Deposit account fraud is any scheme that uses deception to steal money from or through a bank checking or savings account. Federal law treats it as a serious crime carrying fines up to $1,000,000 and up to 30 years in prison, and most states add their own charges on top.1Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud The techniques range from old-fashioned check washing to sophisticated electronic transfers, but they share one thread: someone deliberately manipulates a deposit account, or the banking system around it, to get money they have no right to.
What the Schemes Actually Look Like
The methods have evolved with banking technology, but several patterns come up again and again.
Check Kiting
Check kiting exploits the delay between depositing a check and the bank actually collecting the funds. A person writes a check from an account that lacks the money to cover it, deposits that check into a second account, and withdraws cash from the second account before the first check bounces. To keep the scheme alive, they write another check from the second account back to the first, creating a circular loop of phantom balances. The “float” period between deposit and clearance is what makes the whole thing work.2FedPaymentsImprovement.org. The Anatomy of Check Kiting Kiting schemes collapse once the bank spots the pattern or one of the checks is held long enough to clear, and at that point the perpetrator owes every dollar they withdrew.
Forged, Counterfeit, and Washed Checks
Forged checks involve altering a legitimate check by changing the payee name, the dollar amount, or the signature. Counterfeit checks are fabricated from scratch, often using commercially available check stock and routing numbers stolen from real accounts. Modern printing has made counterfeits difficult to distinguish from authentic checks visually, which is why banks lean on automated verification rather than eyeballing them.
Check washing is lower tech but rising fast. A fraudster steals a check from a mailbox, then uses common household chemicals to dissolve the ink. Once the original payee name and dollar amount are erased, the criminal rewrites the check to themselves for a larger amount and deposits it. The U.S. Postal Inspection Service has flagged check washing as a growing problem tied to mail theft.3United States Postal Inspection Service. Check Washing The FBI’s Internet Crime Complaint Center has similarly noted that mail-theft-related check fraud has been climbing steadily.4Internet Crime Complaint Center. Mail Theft-Related Check Fraud is on the Rise
Mobile Deposit Fraud
The same technology that lets you deposit a check by snapping a photo has opened a new attack vector. In a duplicate presentment scheme, someone deposits a check through a mobile app at one bank and then deposits the physical check at a different bank or cashes it in person. The depositor collects the funds twice before either institution catches on. Fraudsters also use mobile deposit to submit stolen, forged, or counterfeit checks without setting foot in a branch, which makes them harder to identify from security footage.
Unauthorized Electronic Transfers
When a fraudster obtains your bank account and routing numbers, they can initiate ACH debits that pull money directly from your account. These credentials are often harvested through phishing emails, fake websites, or malware that records keystrokes. Wire transfers are another target. In a business email compromise attack, a criminal impersonates a company executive or vendor and instructs an employee to wire funds to a fraudulent account. Wire transfers settle quickly and are difficult to reverse, so the money is often gone before anyone notices.
New Account Fraud
Rather than compromising an existing account, some fraudsters open entirely new ones using stolen or synthetic identities. A synthetic identity blends real data (like a legitimate Social Security number) with fabricated details to create a person who doesn’t actually exist. Fraudsters use these identities to open accounts through online portals, build up a brief history of normal-looking activity, then execute a large fraudulent transaction and vanish. Opening their own accounts lets criminals bypass the need for money mules or accomplices.
How the Law Treats It
The main federal statute is 18 U.S.C. § 1344, which makes it a crime to knowingly carry out any scheme to defraud a federally insured financial institution or to obtain money or property from one through false pretenses.1Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud The language is deliberately broad. Prosecutors do not need to prove a specific technique was used, only that the defendant knowingly participated in a scheme built on deception and that a federally insured bank was the target or the vehicle. A conviction carries a maximum fine of $1,000,000 and up to 30 years in federal prison. Those are statutory maximums, and actual sentences depend on factors like the amount stolen and criminal history, but the ceiling is high enough that even a first offense involving a modest amount can result in years of incarceration.
Deposit account fraud rarely produces a single charge. When a scheme uses phone calls, emails, or electronic communications, prosecutors often add wire fraud under 18 U.S.C. § 1343. Wire fraud normally carries up to 20 years, but when the scheme affects a financial institution, the penalties jump to the same $1,000,000 fine and 30 years that apply to bank fraud.5Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television If the perpetrator used a stolen or fabricated identity to access accounts, federal identity fraud charges can stack on as well. Each count carries its own potential sentence, and federal sentences often run consecutively rather than concurrently.
Federal bank fraud also carries a 10-year statute of limitations under 18 U.S.C. § 3293, twice the standard five-year window for most federal crimes.6Office of the Law Revision Counsel. 18 USC 3293 – Financial Institution Offenses Someone who thinks they got away with a kiting scheme in 2020 can still be indicted in 2030.
State prosecutors also handle deposit account fraud, usually under statutes covering bad checks, forgery, or theft by deception. Whether the charge is a misdemeanor or a felony generally hinges on the dollar amount. Beyond criminal penalties, most states allow the victim to pursue civil damages, and many authorize penalties of double or triple the check’s face value in a civil action. The specific thresholds vary by jurisdiction.
Your Liability Limits as a Victim
If someone makes unauthorized electronic transactions on your account, federal law caps how much you can lose, but only if you report the fraud quickly. The Electronic Fund Transfer Act uses a tiered system based on how fast you notify your bank.
- Within 2 business days of learning about the loss or theft: your maximum liability is $50, or the amount of unauthorized transfers before you notified the bank, whichever is less.7Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- After 2 business days but within 60 days of your statement: your liability rises to a maximum of $500 for unauthorized transfers that occurred after those first two days.7Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- After 60 days: you could be on the hook for the full amount of any unauthorized transfers that occur after the 60-day window closes, with no cap.8Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
Those deadlines are the single most important thing to know. The difference between calling your bank on day two and waiting until day sixty-one can be the difference between losing $50 and losing everything.
For check fraud rather than electronic transfers, the rules come from the Uniform Commercial Code. You have a duty to review your bank statements with “reasonable promptness” and report any forged or altered checks. If you fail to flag a problem and the same person forges another check, you lose the right to challenge that second check if more than 30 days have passed since the bank sent you the statement showing the first one. Regardless of any other circumstances, you have an absolute one-year deadline: if you do not discover and report a forged signature or altered check within one year of receiving the statement, you cannot hold the bank responsible.9Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
What to Do If You Find Fraud on Your Account
Speed matters more than anything else. Because the liability limits hinge on when you notify your bank, the first step is always to contact your bank or credit union immediately. Once you report the problem, the bank generally has 10 business days to investigate and must correct any confirmed error within one business day of completing that investigation.10Consumer Financial Protection Bureau. How Do I Get My Money Back After I Discover an Unauthorized Transaction or Money Missing From My Bank Account
Beyond calling the bank:
- File a police report. Many banks require one before they will process a fraud claim, and you’ll need it if the case is later prosecuted.
- Document everything. Screenshot the unauthorized transactions, save emails, and note the dates and times of every call you make to your bank.
- Change your credentials. Update your online banking password, PIN, and security questions. If your debit card number was compromised, request a new card.
- Place a fraud alert on your credit reports. A fraud alert with any one of the three major credit bureaus automatically extends to the other two and makes it harder for someone to open new accounts in your name.
- File a complaint with the CFPB. If your bank is not responding appropriately, a complaint creates an official record and often accelerates the response.
One thing to know about the bank’s side: federal regulations require banks to file Suspicious Activity Reports with the Financial Crimes Enforcement Network when they spot certain patterns, and they are legally prohibited from telling the customer that a SAR has been filed.11Office of the Comptroller of the Currency. Suspicious Activity Report (SAR) Program Your bank may already be tracking the fraud before you report it.
How It Differs From Related Crimes
Deposit account fraud overlaps with several other financial crimes, and the distinctions matter because they affect which laws apply and which remedies are available.
Identity theft is often the first step in a deposit account fraud scheme, providing the stolen credentials needed to access or open an account. But identity theft alone is a separate offense. A person who steals your Social Security number and never touches a bank account has committed identity theft, not deposit account fraud. The bank account manipulation is what distinguishes this crime.
Credit card fraud targets a credit line rather than deposited funds. The liability rules are different (federal law caps credit card fraud losses at $50 regardless of when you report), the investigation process is different, and the financial institution’s exposure is different. A fraudster draining your checking account takes money you already have; credit card fraud creates a debt on a credit line.
Loan fraud involves lying on a loan application to borrow money you wouldn’t otherwise qualify for. The deception happens during origination rather than through manipulation of an existing deposit account. Someone who fabricates income documents to get a mortgage is committing loan fraud, not deposit account fraud, even though both involve deceiving a financial institution.
If a federal prosecution does result in a conviction, the Mandatory Victims Restitution Act requires the court to order the defendant to pay restitution to any identifiable victim who suffered a financial loss as a direct result of the crime, including both individuals and banks.12Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Offenses The order becomes a judgment the government can enforce through wage garnishment and asset seizure, though collection depends on whether the defendant has any assets left.