Check fraud prevention for small businesses: a practical checklist

Why are small businesses a target for check fraud?

Small businesses write larger checks than households, keep higher balances, and often have one person doing everything. FinCEN's 2023 alert on mail theft related check fraud noted that business checks may be more valuable to criminals because business accounts are often well funded and fraud may take longer to notice. The same alert counted more than 680,000 check fraud reports from banks in 2022.

There are three main attacks to plan for. A mailed check is stolen and washed. A check is counterfeited using the routing and account numbers printed on any check you ever sent. Or someone inside the business writes or alters checks. The checklist below covers all three.

What internal controls stop check fraud?

The core control is separation of duties: the person who writes checks should not also sign them and reconcile the account. In a two person office, the owner can sign and reconcile while a bookkeeper prepares. In a one person business, have your accountant review cleared check images monthly.

Limit authorized signers at the bank to people who actually need the authority, and remove anyone who leaves the business the same day.

How should you store and track blank checks?

Blank check stock is a cash equivalent. Keep it in a locked drawer or safe, with the key held by someone who does not prepare checks. Record the first and last number of each box on arrival, and log any voided or spoiled check by number. A missing number should be as alarming as missing cash.

Destroy voided and misprinted checks with a cross cut shredder, not the recycling bin. Keep a record of the number first. If you ever find a gap in the sequence, call the bank and place a stop payment on the missing numbers right away.

Here is how a simple log works in practice. A box of 250 checks arrives numbered 3001 to 3250. You record the range, the date and who received it. Each week the reconciler confirms that every number used so far appears in the register as issued, voided or spoiled. If 3118 is missing from all three, it is treated as stolen until proven otherwise, and a stop payment goes in the same day.

What should you do every time you write checks?

• Write with pigmented gel ink and fill every field without gaps
• Draw a line through unused space after the payee and written amount
• Never sign a blank check or leave the payee empty
• Record each check in the register or software before it leaves the desk
• Upload or key the positive pay file the same day
• Mail checks inside the post office or hand them to a clerk
• Use security envelopes that hide the contents
• Keep the invoice and approval with the check record

Our guide to the best pen for writing checks and our guide to whether it is safe to mail a check go deeper on the last few steps.

How often should you reconcile to catch fraud?

Monthly is the minimum, but fraud moves faster than statements. Log in every two or three business days and compare cleared checks with your register: number, payee, amount and the image itself. Look for payees you do not recognize and numbers outside your current range.

Timing has legal weight. Under the Uniform Commercial Code, a customer must examine statements with reasonable promptness, and a customer who does not report an unauthorized signature or alteration within one year loses the right to challenge it. Account agreements often set shorter windows for business accounts, so read yours and report anything odd within days.

Which bank services add the most protection?

Positive pay is the strongest single service. You send the bank a list of issued checks, and anything that does not match becomes an exception you decide on. Ask for payee match, which also compares the payee name. Our explainer on how positive pay works covers the file and the daily routine.

Also ask about ACH debit blocks or filters, daily alerts for checks over a set amount, and dual approval for online payments. For vendors you pay every month, moving to ACH or bank bill pay removes paper from the mail entirely.

How do you spot a counterfeit made with your account number?

Counterfeiters only need what is printed on the bottom of every check you have sent. The warning signs are check numbers you never issued, numbers far outside your range, duplicates of real checks, or cleared checks printed on stock that does not match yours. Our guide on what MICR is explains the line they copy.

Security features on your own stock help payees and tellers spot copies. Microprinting, a void pantograph and chemically reactive paper each answer a different attack, as our overview of check security features explains. If counterfeits keep appearing, ask your bank whether to close the account and open a new one with new numbers.

What should your check reorder routine include?

Reordering is a control point, not just an errand. Order from a known supplier, enter bank details only through a secure form, never by email, and check the proof line by line: legal name, address, routing number, account number and starting check number. When a new box arrives, count it, log the range and lock it up.

Voqado encrypts routing and account numbers separately from the cart and prepares a production proof before anything prints. Before you place any order, run through our free business check order checklist so the names, numbers and layout match your bank records.