Stolen-Check Money Laundering: The Deposit Account Behind the Altered Payee

Stolen check money laundering investigations follow bank accounts that received suspected theft proceeds and the transactions that moved them onward. If you work in deposit operations, a branch or fraud review, your concern may begin with a payee that appears to have changed. We want to understand the account behind that payment and what happened after the concern reached someone who could act.

What did the bank know, and who could stop the next payment? Anti-money laundering failures inside a bank can involve customer information, transactions excluded from monitoring or warnings that never changed how an account was handled. An insider can connect those decisions to the activity they allowed to continue.

The Payee Question Leads to the Account

FinCEN’s mail-theft alert describes thieves replacing a stolen check’s payee information with their own identity, a false identity or a business account they control. When your concern is an altered payee, we start with the connection you can explain between the disputed payment and the receiving account. Who was the customer, what was the account supposed to do, and what did the bank learn about this payment?

Bank anti-money laundering rules join customer information with ongoing monitoring. Customer identification addresses the person opening the account. Due diligence also concerns the purpose of the relationship and whether later activity fits the customer’s risk profile. A customer’s stated business gives us something to compare with the payments the account actually handled.

A customer’s explanation is part of that comparison. We would examine what the explanation addressed, what information contradicted it and what decision followed. Where you know about a theft complaint, its connection to that same payment and account belongs in the account you give us.

What Happens After the Deposit?

The movement after a deposit matters because money laundering can distance proceeds from the activity that generated them. The FATF-OECD policy brief Money Laundering, published in 1999, describes criminal proceeds entering accounts through deposits or monetary instruments, followed by transfers or conversions that obscure their source. It also describes transfers made to look like payments for goods or services.

FinCEN describes stolen checks entering accounts through bank branches, ATMs and remote deposit. After depositing the checks, criminals often quickly withdraw the money through ATMs or wire it to other accounts they control. We would connect that movement to the original check and the customer information available at the time. The question becomes who could explain the payment’s origin and who controlled its next destination.

The same policy brief explains why financial transaction records matter to investigations: connections among transactions can identify the people responsible and locate hidden assets. For an insider, that makes the link between records valuable. Knowing which payment belongs to which customer, or which decision allowed further activity, can give a transaction history meaning that the amounts alone cannot supply.

What Account Opening and Later Activity Show

FinCEN’s alert distinguishes accounts opened for check fraud from money mules’ existing accounts. Criminals often open accounts specifically for these schemes, but they may also use a mule’s pre-existing account to deposit fraudulent checks. A money mule moves illicit funds for someone else and may do so knowingly or unknowingly. For an insider, the account’s history helps explain whether the deposits began with the relationship or marked a change in how an existing customer used the account.

We apply that distinction to the account you are concerned about. What explanation was on file when the payment arrived, and what did later transactions or warnings add? We line those events up by date against what staff knew. That chronology separates the original customer information from explanations offered after someone raised a concern.

For repeated disputed payments, we would examine the sequence you observed and the response to each warning. If your work connects more than one account, we want to understand the basis for that connection: customer information, transaction records or a decision involving those accounts.

What Are the Red Flags for AML Transaction Monitoring?

Red flags for AML transaction monitoring include excluded payment categories, alert caps, rules that suppress alerts without adequate testing and activity that conflicts with the business described in the customer file. In a check-related concern, we would examine whether the activity reached review and what information the reviewer had. The decisions behind monitoring coverage can explain why a warning failed to change the handling of later payments.

According to the Justice Department’s account of the bank’s criminal guilty pleas, TD Bank admitted failures that left most checks outside transaction monitoring. Management budget constraints contributed to that gap. We see a bank willing to process checks but unwilling to pay to monitor most of them. The budget won.

The insider evidence reaches the choice itself: monitoring rules, coverage decisions, audit findings and the response to internal warnings. For your concern, we would connect those records to the activity you saw and the people who could change the control.

What Proof Do You Need as a Whistleblower?

Useful whistleblower evidence connects the transaction, customer, warning and institutional response. We sort what you saw from what you were told and what you inferred. That distinction gives your account precision without asking you to resolve the entire case yourself.

Different employees can explain different parts. Onboarding staff may know the customer’s stated business, operations staff which accounts remained open, and auditors what testing found. A monitoring engineer may know which activity the system excluded, while a manager may know who approved the budget or exception. We connect that knowledge to the disputed payments and subsequent activity you are concerned about.

Questions about SAR confidentiality and the underlying transaction evidence belong in a conversation with our whistleblower experts. We work through those questions with you while assessing what the bank knew and how it responded.

What Is the Reward of a Whistleblower in Money Laundering?

The FinCEN whistleblower program provides qualifying whistleblowers collectively 10% to 30% of qualifying collections from covered actions exceeding $1 million. Its award law ties the reward to collected monetary sanctions. For a bank employee concerned about stolen checks, we assess the institution’s anti-money laundering failures and whether the information can support covered enforcement.

The False Claims Act has its own whistleblower route for false claims involving government money. In a stolen-check matter, we would look for that government-claims connection beyond the theft or the bank’s anti-money laundering failure. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. We assess the whistleblower program suited to the matter with you.

You Know What Happened After the Warning

If your work connects a disputed check to an account and a warning the bank received, speak with our whistleblower experts about the payments the bank kept moving. We build the case strategy around the transactions and decisions you can explain, bring in money laundering whistleblower lawyers who understand bank controls, and stay beside you throughout the case.