Check Interception and Diversion Fraud

Check interception and diversion fraud describes schemes in which criminals intercept paper checks at various points along the postal or courier chain — rather than from an individual's letterbox — and redirect or steal them before delivery. This category includes theft from postal sorting facilities, mail carrier interception, and the use of fraudulent mail-forwarding or change-of-address requests to redirect a check stream away from its intended recipient.

Unlike check washing, which focuses on altering a single check, diversion fraud is often larger in scale. A corrupt or compromised postal worker, for example, may divert dozens of checks over an extended period before detection. Similarly, a fraudulent change-of-address filed in a business's name can redirect weeks of incoming checks before the business realises their payments are not arriving.

Businesses and organisations that receive regular check payments — landlords, small suppliers, non-profit organisations — are particularly vulnerable because a sudden pause in check receipts may be attributed to delayed payment rather than theft. The longer the scheme runs undetected, the greater the financial damage.

This form of fraud often involves a network of accomplices to cash or deposit the intercepted checks. Understanding the diversion mechanism is the key to prevention, which primarily involves monitoring expected payment arrival dates and promptly investigating any unexplained gaps.

Diversion can occur at several points. Within postal facilities, checks may be removed from envelopes during sorting — either by a compromised worker or by someone who has gained unauthorised access. Outgoing mail deposited in collection boxes may be harvested by thieves who have obtained or duplicated postal service keys, a known vulnerability in some regions.

Fraudulent mail-forwarding requests are a common tool. A fraudster files a change-of-address form for a business or individual — sometimes requiring only basic identification — and all mail, including checks, is diverted to an address the fraudster controls for a period that can last weeks. By the time the genuine addressee realises their mail has stopped, multiple checks may already have been stolen.

Intercepted checks are then either used directly, washed and altered, or deposited via accomplice accounts or mobile banking apps. Some organised schemes use networks of money mules to cash checks at different branches or institutions to avoid detection thresholds.

Organisations may notice the fraud only when suppliers or customers complain that their checks have not been cashed, or when their bank statement shows fewer incoming deposits than expected for the period.

Check interception succeeds partly because the postal and courier infrastructure is vast, moves quickly, and cannot scrutinise the contents of every envelope. Compromised workers or lax facility security can go undetected for extended periods.

Fraudulent mail-forwarding is effective because change-of-address processes are designed for convenience, not security. In many jurisdictions, relatively little verification is required to redirect another person's or organisation's mail. The victim often notices nothing wrong for days or weeks.

Businesses expecting regular check receipts can easily interpret a brief dry spell as slow payment rather than active fraud — delaying the reporting that might otherwise expose the scheme quickly.

Hi [Company Name], I sent your payment by check on [date] — can you confirm you haven't received it yet? It cleared my account last week.

Change of address confirmation: mail for [Name/Business] will be forwarded to [new address] effective [date]. If you did not request this change, call [number] immediately.

Your incoming deposit of [amount] by check from [payer] has not posted. Please verify the mailing address used.

Postal Service Notice: a mail-forwarding order affecting your address has been filed. If this was not you, visit your local branch with photo ID.

We have not received your check payment for [month]. Our accounts team is following up to ensure there are no postal delays affecting your account.

If you rely on check payments, maintain a log of expected payments and flag any that do not arrive on time. Contact the payer directly to confirm dispatch rather than assuming postal delay.

For businesses: periodically verify with your bank or postal provider that no mail-forwarding or address-change requests have been filed for your organisation. Ask your bank whether any of your account's incoming check deposits have stopped without explanation.

Request a mail-forwarding history check from your postal provider if you suspect a fraudulent redirect has been placed. File a formal correction immediately if an unauthorised forwarding order is found.