On November 4, a former Indianapolis letter carrier was sentenced to six and a half years in federal prison for stealing checks off her own route. Federal agents had found thousands of stolen checks worth more than $20 million that she hadn’t even sold yet, and prosecutors estimated about 6,500 victims. Her buyers changed the payee names, deposited the checks through recruited accounts, and pulled the money out through Cash App and Zelle.
Cases like that make check washing sound like the Postal Service’s problem. The rules that decide whether you get your money back say otherwise. If you’ve heard you have 60 days to report fraud, that number comes from the law covering debit cards and electronic transfers. Paper checks run on an older rulebook, and under it your real deadline is often set by a deposit agreement you’ve never read. In at least one case a court upheld, it was 14 days.
A stolen check is worth more to a thief than whatever amount you wrote on it
Check washing means taking a real check and chemically lifting the ink, usually the payee line and the amount, then rewriting it. The paper, the bank’s printing and, most importantly, your signature all stay genuine. That’s why it works: the check passes the usual teller or mobile deposit review.
A stolen check also carries your name, your address, your bank’s routing number and your account number. So the $40 check you mailed to the utility company can become a $2,400 check to a stranger, and it can also serve as a template for printing new ones. When FinCEN analyzed reports of mail-theft check fraud, it found that 44% of stolen checks were altered and deposited, 26% were used as templates for counterfeits, and 20% were fraudulently signed and deposited. Those 15,417 reports from 841 financial institutions, filed in just six months after FinCEN’s 2023 alert, covered more than $688 million in suspicious activity.
The problem didn’t fade when paper checks became less common. Forbes reported in October that banks still file about 50,000 check fraud reports a month, and that Nasdaq Verafin estimated $34 billion in check fraud losses across the Americas in 2025, compared with $24 billion for credit card fraud. Criminals have spent years stockpiling stolen checks and selling them gradually on Telegram.
Check washing isn’t covered by the 60-day rule people quote
Your debit card and your bank transfers are covered by the Electronic Fund Transfer Act and its rule, Regulation E. That’s where the familiar 60-day reporting window comes from. Paper checks aren’t electronic fund transfers. They fall under Article 4 of the Uniform Commercial Code, a body of state law that banks and courts have applied to checks for decades.
The two systems get blurred all the time. Michigan’s consumer protection page on check washing, for example, warns that you may be responsible if you don’t report check fraud within 60 days of your statement. That’s a fair rule of thumb for card fraud. It isn’t how check losses get decided.
Under the UCC, the question isn’t just whether you reported in time. First the law asks what kind of fraud happened, and that decides which bank stands to lose.
Whether a check was altered or counterfeited decides which bank pays
When a washed check clears, two banks are involved: yours (the “payor” or “drawee” bank that pays it out of your account) and the thief’s (the “depositary” bank that accepted it). The UCC assigns the loss differently depending on how the check was faked.
If the check was altered, meaning your genuine check with a new payee or amount, the depositary bank generally bears the loss. When it presents a check for payment, it warrants that the check hasn’t been altered, and it’s considered the bank best placed to catch a doctored check at deposit. Your own bank, meanwhile, is only allowed to charge your account for the check’s original terms. If you wrote $250 and it was washed to $2,250, your bank can take $250 from you, not $2,250.
If the check was counterfeit, printed fresh using your account details, the loss generally lands on your bank, on the theory that it’s the one that should know its own customer’s signature. In a 2021 federal case in Missouri, a high-quality reproduction was ruled counterfeit rather than altered because the original paper had been replaced, which moved the loss from one bank to the other.
This explains something people find maddening: a bank sometimes credits a victim and later reverses part of it. In one case reported by NBC Washington’s I-Team, a landscaping company owner’s $2,150 check was washed and cashed nine times for more than $15,000. His bank refunded him, then clawed back $6,400 when it couldn’t collect from the bank where the checks were deposited. The fight was between two banks, and the customer was stuck in the middle.
Your deposit agreement sets the clock, and it can be very short
That settles which bank pays. When you report decides whether you get pulled into the loss anyway, and that’s where customers lose. Section 4-406 of the UCC says you must examine your statement with “reasonable promptness” and report unauthorized signatures or alterations. Two timing rules follow from that. If the same thief hits your account again, the bank can refuse to cover later checks it paid in good faith after you’d had “a reasonable period of time, not exceeding 30 days” to review the statement showing the first one. And no matter how careless the bank was, you’re barred from claiming anything you didn’t report within one year of the statement being made available.
One year sounds generous, but banks are allowed to shorten it by contract, and courts have let them. In Gluck v. JP Morgan Chase Bank, a New York appeals court in 2004 enforced a Chase account agreement requiring written notice of a forgery within 60 days of the statement. In 2014, New York’s highest court went further in Clemente Bros. v. Hafner-Milazzo, upholding a Capital One business agreement that cut the window to 14 days because it wasn’t “manifestly unreasonable.” Clemente involved a business account, and states differ on how far a bank can push this against consumers, but the principle is the same: the one-year limit in the statute is a ceiling.
How a $250 holiday check becomes a $6,000 problem
Put numbers on it. Say you mail a $250 check to your nephew on December 1. It’s stolen from a collection box, washed to $2,250, and deposited. Your statement showing it posts on December 31. The thief also has your account number and signature, so he prints two counterfeits: $1,800 paid on January 20 and $1,950 paid on February 10. You don’t open your statements until March. That’s $2,250 plus $1,800 plus $1,950, or $6,000 out of your account.
Under the statute alone, you’re in decent shape on the first check, since you’re well inside the one-year limit and your bank can only charge you the original $250. The 30-day rule is where it starts to hurt. Thirty days from December 31 is January 30. The $1,800 check cleared before then, but the $1,950 check cleared afterward, so the bank can argue you’d had your full review period and refuse to cover that $1,950 if it paid in good faith, unless you can show the bank itself failed to use ordinary care, in which case the loss gets split. Now swap in a 14-day contractual deadline like the one in Clemente. You’d have needed to report by January 14, and in March the bank could argue every one of the three checks is barred. Your exposure goes from $250 (the amount you meant to send) to as much as $6,000, and the only thing that changed is when you looked.
Reading your statement matters more than which pen you use
The usual advice still holds: write checks in black gel ink, which is harder to lift than ballpoint, and drop mail inside the post office. But the mechanics above point somewhere more useful. Your protection depends on how fast you see the problem, so the habit that matters most is checking your account a few days after any check you mail, while it’s still easy to match a cleared amount to the one you wrote. Most banking apps show an image of the cleared check. If the payee name isn’t the one you wrote, you know right away.
It’s also worth finding the “unauthorized items” or “your duty to report” section of your deposit agreement and noting the number of days. And for regular bills, online bill pay avoids the problem entirely when your bank sends the payment electronically, though it may still mail a paper check to payees that can’t accept one. Check washing is a postal crime, but whether you get your money back is mostly decided by your bank’s paperwork and your own calendar.
