Check washing

What it is

Someone writes a check, signs it, and drops it in the mail — to pay rent, a contractor, a utility bill, or to send a tax refund or benefit payment by post. Before it reaches its intended recipient, a thief takes it: from a curbside mailbox, a residential box, or a USPS blue collection box opened with a stolen master “arrow” key that unlocks every box on a route.

The check itself is not destroyed or copied from scratch. It is washed — dipped in or wiped with a household solvent, most commonly acetone, chemically similar to nail polish remover, which dissolves standard ballpoint ink while leaving the printed check template and the account holder’s own signature untouched. What’s left is a real, validly signed check with a blank payee line and a blank amount.

From there, the thief rewrites both fields, or scans the washed check and uses it as a template to print an unlimited number of counterfeit copies. The Postal Inspection Service recovers more than $1 billion in counterfeit checks and money orders every year. FinCEN, the US Treasury’s anti-money-laundering unit, recorded over 350,000 check-fraud-related Suspicious Activity Reports in 2021 and over 680,000 in 2022 — nearly double the prior year — and called it a nationwide surge in a February 2023 alert to every US bank and credit union.

The loss on any single check varies widely and isn’t reliably tracked as its own category, so the range here is estimated from documented cases rather than a published agency average. The Boston Fed cites one altered check that went from $272 to nearly $5,000; the Detroit ring’s more than 10,000 advertised checks totalled $63 million, an average of roughly $6,300 each. Both figures sit inside the hundreds-to-low-five-figures range typical of a single personal or small-business check.

How it actually works

1. Outgoing mail waits for pickup

   A signed check for rent, a bill or an invoice goes into a curbside mailbox or a USPS blue collection box, then sits until the next scheduled pickup — sometimes overnight, sometimes longer over a weekend.

2. Theft from the mail stream

   Thieves use a stolen postal “arrow” key — a single master key that opens every collection box on an entire route — or steal directly from residential boxes and, in some documented cases, from carriers themselves. FinCEN’s 2023 alert notes that mail theft-related check fraud was previously mostly confined to postal employees with facility access; it is now widespread street-level theft as well.

   Where it could have stopped

   The Postal Inspection Service’s own advice is the clearest prevention point in this entire chain: deposit outgoing mail as close to the last collection time as possible, or hand it directly to a carrier or a clerk inside a Post Office, rather than leaving it sitting in a mailbox overnight or in a collection box early in the day. A check that is never left waiting cannot be taken from a box.

3. Washing

   A solvent — acetone, bleach or isopropyl alcohol, all comparable to nail polish remover — dissolves the handwritten ink while leaving the printed check and the signature intact. Standard ballpoint ink sits on top of the paper fibre and lifts easily; gel-pen ink, which binds into the fibre itself, resists the same process, which is why postal and banking guidance specifically recommends it for anyone still mailing checks.

4. Rewriting or reproducing the check

   The payee name and dollar amount are rewritten by hand onto the now-blank check, or the washed check is scanned and used as a template to print counterfeit copies, each with its own new amount, off a single stolen original.

5. Sold wholesale, or deposited directly

   Some washed and counterfeit checks are deposited directly by the thief or a recruited money mule. Others are sold in bulk: a federal case in Detroit documented more than 10,000 stolen checks, including US Treasury tax refund checks, advertised for sale across two Telegram channels.

6. Cashed out before anyone notices

   Funds are withdrawn or moved on quickly, before the original payee reports a missed payment or the account holder’s bank reconciles the statement and flags an amount or payee that doesn’t match what was written.

7. Discovery and prosecution

   The fraud typically surfaces when a bill goes unpaid, a landlord or contractor asks where their payment is, or a bank’s own fraud detection flags an altered check. Postal Inspectors can trace a pattern of thefts to a single collection route or a single stolen key. Documented federal sentences for organized rings have reached a decade or more.

Why it works

The check itself is real. A washed check isn’t a forgery from nothing — it carries a genuine account number, routing number and signature, which is exactly what makes it clear a normal bank teller’s or ATM’s automated check, and often a human reviewer too, on a quick look.

Paper mail is still routine. Rent, contractor payments, and government benefit payments sent by paper check remain common enough that a stolen collection-box key can net dozens of checks at once, across many different victims who have no reason to suspect anything until a payment goes missing.

The chemistry is cheap and the ink is ordinary. Acetone and similar solvents are available at any drugstore, and the standard ballpoint ink most people still write checks with was never engineered to resist them.

Discovery lags behind the theft by weeks. A victim who mails rent doesn’t usually check whether it cleared under the correct payee name; a landlord who doesn’t receive it may assume a postal delay before suspecting theft. That gap is enough time for a check to be washed, deposited and the funds moved on.

And it scales through resale. A single stolen collection-box key produces more checks than one thief can personally cash without drawing attention — so a wholesale market on channels like Telegram lets the theft and the cash-out happen through different people entirely, each taking a smaller, less conspicuous share.

Where it comes from

Domestic and low-tech, running almost entirely through the ordinary postal and banking systems it exploits.

This is a US Postal Service-specific crime wave, and not a new one. Every documented case on this page involves theft from USPS collection boxes, residential mailboxes, or postal employees themselves — not couriers, not private carriers. It also predates the current surge: a Minnesota ring of nine defendants was federally sentenced in 2012 for washing and altering checks stolen between 2010 and 2011. FinCEN’s February 2023 alert traces the more recent, much larger surge to security gaps criminals found in postal infrastructure during the pandemic, and its scale is now large enough that fraud, including check fraud, is one of the Treasury’s named national AML/CFT priorities.

It runs on stolen physical access, not stolen data. Unlike phishing or account-takeover fraud, a washed check requires no hacked password or leaked database — only a stolen master key or a stolen collection route. Two of the three sentenced rings on this page directly involved current or former postal employees exploiting exactly that kind of access.

Scale ranges from individual theft to organized wholesale rings. A single mail carrier can steal hundreds of thousands of dollars in checks over two years working alone, as in the Georgia case on this page; an organized ring with insider postal access, as in Detroit, moved $63 million in stolen checks through an online marketplace before it was broken up.

Enforcement is federal and criminal, unlike the largely civil enforcement seen in some other schemes on this site. Mail theft and bank fraud are federal crimes prosecuted by US Attorneys, and the sentences in documented cases run into years, not fines — reflecting that this is theft of a physical instrument and identity information, not a disclosure or advertising violation.

Real cases

Red flags

• A bill or rent payment you mailed never seems to arrive, and the recipient says it hasn’t cleared or been received.
• A bank or credit card statement shows a check cleared for a different amount or payee than what you wrote.
• You wrote a check in standard ballpoint pen and mailed it from a residential box or left it overnight in a collection box before the last pickup.
• Your bank or credit union flags an altered or counterfeit check drawn on your account that you didn’t write.
• A neighbor or someone on your block reports mail theft or a tampered collection box nearby — a stolen arrow key affects an entire route, not one address.
• You receive a “declined” or bounced-payment notice for a bill you know you paid and mailed on time.

If it’s happening to you

1. Contact your bank or credit union immediately, in writing, if you discover an altered or counterfeit check drawn on your account. Ask specifically about their check-fraud claims process and your rights under Regulation CC and your account agreement.
2. File a report with the US Postal Inspection Service at 1-877-876-2455 or uspis.gov/report — mail theft is a federal crime, and USPIS investigates it directly.
3. Report it to the FTC at ReportFraud.ftc.gov, which shares fraud reports with law enforcement nationwide. See where to report for other countries.
4. File a police report with your local department — some banks require one to process a fraud claim, and it creates a record if your case is part of a larger ring.
5. Consider a stop-payment or account change if a check you wrote is confirmed stolen, and monitor your account closely for further attempts using the same account and routing numbers, which the washed check exposes.
6. Switch to online bill pay or a gel pen for any check you still mail, per USPIS and Federal Reserve guidance, and deposit outgoing mail as close to the last collection time as possible rather than leaving it overnight.

Where the money goes

A washed or counterfeit check is deposited into a bank account — sometimes the thief’s own, more often a recruited money mule’s account — and withdrawn or transferred out quickly, before the account holder or the original payee’s bank can flag the mismatch.

Where the theft is organized rather than opportunistic, the checks themselves become a wholesale commodity before any money moves at all: the Detroit ring on this page sold more than 10,000 stolen checks, including US Treasury refund checks, across two Telegram channels, letting buyers who never touched a mailbox do their own cashing-out through their own mule accounts. That division of labor — one group steals and sells, another group deposits and withdraws — is what let a single ring’s documented scheme reach $63 million while limiting any one person’s direct exposure to the theft itself.

By the numbers

No published dataset breaks this scheme out as its own category yet, so there is no chart to show. The data page explains which agency categories exist and why some schemes are invisible in official statistics.