Mobile banking presents new fraud risks

Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedInEmail this to someonePrint this page

By Bob Sullivan, ThirdCertainty

Can someone cash a check you’ve written more than once? Yes, thanks to the intersection of old and new banking technology. Impossible until recently—payees formerly were required to hand over paper checks during a deposit —some experts predict “double presentment” will be the source of a new fraud wave coming soon. And even if you don’t use mobile banking, you might have to foot the bill.

It happened to Louise Moon Rosales of Vermont. Twice in the past year, she wrote checks to pay for small services such as yard work. Both were cashed … and then cashed a second time a few months later. Her bank honored both payments. For example: a $100 check she wrote to a high school student for yard work was cashed in December, and then again in April. How?

Free resource: Stay informed with a free subscription to SPWNR

The student used a new, popular checking account tool called “remote deposit capture,” and deposited the check with his cell phone. Check recipients who do that get to keep the paper check, rather than hand it over to a teller or an ATM. That means the check can be deposited a second time, a problem known in banking as “double presentment.”

“I totally could have missed it,” Rosales said. “I use online Quicken to reconcile the accounts, and that’s how I found it.”

Dealing with duplicates

It seems almost too simple: criminals re-depositing the same check multiple times. But with the meteoric rise of mobile banking and remote deposit capture, banks are racing to compete with one another to offer the service. That means they’re beginning to favor speed over safety.

And there’s another element that makes mobile banking ripe for the next wave of fraud, predicts analyst Shirley Inscoe of Aite Group. With “EMV” credit card chips finally becoming a reality in the United States, eliminating one popular kind of fraud, criminals will aggressively hop to another technique to replace lost income.

“I predict that organized fraud rings—which will be actively looking for new targets as EMV becomes more widely used—will discover (mobile remote deposit capture) in a big way,” she said.

Spotting fraud takes time, and use of fraud-fighting technologies is always a tight balancing act of convenience vs. security. It seems logical that a bank would quickly scan check numbers to make sure the same check hasn’t been deposited before, but for small dollar amounts, even that level of delay can be seen as unnecessary. Still, banks have historically been good at catching double presentment at the same institution using the same channel, says analyst Bob Meara of Celent, a research and consulting firm focused on IT in the financial services sector.

Cashing the same check twice

But if criminals use different channels—first time on a phone, second time at an ATM—that gets trickier. And depositing the same check into multiple different checking accounts at multiple banks? Well, that’s a big problem.

Even the most rigorous deposit review mechanisms are powerless to identify and reject items that have been previously deposited at other financial institutions,” Meara writes.

“Accidental double presentment” occurs when a consumer isn’t sure if she/he (or a spouse) previously cashed a check. The problem is a new one for consumers, who aren’t used to hanging onto physical checks after they’ve been cashed. Some banks tell consumers to hold onto them for a month or more, leading to inevitable confusion over what’s been cashed and what hasn’t.

Until recently, banks have been very judicious about granting remote deposit privileges to account holders, which has kept fraud rates very low. Tenure with the institution, deposit history, and average daily balances have dictated which consumers or businesses were granted mobile deposit eligibility. Banks also have established low maximum daily deposit limits, another disincentive for fraud. Meara says fraud has been extremely low.

But with the new, highly competitive environment, pressure to accept remote deposits from anyone, and for high deposit limits, has led to lowering of standards, Inscoe said. That means more fraud.


Watch for checks cashed twice. Don’t rely on your bank’s department to catch the problem.

Even if you don’t use mobile banking, you can be a victim. All that matters is the criminal/absent-minded payee uses remote deposit capture. All you have to do is write an old-fashioned check to be victim or the latest banking fraud.

More on emerging threats
Corporate use of cloud apps spikes risk of breaches
WordPress emerges as a cybercrime hotbed
Malicious ads pose insidious, elusive threat