check tampering

Most insider theft does not look like theft. It looks like a routine vendor payment, a signed check with a sensible memo line, or an invoice that fits neatly inside the budget. That is exactly why check tampering and billing schemes remain so costly. The Association of Certified Fraud Examiners (ACFE) Occupational Fraud 2026: A Report to the Nations examined 2,402 cases across 143 countries, documenting more than $3.4 billion in losses and a median loss of $104,000 per case. Asset misappropriation appeared in 90% of those cases, and within that category, billing fraud and check and payment tampering again ranked among the highest-risk schemes once frequency and financial damage are weighed together.

The payment environment adds pressure. The 2026 AFP Payments Fraud and Control Survey found that 76% of U.S. organizations faced attempted or actual payments fraud in 2025, and checks were the most targeted payment method, cited by 58% of respondents. When the person exploiting those weaknesses sits inside your own accounts payable team, the risk multiplies.

Here is how each scheme works and which controls stop it.

What Check Tampering Actually Means Today

Check tampering happens when an employee manipulates an organization’s own outgoing payments to divert funds. The ACFE’s definition covers paper checks and electronic payments alike, so a redirected ACH transfer counts just as much as a forged signature.

The most common variations include:

  • Forged maker: signing an authorized signer’s name on a company check.
  • Altered payee or amount: changing a legitimate check after it has been approved.
  • Concealed checks: slipping a fraudulent check into a stack a busy manager signs without review.
  • Authorized maker: a person with signing authority simply writing checks for personal benefit.
  • Electronic diversion: changing vendor bank details or initiating unauthorized transfers.

What makes check tampering so durable is concealment. The fraudster often controls the ledger as well, so the stolen payment gets recorded as a legitimate expense.

How Billing Schemes Drain Accounts Payable

Billing schemes work differently. Rather than taking money directly, the insider tricks the organization into paying an invoice that should never have been paid. The main forms are:

  • Shell companies: a fictitious vendor secretly controlled by the employee.
  • Pass-through schemes: the employee inserts their own company between a real supplier and the organization, then marks up the price.
  • Pay-and-return: deliberately overpaying or double paying a real vendor, then intercepting the refund.
  • Personal purchases: buying personal items with company funds and coding them as business expenses.

Billing schemes thrive wherever vendor onboarding is loose. If one person can add a vendor, approve its invoice, and release payment, no independent check exists anywhere in the chain. Our analysis of procurement fraud and kickback schemes shows how the same gaps invite rigged bids and inflated contracts.

Real Cases: How These Schemes Played Out

In Kansas, two former accounting employees of the Wyandotte County District Court pleaded guilty to wire fraud conspiracy. According to the U.S. Attorney’s Office, they stole incoming cash and hid the shortfall through check tampering, generating checks with the clerk of court’s forged signature and fabricated memo lines that made them look like routine court disbursements. The scheme cost the court $979,962 between 2018 and 2023, and both were sentenced to federal prison in June 2026.

In North Carolina, a contracted bookkeeper who handled accounts payable and payroll for three small businesses pleaded guilty to wire fraud and filing a false tax return. Court records show she made unauthorized transfers to her own accounts, then created phony vendors and falsified ledger entries to disguise them. Losses reached $975,670.94 between 2019 and 2024, and she received a 57-month sentence in January 2026.

The common thread is familiar: trusted staff, one person controlling both payments and records, and years without independent review. That combination sits at the center of the fraud triangle, where opportunity does most of the work.

Red Flags of Check Tampering and Billing Fraud

The ACFE found that 84% of perpetrators displayed at least one behavioral red flag before they were caught. Combine those human signals with transactional warning signs such as:

  • Vendors using P.O. boxes, residential addresses, or bank accounts that match an employee’s records
  • Invoices with sequential numbers, round-dollar amounts, or totals just below approval thresholds
  • Missing, voided, or out-of-sequence checks
  • Payee names on bank check images that differ from the ledger
  • Vendor bank detail changes followed quickly by large payments
  • An employee who refuses vacation or insists on opening bank statements personally

No single flag proves check tampering, but clusters deserve attention. Small, repeated amounts are how many long-running schemes stay hidden, a pattern we examine in how small embezzlement schemes go undetected for years.

Controls That Stop Check Tampering and Billing Schemes

Speed of detection is everything. The ACFE reports the median scheme ran 12 months before discovery. Frauds caught within six months had a median loss of $40,000, while those lasting more than five years exceeded $1.1 million. These controls shorten that window:

  1. Separate duties. Split vendor setup, invoice approval, payment release, and bank reconciliation across different people.
  2. Use positive pay. Ask your bank to match presented checks, including payee names, against your issued-check file, and block unauthorized ACH debits.
  3. Reconcile independently. Have someone outside accounts payable reconcile bank statements monthly and review actual check images, which directly counters check tampering.
  4. Lock down the vendor master file. Verify new vendors independently and require dual approval plus a callback to a known phone number before changing bank details.
  5. Run data analytics. Match vendor addresses and bank accounts against employee records, and scan for duplicate invoices and threshold splitting.
  6. Encourage reporting. Tips uncovered 43% of frauds in the 2026 study, far ahead of internal audit at 15% and management review at 13%.

The same data-matching approach that exposes shell vendors also catches fake workers, as our payroll fraud field guide explains.

When to Call in a Forensic Investigator

If you uncover evidence of check tampering or a fictitious vendor, resist the urge to confront the employee. Preserve records, quietly restrict system access, and involve legal counsel first.

Independent fraud examiners trace funds, quantify losses in a defensible way, and build documentation that holds up with boards, insurers, regulators, and prosecutors. Our corporate embezzlement investigation services are built for exactly these situations.

Conclusion: Close the Gaps Before Someone Uses Them

Check tampering and billing schemes succeed for one reason: organizations trust routine payments without verifying them. Separated duties, positive pay, a protected vendor file, and a working hotline cost little compared with a median loss that runs into six figures. Start with one control this week, then build from there.

If you suspect a fictitious vendor, altered checks, or unexplained payments, Fraud & Order can help you find the truth quickly and confidentially. Contact our investigators today to protect your organization with clarity and integrity.

Frequently Asked Questions

What is the difference between check tampering and a billing scheme?

Check tampering involves an employee directly manipulating the organization’s own payments, such as forging or altering checks or redirecting electronic transfers. A billing scheme tricks the organization into paying a false or inflated invoice, often from a shell vendor. Both divert company funds, but they exploit different stages of the payment process.

Does check tampering still matter if we mostly pay electronically?

Yes. The ACFE includes electronic payment manipulation in its definition of check tampering, and the 2026 AFP survey found checks remained the most targeted payment method. Changing vendor bank details or initiating unauthorized transfers is the modern version of forging a check.

How can we tell if a vendor is fake?

Start by comparing vendor addresses, phone numbers, tax IDs, and bank accounts against employee records. Look for vendors with no online presence, P.O. box addresses, or invoices that arrive in sequential order. Independent verification before onboarding is the strongest safeguard.

Who usually commits these schemes?

Most cases involve trusted employees with access to both payments and accounting records, such as bookkeepers, accounts payable staff, or office managers. The ACFE found that losses rise sharply when owners, executives, or long-tenured employees are involved, because they face fewer checks on their activity.

What should we do first if we suspect insider fraud?

Preserve documents and system logs, limit the suspect’s access quietly, and contact legal counsel before taking any visible action. Fraud & Order can then conduct a confidential investigation that traces funds and quantifies losses without tipping off the individual involved.

Can Fraud & Order help recover stolen funds?

Our investigators trace where diverted money went and prepare evidence-based reports built for litigation, insurance claims, and referrals to prosecutors. Those reports give your attorneys and insurers the documentation they need to pursue restitution. Every case is different, so recovery outcomes depend on the facts and available assets.

References

Disclaimer: This article is for informational and educational purposes only and does not constitute legal, financial, or professional advice. Reading it does not create an attorney-client, accountant-client, or investigator-client relationship. Consult a qualified attorney, forensic accountant, or certified fraud examiner about your specific situation. For questions about FraudOrder services, visit https://fraudorder.co/