TIP: This Compliance Courier was adapted (with permission) from a recent blog post written by Shelli Clarkston, an attorney with the Spencer Fane law firm in Kansas City, MO.
Recently, credit unions and other financial institutions have faced losses because of a growing fraud scheme. Credit unions should understand this scam and take precautions to protect themselves.
How the fraud works
The fraud begins when a fraudster intercepts a check in the mail. Typically, these checks are payable to a business. The thief then forms a new business entity (usually in a different state), using the same name as the payee business. For example, for a check payable to ABC, Inc., the individual will form a new corporation also named ABC, Inc. and will prepare the relevant corporate documents. (Wisconsin law does not stop someone from incorporating a new business in this state using the exact same name as a business that was formed in some other state but never registered to do business here.)
The individual will then go into the credit union and open a new account in the name of ABC, Inc. The credit union will typically obtain the articles of incorporation as well as a certificate of good standing, corporate resolutions, and bylaws. Satisfied that the new business was legally formed, the credit union will let it deposit the intercepted check into the new account. The fraudster will usually withdraw the funds soon after.
Sometime later, the actual payee contacts the payor (the person or business who wrote the check) to report that it never received the check. The payor contacts its financial institution only to be told that the check has cleared. The payor’s institution then submits a breach of transfer warranty claim to the credit union – which was the “bank of first deposit” – for fraudulent endorsement. By then, though, the funds in the new account are gone.
The liability rules
The fraudster is ultimately liable for the stolen money but typically cannot be found or has already spent the money. That leaves the two financial institutions in a dispute over which of them should bear the loss.
When it comes to forged endorsements, the Uniform Commercial Code (“UCC”) is the controlling law. Wisconsin’s version of the UCC includes several provisions that come into play:
- Section 404.207 of the Wisconsin Statutes, “Transfer Warranties,” says that all signatures (such as an endorsement) are authentic and authorized.
- Under §403.403, “Unauthorized Signature,” an unauthorized signature is ineffective except as the signature of the unauthorized signer in favor of a person who in good faith pays the check or takes it for value (such as the “bank of first deposit”).
- However, §403.406(1) says that a person whose failure to exercise ordinary care substantially contributes to the making for a forged signature on a check is precluded from asserting the forgery against a person who, in good faith, pays the check or takes it for value or collection.
- Also, under §403.406(2), if the person asserting the preclusion fails to exercise ordinary care in paying or taking the check and that failure substantially contributes to the loss, the loss is allocated to the extent to which the failure of each to exercise ordinary care contributed to the loss.
What does all that mean? Simply, if the credit union did not exercise ordinary care in taking the check for deposit, it will be precluded from asserting liability for the forged endorsement against the payor’s financial institution. The credit union will bear the loss, and it will not be able to claim that the payor’s financial institution was somehow liable.
Protect your credit union
So, what does your credit union need to do to show that it acted in good faith and exercised ordinary care when accepting the check for deposit? The following checklist details some actions your credit union should consider taking:
- Follow all procedures for Customer Identification Program and beneficial ownership, including obtaining valid government issued identification. See The League’s ii Release No. 0159 for information on conducting CIP to identify organizations and the individuals who are authorized to open accounts for them. The ii Release also has information on identifying the “beneficial owners” of a business, which is part of your credit union’s Customer Due Diligence obligations.
- Closely examine the identification provided to determine if it is genuine. (Institutions often utilize an I.D. Checking Guide that contains images of valid driver’s license formats for all 50 states.)
- Compare the date the check was written against the date the organization was formed. A check issued before the entity was formed could indicate fraud.
- Compare the address of the payee on the check (if there is one) with the address for the entity. Different addresses could indicate fraud.
- Look at the address of the payee and the entity in comparison to your credit union’s branch locations. An address that is not close to any branch location could indicate fraud.
A credit union that is the victim of such a fraud can, of course, report the scam to authorities and file a Suspicious Activity Report. It should also alert its bonding company (TruStage, for many Wisconsin credit unions) right away and follow their guidance.
For more information on scams like the one described in this Compliance Courier, see FinCEN’s recent Financial Trend Analysis titled, “Mail Theft-Related Check Fraud.” During a six-month period in 2023, FinCEN said that it “received 15,417 BSA reports related to mail theft-related check fraud associated with more than $688 million in transactions, which may include both actual and attempted transactions. Mail theft-related check fraud losses can affect personal savings, checking accounts, business accounts, brokerage accounts and retirement savings, as well as negatively impact financial institutions that typically cover check fraud losses.” FinCEN’s publication describes several methods that criminals use to negotiate stolen checks, and your credit union’s staff should be trained to watch for all of them.