This story was from a little while back but what's to stop you just printing a cheque from someone else and paying it into a bank today? There's no alerting to the originator that a cheque's been paid out and there are no obvious authentication tokens on the cheques.
Frank Abignale only had to get past an initial look-test so what techniques protect against (and are consistently used) to prevent cheque forgery today?
As far as I know, there are just 2 things preventing fraudulent checks:
1. Obscurity : Someone has to know your account number and routing code.
2. ...
Ah, make that just one thing preventing fraudulent checks. It's scary. Any legitimate check, for any amount contains enough information to create a fraudulent check to drain a bank account.
This is why Knuth has stopped writing cheques, incidentally:
"Nowadays almost everybody knows that it's dangerous to reveal your credit card number, or to have that full number on a printed document that somebody might find in the trash. Soon people will learn that it is equally dangerous to reveal the numbers that are printed in plain sight on every check. Forget signatures; banks have no time to verify them. The once venerable system of checking accounts is irretrievably broken. Before long, companies will find it impossible to give out paychecks without exposing themselves to unacceptable risk.
One consequence of this debacle is, alas, that I can no longer write checks to reward the people who discover errors in my books. The system that I've been using has worked well for almost forty years; but recently I have had to close three checking accounts, and the criminal attacks on those accounts have caused significant grief to my bankers. (Certainly I do not believe that anybody who received one of my checks has been in any way a culprit. But all such recipients are entitled to bragging rights; therefore the numbers printed on those checks inevitably become known to random members of the public.) I cannot in good conscience continue to traumatize the people at my bank, who obviously have plenty of other things to worry about."
A friend of mine had $3m stolen by his business partner who simply wrote out $500k cheques and took them to the bank. The bank oked the cheques despite knowing that he had no signing authority.
Once it all came to light, the bank then sued my friend and drove him into bankruptcy.
Manuel went on to inform me of things that further amazed and intrigued me:
* According to Commercial Paper Law the money was now legally mine, because all checks are first assumed to be valid -- and the way a bank invalidates a check is by serving the depositor with a timely notice of dishonor. Considering that it took my bank 33 days to tell me my check had been returned, he did not think they had dishonored the check in time.
* Fraudulent checks ARE a different manner. But he said, "Since you deposited the check 'thinking there was no chance it would cash, and without even endorsing it' -- you didn't commit fraud."
* Getting the cashier's check was also not an act of fraud, since the bank had previously assured me the check could no longer be returned.
* There are two practices of law as seen through the eyes of a court: (1) Black Letter of Law, where the court rules strictly by the law (and I would be awarded the money) and (2) Chancery Courts, also known as Courts of Compassion, where the court disregards the law when it is deemed non-sensical. He said that, "Easily a court could disregard the law and give the money back to the bank because really you have no claim to this money from an equitable sense of the law." And then he added, "And when it's an individual vs. a Bank, I'm sorry to say that courts usually side with the bank."
> But he said, "Since you deposited the check
> 'thinking there was no chance it would cash,
> and without even endorsing it' -- you didn't
> commit fraud."
But he did deposit the check with the thought that it would cash. He wouldn't have done it otherwise, since it wouldn't have been funny.
No, he said that he thought there was no chance it would clear. He said that he imagined the phone call from the bank to tell him that the cheque was nonsense.
I don't know if that's enough to avoid fraud.
In England he'd have to pay back the cash, and any interest earned on the cash, and he'd have to have good lawyers to get off any criminal charges. I think; IANAL etc.
Check gets deposited in ABC bank (issued by XYZ bank). ABC bank sends a scan of the check to XYZ bank. And XYZ bank has an employee whose job it is to look at every inbound check to make sure the signature matches? Or maybe they have computers to recognize the signature and compare them for similarities. If it's too different, then it's flagged and sent to an employee for further review?
I suppose it's possible that this happens. I honestly have no idea. Next time you write a check, sign it "Snoopy" and see if it still clears. My guess is that it would.
> Or maybe they have computers to recognize the signature and compare them for similarities. If it's too different, then it's flagged and sent to an employee for further review?
Yeah, that'd be nice, and I think it's well within the grasp of the big banks to deploy some image recognition software to do this, and yet I'm fairly certain they do not. Anecdata to follow...
I recently had a blank check stolen from me and filled out with a completely fake looking signature, it was really almost cartoonish. Yet the bank (Chase) did nothing to stop this from being deposited by the thief, and debiting my account. I only found out a month or so later, and filed a dispute, which they resolved. But the only reason I noticed it was that I don't use checks very often, so even though the amount was not an outrageous sum, it stood out. The bank's suggestion to me, for the future, was to NOT USE CHECKS. Ever. The low level employees at the local branch, when I was there closing the account and opening a new one, told me NOT to order checks at all, and pay rent with a direct transfer or bill-pay feature.
This is what people mean when they say the only innovation in consumer level banking is improvements to ATMs.
The thing with doing that it it requires the person signing the check to have a /single/ extremely consistent signature. Personally my signature changes a lot depending on the pen I'm using or even how quickly I go. And I doubt I'm the only one.
Fair enough I suppose, and I'd add the rest of online banking is a big improvement too.
The fact that checks are not anywhere near as secure as I would want (or apparently the bank's own tellers would want) just irks me, since they're much more convenient than bill-pay, which takes 5 business days to process while handing a check to my landlord takes less than 1.
I used to sign checks as Nickname Lastname, rather than my given name. I eventually had one bounce due to "signature not as drawn". I do have very legible handwriting though.
They definitely don't check the signature. About a year ago, I altered the way I sign cheques. I used to sign my full name, now I just initials them. I got not problem, no cheque bounced.
Only you can define what your signature looks like. That is why you didn't have any issues. They don't check the signature against anything, if that's what you mean. See this comment: http://news.ycombinator.com/item?id=4345214
A few years ago, I was going through the process of changing my name. I was endorsing checks with my new name and depositing them into accounts with my old name -- a completely different name, and still no problems! I imagine this happens fairly often with newly-wed women.
Also, the signature on my current driver's license is a squiggly line.
> Only you can define what your signature looks like. That is why you didn't have any issues. They don't check the signature against anything, if that's what you mean. See this comment: http://news.ycombinator.com/item?id=4345214
This may be mostly true, or even universally true now, but it hasn't always been. I remember trying to make some major modification on an account with a local bank in Chicago around 2000 --maybe closing it?-- and the bank officer with whom I dealt actually brought out a physical record of my signature to compare against what I was currently signing. (Since I'd opened the account some years ago, it took me a long time to guess how I'd signed back then and to reproduce it successfully. For some reason, the officer was perfectly willing to let me try until I satisfied her, but not to accept that I was who my ID said I was.)
Same thing with credit cards. Most vendors don't event check if you signature matches the signature that is on the back of the card. (not that it proves ownership.)
I deposited a check at an ATM recently and it was rejected (by the ATM itself) because it was not endorsed. It wasn't and I seriously doubt this is anything more than a check for some ink on the back in the endorse-here area.
The ATM then tried to return the check to me, but there was some kind of paper feed error and I never saw it again.
It's too bad there isn't some sort of reconfigurable QR code stamp thing that you can use to sign something. Say, for example, you enter in the payee, amount and date, it digitally signs it with your private key from your bank, creates a QR code with the data and moves tiny little stamp pins up/down and you press it onto the paper.
Other than a bank or cheque cashing service, anyway...
The niche seems pretty small: payments too large for cash, too small for certified bank drafts, to people taking too few payments to have technologying up make sense.
I believe that in the original write-up of this story, which spanned several pages, the author mentioned that he didn't even bother to endorse the check he'd deposited.
For business checking accounts, many banks offer a "positive pay" service, where customers submit files with the dates, check numbers, and amounts of authorized checks they have issued, and only those checks are paid automatically; checks not listed in a file are automatically returned unpaid.
Variations on this service give the customer access to a Web site with a daily exceptions report, or to a list of all checks for amounts greater than some threshold, from which the customer can instruct the bank to pay some checks and return others. The default is usually to return the check unpaid, since Article 4 of the Uniform Commercial Code gives banks a strong incentive to return any item they aren't going to pay before midnight on the next banking day after it was received.
These services used to be fairly expensive, but I see that some banks are now offering them for free or for a modest fee ($40 a month at Chase), perhaps because they shift some responsibility for fraud control to the customer.
I think the main thing is vigilance on the part of the supposed check writer. If you notice a check drawn on your account that you didn't write, you call your bank and get it reversed. Then they go after the depositor for fraud. It's nowhere near 100% reliable, of course, but the mere threat of prosecution helps keep it down. Keep an eye on your accounts....
Sadly if you want to see a forged Cashier's check you need only try to sell a car on Ebay. There is a scam, that works like this:
1) You advertise an item of value X
2) Person 'buys' it. Sends you a cashiers check.
3) "whoops, they typoed the number and the cashiers check is for $1000 more than your car (or boat or whatever)" Go head and deposit it, take out the $1000 'extra' and send it back to me.
The check is forged, the fraud depends on banks giving legitimate customers access to 'some' of the funds right away and holding the rest until the check clears. The victim gives away the $1000, and their property, the crook rides off, and 3 days later the check bounces.
That's the thing, I'm pretty sure check clearinghouses are near real-time these days. At least in the US. Deposit the check and within a few minutes it'll either clear from the other bank or bounce.
Nope, it's still a batch process. Usually the day's batch is collected and sent to the Fed, and then the bank gets their net debit/credit for all their transactions. It'll generally show in accounts the next morning. (Note that there are many details here about exactly which method is used and if there's a third party exchange).
Checks can come back anywhere from nearly instantly (e.x if there's a bad routing number) to a day or two (insufficient funds, or bad accounts, or unauthorized on a commercial account) to a month or two (unauthorized on a personal account) to many months (fraud, US treasury checks). The last can be a real killer, since they're normally big checks on trustworthy accounts (though, not necessarily from trustworthy intermediates).
Checks are never really cleared, they just haven't bounced yet.
Unless it's a large check, in which case it's normal practice for a bank to put a hold on all but a small portion of the funds for several days. The exception is for deposits which occur regularly from the same source, like payroll.
Frank Abignale only had to get past an initial look-test so what techniques protect against (and are consistently used) to prevent cheque forgery today?