Bust out fraud works in two acts. First the account is made to look trustworthy: in credit, by paying small balances on time; in a checking account, by a few small deposits and little else. Then, in a day or two, it takes as much as it can and disappears: on a credit card by maxing out the line, on a checking account by depositing large checks that will bounce and withdrawing against them before they do. The loss is decided by a race between two clocks, the day the bank makes the deposited funds available and the day the bad check comes back. Botminds' New Account Fraud Detection reads a young account's whole life as one line so that the restriction lands while the money is still pending, not after it has gone.
The worked example uses the solution's sample data: Tessaly Community Bank, its partners and customers are fictional, and the dollar paths marked as illustrative are our arithmetic on that sample.
A deposit bust-out: nineteen quiet days, then four days that decide the loss
- Seasoning: $25, $40, $35 inDays 0–19
- Check in, not collectedThu–Mon
- Withdraw before the returnMon
- Four accounts opened, a fifth taken overOct 15–21
- Four Halbrook checks pendingto Mon
- The cash-out dayMon
What is bust out fraud in banking?
It is fraud that builds trust on an account and then cashes it in all at once, leaving a loss and nobody to collect from. FinCEN describes the classic credit version as "bust out schemes (where attackers open credit card accounts with false information and then max out the cards)" (FinCEN, Identity-Related Suspicious Activity: 2021 Threats and Trends). Federal Reserve material on synthetic identities tells the same story: "synthetic identities were used to build up credit lines, max out the credit line, and then “bust out,” or disappear without paying" (Federal Reserve, The Danger of Synthetic Money Mules).
The deposit version is less discussed and faster. There is no credit line to build, so the trust that matters is the bank's willingness to let money out before a deposit has been collected. The Federal Reserve's post-loss toolkit names its mechanism among the ways an account is overdrawn: "Through a check that was deposited, funds withdrawn and then check was returned" (Federal Reserve, Identifying Existing Synthetics Post-Loss). The credit bust-out is the subject of synthetic identity fraud detection in lending; this page is about the checking account.
How does bust out fraud work in a checking account?
In four moves. Open the account, ideally where nobody sees the applicant: online, or in a partner's app. Season it with a few small credits so it does not look empty. Deposit the bad items, usually checks that are counterfeit, altered or drawn on a closed account, often by mobile so no teller sees them. Then withdraw or transfer out as soon as anything is available, before the paying bank returns the checks. FinCEN's alert on mail-theft check fraud lists the pattern as a red flag: "New customer opens an account that is seemingly used only for the deposit of checks followed by frequent withdrawals and transfer of funds" (FinCEN Alert FIN-2023-Alert003).
The sample account follows the script exactly. Jordan Kell's account at Tessaly was opened in a fintech partner's app on October 3, received $25, $40 and $35 over its first nine days, changed devices on day 12 and address to a private mailbox on day 14, and on day 19 received a $6,200 mobile check from a roofing company the stated warehouse associate had no reason to be paid by. A $3,000 transfer out was tried 17 minutes later and held by the bank's fraud engine. Four other accounts had been opened on the same device between October 15 and 20, and three of them received checks from the same Halbrook check book; the four checks were deposited by mobile within 36 hours.
The check behind the dot: same stock as three others this week
How long does a bust out take?
Weeks to prepare, a day or two to execute. No regulator publishes a typical duration for deposit bust-outs, and any figure offered as an industry average deserves a source. What the mechanics fix is the end of it: the cash-out has to happen after the funds become available and before the check comes back, and Regulation CC sets both dates. Seasoning can last as long as the fraudster's patience; in the sample the setup took 19 days and the four other accounts in the ring were only two to seven days old when their checks arrived.
That asymmetry is the reason bust-outs are found late. Nineteen days of a $100 balance trigger nothing in a rules engine built on amounts, and the four days that matter are all the bank gets. A program that reviews new accounts once, at opening, sees the seasoning and nothing else.
Why the loss arrives in the last 48 hours
Because two federal clocks can cross. For an established account, a local check must be made available by the second business day after the banking day of deposit (12 CFR 229.12(b)). A paying bank that refuses a check must send it back fast enough that it would normally reach the depositary bank by 2 p.m., the depositary bank's local time, on the second business day after the banking day it was presented (12 CFR 229.31(b)). Presentment comes after deposit, so on the second business day the funds can be available in the morning and the return can still be on its way. That gap, often a few hours, is the cash-out.
Everything before it costs the bank almost nothing; everything after it costs the full amount. A restriction on Thursday, the day the checks land, holds all of it. A restriction on Friday still holds it, if the bank has not released anything. A restriction on Monday afternoon may arrive after the money has left. The cost of delay is not a slope but a cliff, and the cliff is the availability date the bank itself sets.
"A significant amount of check fraud begins at the new accounts desk."
Check Fraud: A Guide to Avoiding Losses, OCC and the interagency Check Fraud Working Group, 1999
What Regulation CC lets a bank hold on a new account
More than on any other account. For the first 30 calendar days, Regulation CC loosens the schedule in three ways. Cash, electronic payments and certain low-risk checks still follow next-day rules, but for those checks only "with respect to the first $6,725 of funds deposited on any one banking day", the excess available "not later than the ninth business day". And an ordinary check, such as a business check drawn on another bank, "Is not subject to the availability requirements" of the next-day rules for on-us checks and the first $275, or of the local check schedule (12 CFR 229.13(a)(1)). The thresholds were raised to $6,725 for deposits from July 1, 2025 (Federal Register, May 20, 2024).
What a bank must make available on a new account, and what it may hold
| Deposit on a new account | Established account | First 30 days of a new account |
|---|---|---|
| Cash, wires, ACH credits | Next business day | Next business day |
| Treasury, postal money order, Federal Reserve, government, cashier’s, certified and teller’s checks | Next business day, under conditions | Next day only for the first $6,725 a banking day; the rest by the ninth business day |
| A check drawn on the same bank (on-us) | Next business day, under conditions | No requirement |
| The first $275 of other check deposits | Next business day | No requirement |
| A local business or personal check drawn on another bank | Second business day | No maximum set by Regulation CC; the bank’s disclosed new-account policy governs |
The practical point is that the cliff is movable on new accounts and fixed on old ones. On an established account the bank is bound to the second business day unless it can show "reasonable cause to doubt collectibility" or another exception. On a new account it may decide, deposit by deposit, to wait for the check to clear, which is exactly what the sample analyst did: the four Halbrook checks were held under the new-account exception and the solution drafted a hold notice for each customer. A bank that applies a generous established-account schedule to every new account, for good customer reasons, has chosen to put the cliff two business days after deposit for fraudsters too.
What each day of delay costs: a worked example on one ring
Take the sample ring as the clock runs. On Thursday the four Halbrook checks, $19,355 in all, were pending, and $5,400 in transfers out had been tried and held. The analyst restricted all five accounts that morning and a second person approved it; nothing left. Had the restriction waited, what was lost would have depended entirely on when the bank released the funds and when each paying-bank return arrived.
The same ring, restricted on different days: what is still in the bank’s hands
Across a month the pattern scales. The sample bank's results screen estimates $412,600 in deposits held before release on the 64 accounts it restricted or closed in October, with the median account restricted on day 17 of its life. That figure is the agents' estimate on sample data, not a measured loss avoided, but it shows where the value of new account fraud detection sits: in the deposits still pending at the moment of decision. The labour sits elsewhere. The solution's own estimate is that an analyst spends about 40 minutes by hand rebuilding one flagged account, against a 10-minute design target with the agents, and a team that takes 40 minutes per account reaches fewer accounts before Monday.
Is bust out fraud first party fraud?
Sometimes. When the person who opened the account is real and takes the money themselves, it is first-party fraud: in the Federal Reserve's FraudClassifier model it falls under "Authorized Party Acted Fraudulently" (FedPayments Improvement, FraudClassifier). When the account was opened in a stolen identity, or on a synthetic one, the account holder named on it is a victim or does not exist, and the case is third-party or synthetic identity fraud. When a real person was paid to lend their account to a ring, it is a mule. The money moves the same way in all four; the response differs, because a stolen-identity victim must be protected, a mule may be a victim too, and a first-party fraudster can be pursued.
Bust-out, kiting and the mule account: the same deposit, three different frauds
Bust-out on a new account: Seasoning, then bad checks deposited and withdrawn against before they return.
Check kiting: Checks written between accounts at two or more banks to create balances that do not exist, kept alive by the float.
Bust-out on a new account: Once: the account is emptied and abandoned.
Check kiting: When the cycle breaks, often after weeks or months.
Bust-out on a new account: A quiet young account, then a burst.
Check kiting: Frequent deposits and withdrawals of similar amounts, rising over time, between the same accounts.
Bust-out on a new account: A rented account can be the one that busts out; the money then moves on to others.
Check kiting: Rarely; kiting needs control of every account in the circle.
What is the difference between bust out and check kiting?
A bust-out ends once; a kite keeps going. In kiting, FinCEN explains, attackers "exploit check settlement times between financial institutions by accessing funds before financial institutions process the checks and discover insufficient funds" (FinCEN, 2024). The kiter needs the circle to keep turning, so the accounts stay active and the amounts grow. A bust-out needs only one window, so the account is abandoned after it. The Federal Reserve's risk officer survey tracks both among check fraud events, defining kiting as "Timing check deposits to get the cash before it bounces" and new-account fraud as "Opening new account with a fraudulent check" (Federal Reserve Financial Services, 2026). In the sample bank, kiting accounted for 4 of the 64 restrictions in October, bust-outs for 19.
How do banks stop bust out fraud?
By acting in the window before funds become available, which means three things in practice. First, read the account as a whole, not the deposit alone: a $6,200 check means little until it is set beside a file that says warehouse wages, a device change and a mailbox. Second, look sideways: a ring of bust-outs shares devices, addresses and check stock, and the fourth account found is cheaper than the first. Third, decide fast and with a reason, using the new-account exception where it applies and a second person to check the restriction.
That is the sequence the solution follows. The behavior agent names the shape, "A bust-out in setup", the link agent finds the other four accounts, the action agent proposes the restriction with its hold basis, and the analyst and a checker decide. The full trace of that sample account shows each step; the red flags by window show where bust-outs sit among the other shapes. To see the line on your own new accounts, start from New Account Fraud Detection.
The restriction lands while the checks are still pending
Questions people ask
What are the signs of bust out fraud?
On a checking account: an account that does little after opening, a recent change of device, phone or address, then a large check that does not fit the opening file, followed quickly by attempts to withdraw or transfer out. On a credit account, rapid credit-limit growth followed by maxing out the line. Links to other new accounts by device, address or check stock make the pattern much stronger.
How much is lost in a bust out?
No government or academic source publishes a typical loss for deposit bust-outs. The ceiling is set by what the bank releases before the bad items come back: on a new account Regulation CC lets the bank decide how much of an ordinary check to make available, so a bank's own new-account policy largely sets its exposure.
Can bust out fraud happen with checking accounts?
Yes. The deposit version uses bad checks instead of a credit line: deposit, withdraw against the uncollected funds, abandon the account when the checks are returned. The Federal Reserve's synthetic identity toolkit lists exactly that sequence among the ways a deposit account is overdrawn.
Can a bank refuse to release funds from a check it suspects?
On a new account, within the limits of 12 CFR 229.13(a) and its own disclosed policy, yes. On an established account it needs an exception, such as reasonable cause to doubt collectibility, which must rest on facts about the check and be stated in a written notice to the customer.
Who pays when a bust-out check bounces?
The depositary bank first: it can reverse the credit it gave for the check, but if the money has already been withdrawn the account is overdrawn and the bank holds the loss unless it can recover from the account holder or another party. That is why the restriction day, not the day the fraud is understood, decides the cost.