Check use has been in steady decline as consumers move towards faster, digital payment methods. Yet despite this, 30% of fraud losses in 2024 were due to check fraud. In fact, check payments are 31 times more likely to involve fraud than real-time transactions
according to research from PYMNTS Intelligence and The Clearing House. Why has check fraud resurged?
Economic anxiety triggered check-based schemes. When millions of Americans received COVID relief payments by mail, checks became associated with financial relief. And for certain individuals facing economic pressure, creating fraudulent checks became easier to rationalize as a solution. Even as employment recovered, inflation, cost of living, and general financial anxiety have kept economic stress front of mind.
Social media gives fraudsters what they need to know. When people share details like their birthday, employer, location, and family connections, they unknowingly provide sensitive information that helps criminals circumvent existing fraud detection solutions. But social media is just the starting point. The dark web has created a marketplace where personal data becomes currency. In 2024 alone, 1.9 million stolen U.S. bank checks appeared on underground platforms. With stolen bank information and a few check images, fraudsters can quickly generate convincing counterfeit checks using GenAI tools, a standard home printer, and deposit them through channels like mobile remote deposit capture (mRDC). The same approach can be used to alter checks. By uploading an image of a stolen check, GenAI tools can be used to easily modify the payee, the amount, or other key details.
Checks are still used at large in B2B. Despite the ability to make digital payments, checks are still deeply embedded in B2B business operations. Why? Businesses cite them as familiar, easy to trace, and fast to reconcile. In 2024, 33% of B2B payments in the US were made by check. While this is lower than it has been the past, it still represents millions of dollars moving through paper checks each year. How has AI improved check fraud detection so far?Teaching machines with image analysis Image forensics systems use computer vision AI models to look at the visual elements of a check image. Rather than relying on human reviewers to spot inconsistencies, AI models analyze dozens of data points in real time or batch, comparing what they see against known “good” check profiles. Image analysis systems often have different AI working in tandem. Here’s an example:
- YOLO (You Only Look Once), an AI architecture for real-time object detection that identifies the precise location and dimensions of check elements across varying formats
- Convolutional Neural Networks (CNNs), a deep learning model that analyzes handwriting, fonts, and signatures by creating vectors that calculate distances between elements to determine whether they match expected patterns
These AI models compare handwriting and printed text font against what’s expected for that customer. It evaluates payee handwriting style, legal amount handwriting style, legal amount printed text style and font, and payee name printed text style and font. Statistical models complement this work by analyzing geometric and positional elements. Layout positioning, field alignment, and image consistency checks use statistical methods like normalized Mean Square Error to detect alterations. Simply put, AI models excel at recognizing complex patterns that vary naturally (like handwriting) while statistical models efficiently catch geometric anomalies and structural inconsistencies. Both are essential for robust check fraud detection. Breaking data silos with consortium data Shared fraud intelligence is pooled data from multiple financial institutions, aggregated in a secure and privacy-compliant way. Participating institutions form a consortium and have visibility across the wider financial ecosystem. When a fraud attempt takes place at one member institution, all members are alerted. So how is that data shared? Well, data points from billions of transactions across mobile, ATM, branch, and remote deposit capture are analyzed by financial institutions. Once investigated and deemed fraudulent, the fraudulent check data is aggregated. This shared data trains machine learning models that continuously improve at assigning risk scores to transactions and determining which ones are likely fraudulent If a counterfeit check is identified at one institution and later presented at another, the second institution has the intelligence needed to block that specific item. This check fraud detection feedback loop powered by consortium data prevents fraudsters from simply moving to the next target after being caught. Connecting the dots across payment channels Some fraud detection systems analyze checks in isolation from other payment activity. A check gets deposited, the system evaluates it against check-specific rules, and it approves or flags the item based solely on that transaction. But fraudsters don’t operate in single channels. AI-powered cross-channel analysis links activity across all payment types: checks, ACH, wire transfers, and card transactions. The system builds a complete view of account behavior and identifies suspicious patterns that remain invisible when each channel is viewed alone. For example, a fraudster deposits a counterfeit check through mobile RDC, then immediately initiates multiple ACH and wire transfers to move funds before the check is identified as fraudulent. In a siloed system, the check may pass initial screening, and the transfers may appear normal on their own. Cross-channel analysis flags the coordinated pattern: a deposit followed by rapid, unusual fund movement. Cross-channel analysis uses several machine learning models working together: anomaly detection, false-positive reduction, and typology-specific models that target known fraud behaviors. Traditional rule-based systems ask,
“Does this exceed a threshold?” Anomaly detection asks a different question:
“Is this behavior unusual for this specific customer or their peer group?” The model establishes behavioral baselines for every customer. But cross-channel analysis generates alerts… lots of them. Without intelligent filtering, fraud teams would quickly become overwhelmed. False-positive reduction models prevent this. They learn from past case decisions, whether analysts confirmed fraud or marked alerts as false positives, and analyze the context behind those outcomes. The AI then applies those learnings to future cases. Learning unique behavioural patterns with biometrics Transaction data tells you what happened: a check was deposited, funds were transferred, a withdrawal occurred. Behavioral biometrics indicate whether the person interacting with their mobile behaves like the legitimate account holder, for mobile deposits. Biometric technology uses AI to analyze how users interact with a device to prevent fraud by identifying anomalies in patterns like typing speed, mouse movements, and navigation habits. These behavioral patterns are remarkably consistent for legitimate users and noticeably different for fraudsters, even when fraudsters have valid credentials. Here’s what behavioral biometrics detects:
- Typing patterns: How fast someone types, the intervals between keystrokes, common typos, and rhythm patterns are unique to individuals.
- Mouse movements and navigation: Legitimate account holders navigate banking interfaces in consistent ways, where they click, how they move the mouse, which features they use regularly. Fraudsters, even with stolen credentials, navigate differently.
- Session behavior: How long sessions last, what time of day access occurs, which devices are used, and what actions happen during sessions all create behavioral profiles.
- Device intelligence: Tracks the devices and locations used to access accounts. When fraudsters use their own devices to deposit fraudulent checks into compromised accounts, device intelligence flags the mismatch.
Behavioral biometrics detects suspicious activity that's otherwise invisible to banks when looking at transaction data only. This real-time detection allows institutions to intervene before checks clear. Instead of discovering a fraudulent check deposit after funds have been moved, behavioral biometrics can trigger additional authentication or check review during the deposit attempt.Where is AI heading for better check fraud detection? Self-service model development Today, when a financial institution needs a fraud detection model tailored to their specific customer base, transaction patterns, or regional fraud trends, they typically engage an anti-financial crime vendor’s data science team which requires significant expertise and time. Development cycles, testing phases, and deployment can stretch across months. We envision a different approach: a self-service model development environment that allows institutions to train and deploy their own models with minimal technical friction. A fraud analyst, operations leader or in-house data scientist could:
- Define the fraud patterns they want to detect based on trends they're seeing
- Select which data sources and features the model should analyze
- Train a model on their institution's historical data
- Test the model's performance against known fraud cases
- Monitor its performance and iterate as fraud patterns evolve
Detecting insider fraud Current check fraud detection focuses almost entirely on external threats. But fraud has also been found to originate inside financial institutions. Employees with system access, knowledge of internal controls, and understanding of detection thresholds can exploit their positions in ways external fraudsters can’t. A teller with access to customer accounts, a clerk who processes check deposits, an accountant with authority to override fraud flags, each represents a potential vulnerability. Future systems could continuously monitor for patterns that indicate insider involvement in check fraud:
- Anomalous approval patterns: AI models could analyze which employees approve or override fraud alerts, looking for statistical anomalies.
- Access pattern analysis: The system could track which employees' access which accounts and when, identifying unusual patterns. By learning baseline access behaviors and comparing them in real-time, AI could flag situations where employees interact with accounts atypically, quicker and more accurately than manual or simple statistical models.
- Transaction timing correlations: When fraudulent checks are later discovered, the system could analyze the timing of employee actions around those transactions. Again, by automatically mapping these linkages, AI could substantially increase precision in insider fraud investigations and enable timely intervention.
This requires lots of care around bias, fairness, and employee privacy. Systems must have extremely high precision and be explainable to justify investigations. The technology path exists. The harder questions are around policy, governance, and how institutions balance fraud prevention against employee rights and workplace culture. True predictive fraud risk scoring Today's "predictive" fraud scoring isn't always quite predictive. It’s often reactive analysis presented in real-time. The system evaluates a check against the customer's historical behavior, current fraud patterns, and consortium intelligence, then assigns a risk score. That's powerful, but it's an assessment of present risk based on past data. True predictive scoring might assign fraud risk scores to checks before suspicious activity occurs, based on leading indicators that signal increased fraud likelihood. What true prediction might include:
- Customer life event signals: Change in address, sudden increases in account activity, or changes in typical transaction patterns could indicate increased vulnerability to fraud (account takeover) or increased likelihood of committing fraud (financial stress).
- Seasonal and economic pattern analysis: Fraud rates often correlate with economic conditions. A model that incorporates unemployment rates, inflation data, regional economic stress indicators, and seasonal fraud trends could adjust individual customer risk scores based on these contextual factors.
Again, this would require lots of care around bias and fairness. How does Hawk strengthen check fraud defenses? At Hawk, we partnered with Mitek to deliver check fraud prevention by combining Mitek’s best-in-class AI image forensics and consortium intelligence with our flexible, AI-powered precision and self-serve rule management. By applying AI anomaly detection and advanced image forensics, we equip financial institutions with the technology to identify subtle manipulations and behavioural patterns that the human eye can’t detect. AI-driven image forensics Our fraud solution uses optical character recognition (OCR), statistical models and AI computer vision models to analyse
24 key check attributes and detect subtle manipulations that manual review would miss. This is far more than generic image analysis. Mitek, the pioneers of mobile check deposit technology, has spent years refining its models using consortium image intelligence, giving its fraud detection exceptional accuracy. The consortium data advantage Mitek powers the market’s only image-based consortium for check analysis. When institutions share data, hidden fraud patterns quickly surface, like a ring reusing the same check template across different banks. Every new contributor strengthens the network: more images mean more patterns, better-trained models, and stronger fraud detection that helps your institution spot what others overlook. AI models trained on your data Generic AI models optimize for the median use case, which means they're suboptimal for everyone. Hawk's AI learns from your specific transaction patterns, customer behaviors, and fraud team decisions. The result: Detection that's calibrated to your institution's unique risk profile, customer base, and operational constraints.
Learn more about how Hawk is helping financial institutions strengthen their fraud prevention here.
