Get the iPhone appApp Store
LedgerHQ
Start Free
All articles

Firm operations

Bank Statement Fraud and Document Authentication for Bookkeeping Firms

76% of organizations faced payments fraud in 2025, checks were the most-targeted method, and only 35% of businesses run positive pay. For bookkeeping firms, the reconciliation is where fraud becomes visible. Here's how check washing and forged statements work, how professionals authenticate documents, the five controls every firm should run, and a worked example of the exact moment the books catch a $12,000 washed check.

LedgerHQOctober 3, 2026
Bank Statement Fraud and Document Authentication for Bookkeeping Firms

The short answer

Fraud is not the exception anymore; it is the operating environment. In the 2026 AFP Payments Fraud and Control Survey, 76% of organizations said they experienced attempted or actual payments fraud in 2025, and checks were the payment method most frequently impacted — 58% reported check fraud (AFP / Truist, 2026). The year before was barely better: 79% experienced payments fraud and 63% experienced check fraud in 2024 (AFP, 2025). Meanwhile the defenses lag badly: only 35% of businesses have adopted positive pay, the bank control that Frank Abagnale — the reformed forger who knows the trade — called "probably the best technology in the world to prevent forgery" (Q2, 2026; The Global Treasurer, 2017). And just 17% of organizations use AI to combat payments fraud (AFP, 2026).

Here is the part that belongs in a bookkeeping firm's article rather than a bank's: nobody in this chain is positioned better to catch it than the bookkeeper. The fraud lives in the gap between what the client issued and what the bank saw — and the reconciliation is the one process that compares those two things, row by row, every period. A washed check, an altered payee, a statement that doesn't foot: they all surface at the same place. The question is whether the firm's process is fast and disciplined enough to surface them while the money is still recoverable.

This article walks the whole problem from the firm's seat: the scale of the fraud wave, how check washing and statement forgery actually work (with real cases and real numbers), how professionals authenticate documents, the five controls every firm should run, and a worked example of the exact moment a reconciliation catches a $1,200 check that cleared as $12,000. It ends with an honest accounting of where LedgerHQ's reconciliation tooling fits in that control chain — and where it doesn't.

Fraud is normal. Protection is not.

The numbers have stopped being shocking and started being structural. Three findings from the 2026 AFP survey — the 22nd annual edition, based on 465 corporate professionals across industries and company sizes — define the landscape:

  • 76% of organizations experienced attempted or actual payments fraud in 2025. Down slightly from 79% in 2024, but still elevated across every size band.
  • 58% reported check fraud in 2025, outpacing ACH and wire fraud. Checks remain the most-frequently-impacted payment method, a title they've held in every survey in recent memory.
  • Only 17% of organizations leverage AI to combat payments fraud. The ones that do report it pays: 49% cite improved fraud-reporting efficiency, 45% improved deepfake detection, 43% real-time identification capability.

Two more numbers complete the mismatch. The Federal Reserve's survey work found check fraud accounted for 30% of all bank fraud losses in 2024 — second only to debit card fraud. And Bank Director's 2025 Risk Survey found 94% of bank executives said their institution or customers had been directly affected by check fraud in the past 18 months, with check fraud up nearly 400% (via Monit/CheckSync, EIN Presswire, October 2025).

Now the protection side. Per Q2's Positive Pay Adoption Playbook (2026): 91% of financial institutions recognize positive pay as a critical solution — yet adoption across the industry is only 35%. That is a staggering gap between what banks know works and what businesses run. Q2 Centrix's customers alone used the tool to stop more than $2.8 billion in attempted fraud in 2025. And 61% of businesses that receive positive pay at no cost say they would pay for the protection — demand exists; the gap is awareness and implementation friction.

Surveyed fraud exposure versus actual adoption of defenses: 76% of organizations hit by payments fraud in 2025, 58% hit by check fraud, 94% of bank executives reporting check-fraud impact — against 35% positive-pay adoption and 17% AI use for fraud mitigation

The pattern is familiar to anyone who sells controls to small businesses: the threat is measured in the hundreds of billions industry-wide while the response is one vendor form away. FinCEN's financial-crime analysts estimate check fraud accounted for roughly $21 billion in losses during 2023 alone — and note the figure is almost certainly low, because an estimated 90% of mail theft goes unreported (Forbes / Steve Weisman, January 2026). Between fiscal years 2019 and 2023, reports of mail theft from mail receptacles rose 139% (Postal Inspection Service / Treasury data). The Suspicious Activity Reports tell the same story in banking terms: financial institutions filed more than 350,000 check-fraud SARs in 2021 (up 23% over 2020) and over 680,000 in 2022 — nearly double (FinCEN alert, February 2023).

The Association for Certified Fraud Examiners adds the small-business punchline: in the 2024 Report to the Nations, organizations with fewer than 100 employees suffered a median loss of $141,000 per fraud case — the second-highest of any size band — and billing, check tampering, and payment tampering schemes hit smaller organizations hardest. The typical case runs 12 months before detection, and check-and-payment-tampering schemes bleed at a median velocity of $8,600 per month (ACFE, 2024). For a small business, that is not a rounding error. It is an existential threat.

How check fraud actually works

Strip away the jargon and almost all check fraud runs one of three plays: steal it, wash it, or forge it. The mechanics matter because each one leaves a different fingerprint in the books — and a different opportunity for the bookkeeper to catch it.

Steal it. The supply chain starts at the U.S. Mail. Criminals target USPS blue collection boxes and unsecured residential mailboxes — by forced entry, makeshift "fishing" devices, counterfeit keys, and in some cases stolen or counterfeited "arrow keys," the master keys letter carriers use to open collection boxes (FinCEN, 2023). Residential mailboxes with the flag up are the softest target of all: outgoing mail containing checks, sitting overnight. Since the COVID-19 pandemic, organized criminal groups have treated mail theft as a low-risk, high-reward crime, and stolen checks are frequently sold online or funneled into organized fraud rings (AFP / Truist analysis, 2025).

Wash it. This is the signature technique of the current wave. A check written in standard ink is treated with common household solvents — acetone, bleach, even nail polish remover — which dissolve the ink without damaging the paper fibers. The thief then rewrites the payee line and the amount in a different hand or printer. The bank receives a check that is, forensically, the original paper with the original routing numbers: it reads as legitimate because the substrate is legitimate. It is low-tech, cheap, and devastatingly effective (ConsumerAffairs, April 2026).

Forge it. Counterfeit checks skip the mail entirely: the fraudster prints a check using the victim's routing and account numbers, often harvested from a single stolen statement or a prior payment. BEC (business email compromise) variants reroute legitimate payments — a vendor email impersonation that swaps in new wiring or check-payee instructions — and AFP found BEC was the number-one avenue for attempted and actual payments fraud in 2024, cited by 63% of respondents, with vendor-imposter fraud jumping 11 percentage points year over year (AFP, 2025).

Once altered, the check is deposited — in person, at an ATM, or by remote deposit — into accounts the criminals control, and the funds are withdrawn or wired out within hours. Then FinCEN's red-flag list, published with the U.S. Postal Inspection Service, describes the pattern banks are told to watch: non-characteristic large check amounts to a new payee, and a customer complaining that a mailed check was never received (FinCEN / USPIS alert, February 2023).

The check-fraud lifecycle in five steps: mail theft, chemical washing and alteration, negotiation by remote or in-person deposit, rapid cash-out — and the books, where reconciliation flags the mismatch between issued and cleared amounts

The uncomfortable corollary: because the washed check is real paper, it will clear. Positive pay and payee positive pay exist precisely because the banking system cannot reliably distinguish a washed check at presentment speed — the defense has to come from the payer's own data. Which brings us to the document sitting on the bookkeeper's desk.

The second front: forged statements

The statement fraud story runs in the other direction — not money leaving the business, but documents manufactured to look like the business (or a borrower) is healthier than it is. This is where "document authentication" stops being a bank problem and becomes a firm problem, because bookkeepers, lenders, and underwriters all read the same PDFs.

The cases are recent and blunt:

  • Kenneth Blair (DOJ, Middle District of Florida, 2026): sentenced to 30 months in federal prison for bank fraud after preparing fictitious pay stubs and altered bank statements showing "vastly overstated account balances" to qualify unqualified borrowers for loans. He ran the scheme from 2020–2021 — and then ran it again in 2025, falsifying pay slips from a Daytona Beach logistics firm to land a $305,000 wrongful Georgia home loan (justice.gov).
  • The $7.3M FHA/VA scheme (DOJ, Northern District of Texas, 2026): defendants allegedly produced falsified bank statements at a recruiter's request for loan-qualification files in Texas and Oklahoma; HUD has already paid more than $493,499 in partial FHA-insurance claims (justice.gov).
  • Jason Motter (DOJ, Middle District of Pennsylvania, 2026): presented bank statements altered to increase balances by more than $400,000 to secure a $773,000 residential loan — which the bank disbursed. An internal bank audit, not the underwriting process, discovered the fraud. He was sentenced to 21 months (U.S. Attorney's Office, via York Daily Record, August 2026).

And the trend is accelerating because the tools are democratizing. National Mortgage News (July 2026) reports bankers warning that AI-generated receipts, pay stubs, and forms now "appear legitimate upon review," driving a rise in expense-account and underwriting fraud — and calling for enhanced auditing and verification tools. Fake documents predate AI (Fannie Mae warned in 2018 about a three-year phony-employer scam), but the cost of producing a convincing forgery has collapsed.

The oldest lesson is the most durable. When Parmalat collapsed, auditors had received a faxed Bank of America confirmation of a $4.9 billion account that was fake — a Parmalat employee had scanned the BoA logo to build the letterhead. The standing guidance for auditors ever since: any critical evidence obtained from the client and printed from a computer — confirmations, statements — may be fictitious and demands heightened professional skepticism. Bank statements obtained directly from the bank outrank client-provided ones in the reliability hierarchy (The CPA Journal, 2005). The bookkeeper who files a client-forwarded PDF without a second thought is sitting at the bottom of that hierarchy.

How professionals authenticate documents

Document authentication is not one tool. It is a stack of checks, each one cheap, each one closing a different door. Here is what the stack looks like for a firm, in order of leverage:

1. Payee positive pay — the single highest-leverage check control. Standard positive pay compares the check number and amount presented at the bank against the issuer's file of issued checks; a mismatch gets flagged for review before it clears. Payee positive pay adds the payee name to the match. A washed check with a rewritten payee sails through standard positive pay (the number and the amount... well, the amount usually changes too, but amounts can be fudged within tolerance) and dies on payee positive pay. Frank Abagnale's endorsement of positive pay as "probably the best technology in the world to prevent forgery" was earned in the forgery trade. With adoption at 35%, recommending it to every check-writing client is the easiest advisory conversation a firm can start.

2. Verify the statement's arithmetic. Every genuine bank statement must foot: opening balance + the signed transaction amounts = closing balance, with per-row running balances as a second chain. Practitioners who do document forensics treat this as the built-in proof of extraction — and of authenticity. A forged or edited statement almost always breaks the chain somewhere, because forgers edit balances and forget to re-foot the running totals. This is also the test that statement-OCR pipelines run before trusting an extraction: no arithmetic agreement, no evidence.

3. Prefer direct-from-bank evidence. The reliability hierarchy runs: direct bank feed (API/Plaid) > bank portal download by the firm > statement forwarded by the client > statement handed to the firm in paper or screenshot form. Every hop away from the bank is a hop toward the forger. A firm that pulls statements itself — or receives them through a direct feed — has removed the entire "altered PDF" attack class for that account.

4. Match the issued check register against presentment. This is the bookkeeper's home turf: the register says check #4121 went to Apex Electric for $1,200; the statement says check #4121 cleared to R. Mason for $12,000. Payee, amount, number, endorsement — any one of them can be the tell. This comparison is what the reconciliation does, which is why reconciliation cadence is a fraud control (more on that next).

5. Run the red-flag list on exceptions. FinCEN's alert names the tells explicitly: non-characteristic large check amounts to a new payee; a customer who says a mailed check never arrived; checks deposited by remote capture into new accounts with rapid withdrawals. A firm doesn't need software to check these — it needs a checklist and five minutes during the review.

One note on trust, since it cuts both ways: in the 2026 Financial Cents survey of 486 North American accounting professionals, 26% of non-AI-using firms cited accuracy and trust in outputs as their biggest barrier to AI adoption — and separately, 96% of AI use is happening in general-purpose chatbots outside audit-trailed systems. The same skepticism that slows automation should be pointed at client-provided documents: trust the arithmetic, trust the bank's channel, and verify everything else.

The 72-hour problem: detection speed is the control

Here is the timeline that should change how firms think about reconciliation cadence. A washed check's life runs on days, not months:

Day 0: the check is mailed. Day 1: it is stolen and washed. Day 2: it is rewritten and deposited by remote capture. Day 3: the funds are gone. A monthly reconciliation finds the mismatch on Day 30 — roughly four weeks after the money left, when recovery is a long shot and the trail is cold.

A washed check's first 72 hours: mailed on Day 0, stolen and washed on Day 1, re-written and deposited on Day 2, funds withdrawn on Day 3 — against a monthly reconciliation that finds it on Day 30

This is not hypothetical urgency. The ACFE's 2024 data puts the median fraud case at 12 months before detection — and for check tampering specifically, the scheme bleeds at a median $8,600 per month while it runs. Every week a reconciliation lags is another week of velocity.

The firm-level implication is direct: reconciliation cadence is a fraud control, not an accounting chore. Daily bank review of cleared items — even a five-minute scan of yesterday's presentments against the issued register — moves detection from Day 30 to Day 1 or 2, inside the window where a bank can still reverse, hold, or investigate. Positive pay achieves the same thing at presentment time without the human scan. The month-end reconciliation then becomes the backstop: the control of last resort that must never be the control of first resort.

Firms should frame this to clients as what it is — a service, not a scolding. "We review your cleared checks every morning" is a sentence that justifies a retainer. The data supports the pitch: with 76% of organizations facing fraud attempts and only 35% running positive pay, the client is far more likely to be unprotected than protected, and the firm is the one who would notice first.

Five controls every firm should run

Putting it together, here is the practical control set — each one cheap, each one documented, each one something a firm can start this month:

1. Recommend payee positive pay to every check-writing client. Not positive pay — payee positive pay, the variant that matches the payee name. It is the highest-leverage single control against check washing, and adoption is low enough (35%) that the recommendation is genuinely valuable advice. Track which clients have enrolled and which haven't; the ones who haven't are your concentration risk.

2. Review cleared checks on a daily or weekly cadence, not just monthly. The register-vs-statement comparison is the detection engine. Move it earlier than month-end for any client writing material checks. Even a scan of "checks presented yesterday vs. checks issued" catches a washed check inside the recovery window.

3. Keep the issued-check register complete and timely. Positive pay, payee positive pay, and the register-vs-statement match all depend on one unglamorous input: every issued check recorded, with the correct payee and amount, before it clears. A firm that posts checks days late has no positive-pay file worth sending and no register worth reconciling. Discipline here is the whole game.

4. Authenticate statements before relying on them. Run the arithmetic (opening + activity = closing; running balances continuous), prefer direct-from-bank sources over client-forwarded PDFs, and treat any statement that doesn't foot as a hard stop, not a data-entry task. Flag the coverage: which account-months are verified, which are client-provided and unverified, which are missing.

5. Verify vendor payment changes out-of-band. BEC and vendor-imposter fraud — up 11 percentage points in a single year per AFP — defeat every document control because the document is legitimate; the instructions are the fraud. Any change to a vendor's payment instructions gets a callback to a known number, not a reply to the email that announced it. This one is free and it stops the scheme class that grew fastest in 2024.

Worked example: the moment the books catch it

Make it concrete. Harbor & Vine Landscaping mails check #4121 to Apex Electric LLC for $1,200.00 on September 18, paying the August irrigation invoice. The check is stolen from a collection box, washed, and rewritten: payee R. Mason, amount $12,000.00. It is deposited by remote capture on September 21 and clears on September 22.

On September 23, the firm's daily review compares the issued register against yesterday's presentments:

FieldIssued registerBank statementResult
Check number#4121#4121Match
PayeeApex Electric LLCR. MasonMISMATCH
Amount$1,200.00$12,000.00MISMATCH

Two fields trip. Under payee positive pay, this would have been held at presentment for a pay/return decision. Under standard positive pay, the amount mismatch alone would have flagged it. Without either, the daily register-vs-statement scan catches it on Day 5 — inside the window where the bank's fraud team can still act. The monthly reconciliation would have found the same two mismatches on Day 30 — as a historical fact, not a recoverable event.

The moment reconciliation catches a washed check: the books show check #4121 to Apex Electric LLC for $1,200.00; the statement shows #4121 to R. Mason for $12,000.00 — payee and amount mismatches surface as an exception for human review

The math of the save: one caught check at $10,800 of avoided loss is more than a decade of bookkeeping fees for most small clients. Fraud controls are the rare advisory line where the ROI is a single event, not a trend.

Where LedgerHQ fits — and where it doesn't

A candid section, because the honest placement matters more than the sale. LedgerHQ does not market a fraud-detection feature. There is no risk score, no "fraud alert" product, no document-authentication claim on the site — and this article will not invent one. What LedgerHQ does provide is the control infrastructure on which the five controls above run:

The reconciliation is the control, and Tally works it continuously. LedgerHQ's docs define reconciliation exactly the way this article has used it: "Reconciliation confirms that a bank or credit card register agrees with a statement ending balance," and the session is finished "at zero difference" (ledgerhq.ai/docs/modules/banking, verified October 2026). The pricing page describes the division of labor in one line: "Tally clears the matching activity and shows the remaining difference" — coding the bank activity, working the reconciliations, asking for whatever is missing, and handing over finished financial statements (ledgerhq.ai/pricing, verified October 2026). The matching is automated; the exceptions are human. That exception queue is precisely where a washed check, an altered payee, or a statement that won't foot becomes visible — because everything that matched cleanly is, by definition, not the fraud.

The statements workspace is built for the authentication question. "Statement PDFs and uploads live in the Statements workspace. LedgerHQ can store Plaid-provided statements, firm uploads, and client uploads. OCR/extraction reads structured statement data when available, and statement coverage policies track which account/month periods are verified, received unverified, mismatched, waived, or missing." Note the deliberate distinction the docs draw: "Statements support reconciliation and close, but they are not the reconciliation itself. A verified statement period means the firm has statement evidence. It does not mean the register is already reconciled." A firm can see, per account per month, whether it holds verified statement evidence — and which periods are client-provided and unverified, which is exactly the reliability-hierarchy question from the Parmalat lesson.

The issued-check data feeds the bank's controls. Positive pay needs an issue file; the issue file is the books. Because bank activity — purchases, deposits, transfers, bill payments on bank-linked accounts — creates register rows as it posts (ledgerhq.ai/docs/modules/banking), the record of what the client actually issued stays current without a separate export ritual. The bank does the presentment matching; LedgerHQ keeps the ground truth accurate.

What this means for a firm evaluating the platform: LedgerHQ is $20 a month per business with Tally's AI use included — free until January 1, 2027 (ledgerhq.ai/pricing) — and what that price buys in this context is the daily control surface: the reconciliation worked continuously, the statement evidence tracked per period, and the exceptions surfaced for the one judgment no software should make alone. The fraud expertise stays with the bookkeeper. The machine's job is to make sure the bookkeeper actually sees the moment.

FAQ

Is check fraud really still growing? Everything is digital now.

Yes, and the digital shift is part of the cause. Checks are fewer but each one carries more value to a thief, and the mail is a soft supply chain. AFP's 2025 and 2026 surveys show check fraud hitting 63% and then 58% of organizations across two consecutive years; Bank Director's 2025 survey found check fraud up nearly 400% at banks. 91% of organizations still use checks — the payment method isn't dying, it's just less defended than it used to be.

My clients barely write checks. Does any of this apply to them?

The register-vs-statement discipline applies to every payment method: ACH, wires, and card payments all reconcile the same way. And the forged-statement front — altered PDFs for loans, investor decks, or tax filings — doesn't need a single check. If your clients receive statements or documents from counterparties, authentication is your problem regardless of how they pay.

Will positive pay annoy my clients with daily exception reviews?

In practice, no — exceptions are rare for clients with clean issuance data, and the review is a same-day yes/no on a handful of items. The friction clients actually complain about is the fraud, not the control. Frame it as insurance they review for thirty seconds a day: most never see an exception, and the one who does is the one who needed it.

Can a bank statement PDF be faked well enough to fool OCR?

Yes — and that is exactly the point. OCR reads what's on the page; it doesn't verify the page is genuine. AI-generated statements now "appear legitimate upon review" (National Mortgage News, July 2026). The defenses are the statement's arithmetic (opening + activity must equal closing), the source channel (direct from the bank beats client-forwarded), and the coverage tracking that flags unverified periods.

Should the firm be liable if fraud slips through?

That is a legal question for the firm's engagement letter, not a software article — but the operational answer is that a documented control set (daily review cadence, positive-pay recommendations, statement authentication, out-of-band vendor verification) is both the best protection for the client and the best evidence the firm met its standard of care. Document the controls you run; they are the answer to the question nobody wants to ask after the fact.

Does LedgerHQ detect fraud?

No — and beware any bookkeeping platform that claims to. LedgerHQ automates the matching and surfaces the exceptions; the judgment stays with the bookkeeper. What it gives you is the control surface: continuous reconciliation, per-period statement evidence tracking, and an accurate issued-check record that feeds the bank's own presentment controls.

Sources