Check Fraud & Overpayment Scams: 5 Variants and the Wait-for-Funds-to-Clear Rule

Thieves steal mail to extract outgoing checks, chemically "wash" the payee and amount, and rewrite the check to themselves. Per FinCEN's 2023 alert, financial institutions reported $688M in suspicious activity related to this single mechanic in the first six months after the alert. The protective rule: pay bills electronically; if you must mail a check, drop it inside a USPS post office, never in a residential mailbox or blue collection box.

A representative case from FinCEN's 15,417-case analysis: a homeowner mails his $1,800 monthly mortgage payment by dropping a check in his residential mailbox with the flag up. A thief drives the neighborhood, steals the contents of mailboxes with raised flags, and extracts the homeowner's check. Back at the thief's location, the check is dipped in acetone, the payee name and amount are washed off, and the check is rewritten to "John Smith" for $9,800. The thief deposits the altered check at a money-mule account. Two weeks later the homeowner's bank statement shows a $9,800 debit instead of $1,800, and the mortgage company reports the payment as missing. The protective architecture (FBI investigation, USPIS investigation, bank fraud-recovery process) eventually returns most of the funds — but the homeowner's account has been frozen for 30-60 days during investigation, and the mortgage payment has been late.

FinCEN's 2025 analysis of 15,417 check-fraud cases identified the residential-mailbox channel as the highest-risk vector. Blue USPS collection boxes are also routinely targeted, sometimes with thieves using stolen postal-worker keys (USPIS prosecutes these cases as federal crimes). The protective infrastructure: pay bills via ACH, your bank's online bill-pay, or in person. If you must mail a check, drop it inside a USPS post office during operating hours or hand it to a postal employee directly.

What stops it is electronic payment plus mail discipline. Pay bills via ACH or online bill-pay through your bank's website or app. If you must mail a check, drop it inside a USPS post office during operating hours, never in a residential mailbox or a blue collection box. Use security pens (gel or ballpoint, never erasable) for any handwritten checks. Monitor your bank statements weekly. If you notice a washed check, contact your bank's fraud line within 60 days (UCC 4-406 gives consumers a 60-day window to dispute altered items) and file with USPIS at uspis.gov/report.

A buyer pays by check for more than the purchase price and asks you to deposit it and wire back the difference. The check is fake; you wire your own money before the bank confirms clearance; the check bounces 2-4 weeks later and you owe the bank the full amount. Per the FTC's fake-check page, this is one of the longest-running consumer-side check-fraud variants. The protective rule: never accept a check for more than your selling price.

A representative case: a seller lists a guitar for $800 on Facebook Marketplace. A buyer "from out of state" offers to pay by cashier's check and asks the seller to handle shipping. The seller agrees to a $50 shipping cost. A check arrives for $2,800 with a note saying the buyer "accidentally added a zero" and would the seller please deposit the check, ship the guitar, and Zelle the difference of $2,000 back to the buyer's "shipping coordinator"? The seller deposits the check; the bank makes funds available within 2 days. The seller ships the guitar and Zelles $2,000 to the "coordinator." Three weeks later the cashier's check is flagged as counterfeit by the issuing bank; the seller's bank reverses the deposit and claws back $2,800 from the seller's account. The seller has lost the guitar, the $2,000 wired, and now owes the bank $2,800. Total loss: $4,800 plus the guitar.

The protective architecture is straightforward but underappreciated. Banks make funds "available" under Regulation CC within 1-5 business days as a courtesy; this is not the same as the check having cleared. Real cashier's-check clearance can take 2-4 weeks; personal-check clearance can take 30+ days. The deposit appears as money in your account before the check has cleared; the deposit is reversed when the fake check bounces. The "overpayment" framing is the diagnostic — real buyers do not accidentally overpay by hundreds or thousands of dollars.

What stops it is the wait-for-clearance rule plus refusing to ever wire "overpayment" back. Never accept a check for more than your selling price. If a buyer overpays, return the check uncashed and ask for the correct amount via Zelle / Venmo / cash / in-person card-tap. Never deposit and wire the difference, regardless of how plausible the overpayment story sounds. If you have already deposited and wired, contact your bank's fraud line immediately; recovery via wire-recall is possible within 24-48 hours of sending. Report at reportfraud.ftc.gov and the platform where the listing originated.

A "secret shopper" job offer arrives with a check for $2,000-$5,000 and instructions to deposit it, buy $1,500-$4,500 in gift cards or money orders as part of the "evaluation," keep $300-$500 as pay, and report back. The check is fake; the recipient has spent their own money on gift cards before the bounce. Per FTC consumer alerts, this variant has been one of the most consistent fake-check patterns since the early 2010s.

A representative case from FTC consumer-protection records: a recent college graduate looking for remote work receives a Facebook DM offering a "Mystery Shopper Position — $500/assignment, work from home." The recruiter sends a $4,000 check by FedEx with instructions: deposit the check, buy $3,500 in MoneyGram money orders at three different Walmart locations as the "shopping evaluation," report back on the customer-service experience at each store, and keep $500 as the first assignment's pay. The graduate deposits the check; the bank makes funds available in 24 hours. He buys the money orders, photographs them, sends the photos to the recruiter as instructed, and waits for the next assignment. Two weeks later the check is flagged as counterfeit; the bank reverses the $4,000 deposit and his account goes to -$2,800. He has lost $3,500 in money orders (cashed by the scammer immediately upon receiving the photos) plus the $4,000 the bank clawed back.

The variant exploits a real industry. Legitimate mystery-shopping firms do exist (the Mystery Shopping Professionals Association at mspa-na.org maintains a directory of vetted firms), but they do not send pre-work checks, do not require shoppers to buy gift cards or money orders, and typically pay $5-$25 per assignment via direct deposit after the work is performed. Per the FTC's fake-check guidance, any "mystery shopper" arrangement that requires the shopper to deposit a check and use the funds to buy gift cards is fraud.

What stops it is the no-pre-work-check rule. Real employers do not send checks before work is performed. Real mystery-shopping firms pay after the assignment is complete, in small amounts ($5-$25), via direct deposit. Verify any mystery-shopping opportunity through MSPA-NA's official directory before responding. If you have already deposited a fake check, contact your bank immediately, the FTC at reportfraud.ftc.gov, and your state attorney general.

A new "employer" sends a fake cashier's check before the new hire's first day with instructions to use most of it to buy specific equipment from a "vendor" (the scammer in disguise) and keep a small amount as a signing bonus. The check bounces; the new hire has wired or Zelle'd from their own funds. Variant overlaps with our fake-job-offers guide.

A representative case: a job-seeker accepts a "remote customer-service position" with a company that resembles a real organization. The HR contact sends a $3,500 check via FedEx with instructions: deposit the check, use $2,800 to buy a "company-issued laptop" from the company's preferred vendor (Zelle to specified email address), keep $700 as a signing bonus, and the laptop will arrive in 5-7 business days. The job-seeker deposits the check, Zelles $2,800, and waits for the laptop that never arrives. The check bounces 2 weeks later. The HR contact stops responding. The "company" turns out to have no record of the hire — the entire job offer was fabricated to deliver this check-and-Zelle script.

Real employers do not send pre-employment checks. Real equipment is shipped directly to the new hire by the employer's IT department, paid for by corporate purchase order; the employee never handles the equipment-purchase money. Real signing bonuses are paid through normal payroll (W-2 income, taxes withheld) on a regular pay schedule, never via cashier's check before the start date. Variant overlaps significantly with our fake-job-offers guide.

What stops it is the no-pre-employment-check rule. Real employers ship equipment directly via IT, paid through corporate purchase orders. Real signing bonuses come through payroll. Any pre-employment check that asks the recipient to use the funds to purchase equipment is fraud. Verify any new "employer" through the company's official career page (typed URL, not via the recruiter's link), the BBB, and LinkedIn (looking for actual employees, not just the recruiter). Report at FTC ReportFraud, the company being impersonated (their security or HR team), and IC3 for losses over $1,000.

A "lottery / sweepstakes" win notification arrives with a small advance check of $2,000-$10,000 to cover "taxes" or "processing fees." The recipient is told to deposit the check and wire $1,500-$8,000 to the "tax processor" before the full $50,000-$500,000 prize can be released. The advance check is fake. Real lotteries do not require winners to pay taxes or fees in advance, and you cannot win a lottery you did not enter. Variant overlaps with our lottery-and-sweepstakes guide.

A representative case from FTC and AARP elder-fraud advisories: a 72-year-old retiree receives a letter saying she has won a $250,000 sweepstakes prize. A $5,000 cashier's check is included to cover the IRS "withholding tax" she will owe. The instructions: deposit the $5,000 check, then wire $4,200 to the "sweepstakes tax processor" via Western Union to clear the tax obligation, and the full $250,000 will arrive within 14 days. She deposits the check, wires the $4,200. Two weeks later the cashier's check bounces; the bank reverses the $5,000 deposit. The $250,000 prize never arrives. The "sweepstakes" never existed; the entire structure was a vehicle for the $4,200 wire.

The variant disproportionately targets older adults, often through mailed letters with official-looking branding. The protective architecture is unambiguous: real lotteries do not require winners to pay taxes or fees in advance, and you cannot win a lottery you did not enter. Real lotteries deduct withholding taxes from the prize before disbursement, not in advance from the winner's own funds. Variant overlaps with our lottery-and-sweepstakes guide and our advance-fee guide.

What stops it is the no-prizes-without-entry rule plus the no-advance-fees rule. If you didn't enter, you didn't win. Real lotteries deduct taxes from the prize, never collect them in advance from the winner. Any sweepstakes that requires an advance payment is fraud. If you have already wired funds, contact your bank immediately and file at reportfraud.ftc.gov, USPIS for the mailed letter, and your state attorney general.