Counterfeit check vs altered check: two frauds, two kinds of evidence

The difference between a counterfeit check and an altered check is whether the paper is real. An altered check is a genuine check, issued by the account holder, on which someone has changed the payee, the amount or the date. A counterfeit check is a fake made to pass for a genuine one, very often printed from a stolen check used as a template, so it carries a real account and routing number on paper the account holder never issued. FinCEN's review of mail theft-related check fraud found alteration the most common outcome, at about 44% of reports, and counterfeiting second, at 26%. The two leave different evidence: an alteration shows inside the check, as a field that disagrees with the rest; a counterfeit shows against the outside world, as stock, layout or a serial that does not match the account's real checks. They also land on different banks under the Uniform Commercial Code. Botminds' Check Fraud Detection reads for both and labels which one it found, because the label decides what happens next.

The examples come from a fictional sample, Norrell Federal Credit Union, as it runs through the solution in October.

What is the difference between a counterfeit and an altered check?

An alteration changes a real instrument; a counterfeit imitates one. The Uniform Commercial Code defines the first precisely: an alteration is any unauthorized change to an instrument that claims to alter, in any way, what a party is obliged to pay, or any unauthorized addition of words or numbers to an incomplete instrument that bears on that obligation (UCC 3-407(a), official text). A changed payee, a raised amount and a filled-in blank all qualify.

A counterfeit is a check whose drawer's signature is unauthorized from the start, because the drawer never issued it. FinCEN's 2024 analysis describes how most are made after a mail theft: "If a stolen check is not altered or directly deposited, criminals may use it as a template to create counterfeit checks, which was the second most frequently observed behavior" (FinCEN Financial Trend Analysis, 2024). The template supplies the hard part, the real account and routing numbers; the counterfeiter supplies the paper, the payee and the amount.

A third kind sits between them. A fraudulently signed check is a genuine blank, or a genuine check made out to someone else, signed by a person with no right to sign: a forged drawer's signature on stolen blank stock, or a forged endorsement on the back. FinCEN counted it at about 20% of the mail-theft reports.

Which is more common, altered or counterfeit checks?

Altered checks, in the reported data, by a wide margin. "Altered checks accounted for approximately 44 percent of the BSA reports, counterfeit accounted for 26 percent, and fraudulently signed checks were 20 percent, according to manual review of BSA reports," FinCEN found across 15,417 reports filed from February to August 2023 under its mail-theft alert. FinCEN notes the figures count methods per deposit, so one report can describe more than one.

Counterfeiting is where the growth is. In the Federal Reserve's risk officer survey fielded in late 2025, only 5% of institutions said they had never experienced counterfeit checks, and more institutions reported counterfeiting increasing than any other kind of check fraud.

The two sources measure different things, which is why they disagree on emphasis. FinCEN counts what institutions reported in suspicious activity filings during one surge; the survey counts how many institutions see each type rising. Read together, they say alteration is the bigger stock of cases and counterfeiting the faster-growing one.

What each leaves on the image

An altered check gives itself away by disagreeing with itself; a counterfeit gives itself away by disagreeing with the account's real checks. That is the practical rule an analyst, or an image agent, works from: compare inside the item for alteration, compare outside it for counterfeiting.

How do you tell if a check was altered?

Check the fields against each other first: the written amount against the figures, the payee against the endorsement, the date against the deposit. Then look at how the ink sits: an overwritten field is usually darker, fainter or differently spaced than the lines around it. FinCEN's 2024 analysis found the payee line was the field most often altered, followed by the amount, and its 2023 alert lists overwritten handwriting as a red flag.

The sample credit union's October cases show both kinds of alteration. A county refund deposited by mobile showed $1,275.40 in figures while its written line still read two hundred seventy-five and 40/100: a raised amount, caught because two fields disagreed. And a member's own share draft for $380 was altered to $3,880 and paid before anyone noticed; that one came back through a warranty claim against the bank that presented it. The chemical route to an alteration, and what survives it, is in how checks are washed, and what still shows on the image.

Alteration that is done well can defeat a field-by-field check, which is why the comparison with the account's earlier checks matters for both kinds. If the archive holds a paid original with the same serial and every field matches except the payee, the item is not an altered original: it is a copy with a new payee, which is a counterfeit.

What is a counterfeit check made from?

Most often from a real one. FinCEN describes the method plainly: "Criminals took stolen checks and used them as a framework to create counterfeit checks with the victim's banking information. Some criminals used more sophisticated technology to make high-quality counterfeit checks." The cruder ones give themselves away on paper: "Financial institutions noted that poorly made counterfeit checks are often made using incorrect check stock, and security features" (FinCEN, 2024). The alert's matching red flag is checks that "appear to be of a noticeably different check stock than check stock used by the issuing bank and check stock used for known, legitimate transactions" (FIN-2023-Alert003).

The sample's $4,850 mobile deposit was a counterfeit of the high-quality kind. Against the archive original, six fields agreed: serial, routing number, paying account, amount, date and memo. The payee differed, and the signature line was a plain printed line where the genuine check carried microprint. The archive showed the genuine check 10442 deposited at a Westfield branch ATM on October 11 and paid on October 13. That made the new item both a counterfeit and a duplicate of a paid check.

A counterfeit beside the genuine check it was copied from

FinCEN draws the consequence: "If counterfeit checks are not identified during the negotiation process, losses resulting from that initial stolen check can be significantly higher." One stolen check can become many counterfeits; the sample's duplicate agent found a second, check 10443 from the same paying account, presented at another branch's teller line 28 minutes after the first.

What is a forged check, and how is it different from a counterfeit?

A forged check is a genuine instrument with a signature someone had no right to make; a counterfeit is not a genuine instrument at all. The forgery can be on the front, a drawer's signature on stolen blank checks, or on the back, an endorsement in the payee's name. FinCEN's analysis describes both: criminals who "stole newly ordered blank checks from the mail, forged the rightful account holder's signature, and then issued the checks to themselves or others", and others who "simply sign the back and attempt to negotiate it".

The survey shows how widespread the endorsement kind is: 84% of institutions reported experiencing endorsement forgery and 89% payee forgery (FRFS, 2026). A forged endorsement leaves the front of the check untouched, which is why a review that never reads the back misses it. In the solution, the image agent never judges an item without both sides.

Who carries the loss: altered vs counterfeit

Under the official text of the UCC, an altered check's loss usually travels back to the bank of first deposit, while a counterfeit's usually stays with the paying bank. The difference comes from the warranties every presenting bank gives the paying bank. It warrants without qualification that the check has not been altered; but on the drawer's signature it warrants only that it does not know the signature to be unauthorized (UCC 4-208(a)(2) and (3)). The claims side of that rule, from the warranty notice to the deadline, is in who is liable for altered checks.

The counterfeit route rests on an old rule now in UCC 3-418: a drawee that pays "on the mistaken belief that ... the signature of the drawer of the draft was authorized" may recover from the person paid, but cannot use that remedy against anyone who took the check in good faith and gave value for it (UCC 3-418(a), (c)). The paying bank is expected to know its own customer's signature.

Customers carry part of the duty too. A customer whose own lack of ordinary care contributes substantially to an alteration or a forged signature is precluded from asserting it against a bank that paid in good faith, with the loss shared if the bank was also careless (UCC 3-406). And a customer who does not report an alteration or unauthorized signature within one year after the statement or items are made available is precluded regardless of care (UCC 4-406(f)). How the two routes add up in a budget is in check fraud losses in 2025, and the cost of a wrong hold.

How do banks classify check fraud?

The Federal Reserve's FraudClassifier model gives the two frauds different paths, which is the cleanest way to keep them apart in a case file. An altered check is a case where an "Unauthorized Party Modified Payment Information", by the tactic "Physical Alteration". A counterfeit is a case where an "Unauthorized Party Misused Account Information/Payment Instrument", by the tactic "Physical Forgery/Counterfeit" (FedPayments Improvement, FraudClassifier model). The model is voluntary, but it is designed to classify fraud "independently of payment type, payment channel or other payment characteristics", which makes check cases comparable with others.

For suspicious activity reports, both kinds go under the check fraud box, SAR field 34(d), and FinCEN asks for the key term "FIN-2023-MAILTHEFT" when the check was stolen from the mail. In the sample credit union's hold codes the distinction is built in: HR-02 is an alteration found on the item, HR-03 counterfeit stock or an issuer mismatch, and HR-01 an item already presented and paid.

Classify first, decide second

The label comes before the decision because it changes the decision. An altered check from a long-standing member may be a theft the member suffered, with the original payee to find; a counterfeit deposited by a three-week-old member may be a scam the member fell for. The hold, the call, the notice, the claim and the referral all differ.

The sample's $4,850 case shows the order paying off. Because the agents labelled the item a counterfeit and a duplicate of a paid check, the analyst's next step was a call to the paying bank, at a number from the bank directory, which confirmed the genuine check had been paid on October 13. The analyst confirmed the counterfeit at 1:34 PM, the supervisor co-signed the reversal at 1:41 PM, and the loss was $0. The duplicate side of the same case is the subject of what is duplicate presentment; to follow the case from the first image, start from Check Fraud Detection.

Confirmed cases keep the label: counterfeit, washed, altered

Questions people ask

Is a counterfeit check the same as a forged check?

Not quite. A counterfeit is a fake instrument made to imitate a real one; a forged check is a genuine instrument with an unauthorized signature, such as stolen blank stock signed in the account holder's name. In loss terms the UCC treats both as an unauthorized drawer's signature, so both usually stay with the paying bank unless the presenter knew.

How long does a customer have to report an altered check?

Under UCC 4-406, a customer must examine statements with reasonable promptness, and one who does not discover and report an alteration within one year after the statement or items are made available is precluded from asserting it against the bank, whatever the care on either side. For later items altered by the same wrongdoer, the customer can be precluded much sooner, after a reasonable period of no more than 30 days to examine the statement.

Can an altered check still be paid for its original amount?

Yes. UCC 4-401(d) lets a paying bank that pays in good faith charge its customer's account according to the original terms of an altered item, and UCC 3-407(c) lets a good-faith payor enforce the instrument as originally written. A $380 check raised to $3,880 can be charged as $380; the remaining $3,500 is the loss to allocate.

Is check washing alteration or counterfeiting?

Washing is alteration: the criminal removes the ink from a genuine check and writes a new payee and often a new amount, keeping the drawer's real signature. FinCEN notes that washed checks may also be copied and printed, at which point the copies are counterfeits made from an altered original.

Do counterfeit checks have real account numbers?

Often, yes. FinCEN describes criminals using stolen checks as a template to print counterfeits with the victim's banking information, which is why a counterfeit can pass a routing and account check. The tell is usually elsewhere: different stock, missing security features, or a serial the account has already paid.