Check Fraud Red Flags for Small AP Teams: What to Watch Before and After a Check Goes Out
ACOM Business SolutionsShare
Small AP teams can catch most check fraud by watching four places: a vendor asking to change where it gets paid, a check the vendor says never arrived, a paid check whose payee, amount or number does not match your register, and a bank statement nobody reads for weeks. Checks were the payment method most often hit by fraud in the 2026 AFP survey, so a short weekly routine plus a bank control or two is worth setting up.
What this article is, and is not
ACOM sells check stock and MICR printing supplies. We are not a bank or a fraud consultancy, and this does not replace advice from your bank or your auditor. Every fact below comes from a public source listed at the end. Our own suggestions are labeled.
Why checks still need attention
In the 2026 AFP Payments Fraud and Control Survey, 58 percent of organizations reported attempted or actual check fraud in 2025. ACH debits followed at 30 percent and wire transfers at 25 percent. AFP's highlights report says 87 percent of organizations still use checks.
AFP also notes that smaller firms face fraud less often than large ones but are much more likely to absorb the full loss. FinCEN's mail-theft alert says business checks may be more valuable to thieves because business accounts are often well funded and the victim may take longer to notice.
Red flags before the check is written
The FBI's business email compromise red flags fit a vendor payment request well: unexplained urgency, last-minute changes to recipient account information, a switch in the email address or platform the vendor normally uses, email-only contact with a refusal to talk by phone, and a request for advance payment that was never required before.
Checks are not exempt. In AFP's figures on payment methods used in these attacks, checks were named at 33 percent, next to ACH debits at 34 percent and wires at 49 percent. Our suggestion: treat a new remit-to address the way you treat new bank details.
The FBI's fix is plain. Verify the change through the contact you already have on file, never the number in the email. The IC3 public service announcement calls for "secondary channels." AFP reports that 94 percent of organizations have callback verification and 96 percent have a policy to verify changes to invoices, bank details and contact information.
Red flags in the mail and on the paid check
The Postal Inspection Service describes the classic sign: you sent a check, it was cashed, and the payee says it never arrived. FinCEN's trend analysis found the payee line was altered most often, then the amount, usually raised. It also saw criminals open accounts in a business payee's name, or a near match, to deposit stolen checks.
| Red flag | Where you see it | First move |
|---|---|---|
| Vendor wants new bank details or a new remit-to address | Email, phone call or portal message | Call the number on file before paying |
| Vendor says a check never arrived, yet it shows as paid | Vendor call, bank portal | Pull the paid-item image and call your bank the same day |
| Paid payee differs from your register | Paid-item image | Call your bank the same day |
| Paid amount is higher than the amount issued | Paid-item image | Call your bank the same day |
| Check number or amount is missing from your issued list | Positive Pay exception | Reject it unless it matches a real payment |
See our article on spotting a washed or altered check for what tampering looks like.
How soon to look at statements
Under the model Uniform Commercial Code, section 4-406, a customer must examine statements or paid items with reasonable promptness and report an unauthorized payment. A customer who does not can lose the right to dispute later altered items by the same wrongdoer, once a reasonable review period of up to 30 days has passed. States adopt their own versions and your account agreement may add terms, so ask your bank. This is not legal advice.
Our suggestion: compare paid-item images to your check register every week, not at month end.
Controls that fit a small AP team
- A written rule that no vendor bank or address change happens without a callback to the number on file.
- Senior sign-off above a set amount. AFP reports 94 percent of organizations have it.
- A ban on starting a payment from an email. AFP reports 91 percent have one.
- Positive Pay with payee match, if your bank offers it. Our Positive Pay article covers what the file needs.
- Secure stock that shows or resists tampering, with payee and amount printed, not handwritten. Our secure check stock features article compares the features, and secure blank check stock lists what each style includes.
Frequently asked questions
Which red flag should we check first?
No source we reviewed ranks red flags by frequency. FinCEN found altered checks were about 44 percent of the mail-theft check fraud reports it reviewed by hand, with the payee changed most often. A payee that does not match your register is a sensible first test.
Do small businesses get hit less often?
Less often, according to AFP, but they are much more likely to absorb the full loss.
Should we stop using checks?
That is your call. AFP found that 72 percent of organizations using checks plan to keep them, and 68 percent of those cite vendor requirements.
What do we do after a fraudulent payment?
The FBI says to contact your financial institution immediately to request a recall of funds, then file a complaint at ic3.gov. For business email compromise, it lists bec.ic3.gov.
Talk to us
Questions about secure check stock or MICR printing supplies? Call ACOM Business Solutions at 800-891-7899 or use the contact page.