "eliminates a hurdle to negotiating the checks in person, as bank officials could potentially detect the fraudulent check or become suspicious of the person depositing the check, which could hinder the scheme." That sentence is the best argument for teller training there is: the fraud is routed around tellers because tellers catch it.
Where one sample day's 16,480 checks came in: under a quarter crossed a counter
Checks deposited since the previous night's cutoff
- Teller line 3,910 · 23.7%
- ATM 2,240 · 13.6%
- Mobile 8,770 · 53.2%
- Business remote 1,560 · 9.5%
The consequence for a training plan is a narrower job. A teller does not need a course on every check fraud typology; the image, the archive and the deposit history now do most of that reading for the 76% of items that never touch a counter. A teller needs to be very good at the handful of things only a person in the room can notice, and at handing them on.
What should tellers look for in a fake check?
Tellers should look for the red flags that show up in person: who is presenting the check, what they say about it, what the paper feels and looks like, and whether the writing has been worked over. FinCEN's February 2023 alert, written with the U.S. Postal Inspection Service, lists ten red flags for mail theft-related check fraud. Five of them can surface at a teller window; the other five live in account data that only a system, or an analyst, sees across days.
FinCEN's ten red flags: five can show up at the window, five only in the data
| FinCEN red flag (paraphrased) | Can a teller see it? | Where else it shows |
|---|---|---|
| A non-customer cashes a large check, or several, and gives a suspicious explanation | Yes: it happens in front of the teller | Nowhere else until the return arrives |
| A customer complains a check was stolen from the mail and deposited elsewhere | Yes: the complaint usually starts at a branch | Claims and the fraud case |
| A customer says a check they mailed never arrived | Yes | Claims; the payee's complaint |
| The check stock looks noticeably different from the issuer's usual stock | Yes, on paper; less so on an image | Image comparison with the payor's earlier checks |
| Faded handwriting sits under darker handwriting | Yes, with a good look at the original | Image forensics, if the scan keeps it |
| An existing customer with no check history starts depositing checks and moving the money | No | Deposit history and velocity |
| A sudden, unusual deposit of checks, often electronic, then rapid withdrawal | No | Monitoring across channels |
| A new account seems used only to deposit checks and move funds out | Rarely | Account age, deposit and withdrawal pattern |
| Large withdrawals by check to a new payee | Sometimes, on an on-us check | Paying-side review and positive pay |
| Signs of other suspicious activity, such as pandemic-related fraud | No | Investigations and SAR history |
The first row is the one FinCEN wrote for tellers. In its words: "A non-customer that is attempting to cash a large check or multiple large checks in-person and, when questioned by the financial institution, provides an explanation that is suspicious or potentially indicative of money mule activity" (FIN-2023-Alert003). The flag has two parts, and both need a person: someone has to ask the question, and someone has to judge the answer.
FinCEN's caution matters as much as its list. "As no single red flag is determinative of illicit or suspicious activity," the alert says, institutions should weigh the surrounding facts, such as the customer's history and whether several flags appear together. Training that turns the list into a set of automatic refusals teaches the wrong lesson. Training that teaches tellers to notice, ask and write it down teaches the right one.
How do tellers spot altered checks?
Tellers spot altered checks by reading the check the way the paying bank's customer wrote it: the payee and the amount first, then whether the two amount fields agree, then the ink. The Department of Labor's own description of the job already includes it. Among a teller's core tasks O*NET lists "Examine checks for endorsements and to verify other information, such as dates, bank names, identification of the persons receiving payments, and the legality of the documents" (O*NET 43-3071.00, Tellers).
FinCEN's 2024 analysis says where to look first. "The payee line was the most frequently altered section, followed by the amount, which is typically made higher than the intended amount" (FinCEN, 2024). The crude alterations are visible at arm's length: the report's least sophisticated methods include payees "crossed out" with a new name added, letters or numbers changed, and correction fluid. The careful ones, chemically washed and rewritten, are subtler, and how checks are washed, and what still shows on the image covers what survives.
One check on the sample credit union's list shows the cheapest test of all. A county refund check deposited by mobile for $1,275.40 had its written amount line still reading two hundred seventy-five and 40/100: the figure in the box was raised, the words were not. At a counter, a teller who reads both amount fields catches that in seconds. Whether an item is altered or counterfeit changes what happens next, including who carries the loss, which counterfeit check vs altered check works through.
What should a teller do with a suspicious check?
A teller who doubts a check should slow the transaction down, ask, verify with the paying bank through a number the teller looks up, and write down what was seen, without accusing the person at the window and without mentioning a report. The steps below are a starting point a branch can adapt; the legal anchors are cited where they apply.
Seven steps for a teller holding a doubtful check
- Ask open questions, then listen
Who is the check from, and what is it for? FinCEN's in-person red flag turns on the explanation, so the question has to be asked.
- Read both amounts and the payee line against each other
The payee is the most altered field and the amount the next; a box figure the words do not support is an alteration until shown otherwise.
- Compare the stock and the ink with what you know
A business check on unusual paper, or handwriting over fainter handwriting, is worth a second person's look.
- Verify with the paying bank at a number you look up
Never the number printed on the check: a counterfeit can print any number it likes.
- If a hold is placed, give the notice at the counter
For a deposit made in person to an employee, Reg CC wants the exception notice at the time of deposit, with the reason and the availability date.
- Write down what you saw, in plain facts
The analyst needs the observation, not a verdict: "payee line shows a second name underneath", "presenter could not name the issuer".
- Never mention a report
Federal rules forbid disclosing a SAR or anything that would reveal one; the teller's words to the customer stay with the hold and its reason.
Two of those steps carry law. On the hold notice, Reg CC says the notice "shall be provided to the depositor at the time of the deposit, unless the deposit is not made in person to an employee of the depositary bank", or unless the facts only become known later (12 CFR 229.13(g)(1)(ii)). The Board's commentary adds that the depositor at the counter "need not be the customer holding the account" (Reg CC commentary, 229.13(g)). A teller who places a hold is therefore the person who hands over its reason, which is why the reason has to be one the teller can say out loud.
On reports, the rule is absolute and short: nobody at the bank, from a director to a teller, may disclose a SAR or anything that would show one exists (31 CFR 1020.320(e)(1)(i)). A teller who says "we've reported this" has broken it. The teller's script is the hold, its reason and its date, and nothing about what happens behind them.
Is check fraud training required for bank employees?
No federal rule requires training on check fraud by name, but every bank and credit union's anti-money laundering program must include training, and check fraud sits inside it. The Bank Secrecy Act rule for banks, savings associations and credit unions requires a program that includes, at a minimum, "Training for appropriate personnel" (31 CFR 1020.210). Tellers are among the most appropriate personnel there are: FinCEN's alert exists to get check fraud reported in SARs, and the reports start with what front-line staff notice.
Institutions say they rely on it. In the Federal Reserve Financial Services Risk Officer Survey fielded in late 2025, respondents listed manual reviews and staff training among their own solutions for check fraud losses, beside image analysis, positive pay and monitoring of new accounts (FRFS Risk Officer Survey, 2026). The survey describes itself as "not independent academic research" and carries a margin of error of plus or minus 6%, but its list is a fair picture of where peers put their effort.
The scale of the audience is large and shrinking. O*NET counts 339,200 tellers in 2025, at a median wage of $43,030, with employment projected to decline (O*NET). Fewer tellers seeing a smaller share of the checks is the reason the training has to be sharper, not the reason to drop it.
The teller's look belongs in the analyst's file the same day
A teller's observation is evidence, and evidence that waits in a branch log for a week is evidence nobody used. The deposit fraud analyst decides holds against an evening availability run; in the sample, the cutoff is 6:00 PM before an 8:00 PM run. An observation that reaches her after the run arrives after the money has gone.
Who carries a doubtful check at the counter, before and after the agents read the rest
Today
Notices a doubtful check, mentions it to a supervisor, and writes a note the analyst may never see before the funds release.
With agents
Records the observation on the item itself, in plain facts, where the analyst reads it beside the image and the archive search.
Still theirs: The question at the window, the judgment of the answer, and the words said to the customer.
Today
Opens the item in the image archive, the core and the remote deposit platform, and may not know a teller saw anything.
With agents
Sees the agents' pinned findings and the teller's note on one screen, and decides hold, release, return or ask.
Still theirs: Every hold decision and its reason; nothing is held or released without her.
Today
Answers members about holds she did not place, without a reason she can repeat.
With agents
Gets a task when the fraud team needs a captured paper item pulled, and a notice that states the reason in plain words.
Still theirs: The conversation with the member; referrals never reach branch screens.
Today
Signs large holds and restrictions without the image, the reason and the notice in one place.
With agents
Co-signs with the analyst's reason code, the image and the drafted notice together.
Still theirs: The second signature; nobody signs their own decision.
On the sample day a teller's note did exactly that. At 9:40 AM a 20-day-old member presented a $3,960 check at the Brookline counter, drawn on the same paying account as a $4,850 item deposited by mobile half an hour earlier, and asked for $2,000 in cash; the teller refused the cash and wrote down the request. By 1:45 PM that note was one of the cited facts in the referral the solution drafted for the BSA officer, beside the image findings on both checks. Nothing the teller saw was retyped or lost.
The branch side runs both ways. In the sample, the fraud team's screen lists three branch tasks for the day: hand a member a hold notice at the Brookline counter once the analyst approves it; pull a paper check that a Westfield ATM captured, so its original can be examined; and call a member at Fairview whose file names a trusted contact, using a script the team has already written. Each task names the branch, the item and the reason, and none of it mentions a referral.
The fraud team's clock, with the tasks it sends to branches
What does FinCEN say about mail theft check fraud?
FinCEN says mail theft-related check fraud surged after the pandemic, that it is most often an alteration crime, and that institutions should report it under a dedicated key term. Its February 2023 alert, issued with the Postal Inspection Service, asks filers to put "FIN-2023-MAILTHEFT" in SAR field 2 and the narrative and to mark the check fraud box, field 34(d). In the first six months after the alert, 841 institutions filed 15,417 reports using that term, describing more than $688 million in actual and attempted transactions (FinCEN, 2024).
For a branch, the most practical line in the alert is about victims, not criminals. FinCEN asks institutions to refer customers who may be victims of mail theft-related check fraud to the Postal Inspection Service, at 1-877-876-2455 or uspis.gov/report, and to point them to the Service's mail theft tips. The customer who walks in saying a mailed check never arrived is reporting a crime; the teller's job is to start both the bank's claim and the customer's report.
How often should tellers get fraud training?
No federal rule sets a frequency for check fraud training; the useful frequency is whenever the evidence changes. The anti-money laundering program rule requires training without fixing a calendar, and each institution's program sets its own cycle. Check fraud moves faster than an annual module: FinCEN's alert came in 2023, its trend analysis in 2024, and the 2026 survey reports counterfeiting, washing and payee forgery all increasing at a share of institutions.
The richest training material is the institution's own outcomes. Every hold ends paid, returned or confirmed as fraud, and a monthly review of those outcomes shows which observations predicted fraud and which did not. In the sample's September review, 735 holds produced 61 confirmed frauds; 71 of the holds on good items rested on an endorsement finding alone. A teller session built on that month's confirmed cases, and on the good checks that were held for nothing, teaches more than a generic deck.
Three short habits keep the training alive between sessions: a weekly note of the month's confirmed cases with the image of each, a standing slot to ask the fraud desk what happened to an item the teller doubted, and a refresher each time FinCEN or the Postal Inspection Service publishes a new alert. The last one costs nothing and keeps the window current with the criminals.
What the teller says when a member asks about a hold
The teller says the reason on the notice and the date the funds will be available, and nothing else. Reg CC requires the exception notice to carry the account, the date of the deposit, the amount delayed, the reason for invoking the exception and the time within which the funds will be available (12 CFR 229.13(g)(1)(i)). A notice that states its reason in plain words is one a teller can repeat; a notice that says only "exception hold" sends the member back to the counter for an explanation nobody at the counter has.
What the member reads in the app: the reason and the date, in plain words
The sample shows the sentence in practice. A member's $4,850 mobile deposit was held until Thursday, October 29, and the notice said why in one plain sentence: a check carrying that number, drawn on that account and for that amount, had already been deposited and paid. It names no rule number the member must look up and no internal code, and it is true. When the member calls the branch, the teller can read it aloud. For what the reason has to contain to stand up, see what a reasonable cause exception hold needs.
The analyst wrote that reason and a supervisor signed it; the branch delivered it. That division is the point of the whole design, and it is why the training for tellers can be short and sharp: notice, ask, write it down, say only the reason. To see the analyst's side of the same deposit, start from Check Fraud Detection.
Questions people ask
How many bank tellers are there in the United States?
O*NET, drawing on Bureau of Labor Statistics data, counts 339,200 tellers in 2025, with a median wage of $43,030 a year. Employment is projected to decline from 2025 to 2035, with 26,800 projected job openings over the decade. Fewer tellers, seeing a smaller share of deposits, is why each one's training has to concentrate on what only a person can see.
Should a teller call the phone number printed on a check to verify it?
No. A counterfeit check can carry any phone number its maker prints, including one that rings an accomplice. The number for the paying bank should come from a source independent of the check, such as a bank directory or the institution's own files; that is how the sample credit union's fraud desk confirmed a duplicate with the paying bank.
Does the person who deposits a check have to receive the hold notice?
For a deposit made in person to an employee, Reg CC's commentary says the notice generally goes to the person making the deposit at the time of deposit, and that person need not be the account holder. For a deposit not made to an employee, such as at an ATM, by mail or by mobile, the notice is mailed or delivered to the customer no later than the first business day after the deposit, or after the facts become known if that is later.
What key term do banks use when filing a SAR on mail theft check fraud?
FinCEN asks filers to include "FIN-2023-MAILTHEFT" in SAR field 2 and in the narrative, and to mark field 34(d), check fraud. The term let FinCEN count 15,417 reports from 841 institutions in the alert's first six months; banks filed 88% of them.
What should a customer do if a check they mailed was stolen?
Contact their bank at once, so the bank can start its claim, and report the theft to the U.S. Postal Inspection Service at 1-877-876-2455 or uspis.gov/report. FinCEN asks institutions to make that referral; the Postal Inspection Service is the federal agency that investigates mail theft.