Nearly every explanation of this scam stops at “the check is fake.” The part that actually costs people is what happens afterward, at their own bank — and almost nobody is told about it until it is already happening.
A deposited check can appear in your balance and still be fraudulent. Banks generally must make funds available within a day or two, but may take weeks to discover a check is bad. If it is, you owe the bank the amount — the FTC says so plainly — and the bank can take it back out of your account. Any check that arrives with instructions to send part of the money onward is a scam, every time.
People look for a fake check the way they'd look for counterfeit money — searching the paper for something wrong. That is the wrong instinct, because the forgery is usually excellent. Modern fakes are drawn on real accounts at real banks and reproduce genuine security features. Tellers pass them. Mobile deposit accepts them.
What makes the scam work is timing. Two different things happen to a deposited check, and they happen weeks apart:
Between those two moments, your balance shows money that is not yours. The scammer's only job is to get you to send some of it onward inside that window. As the FTC puts it, by the time the bank learns the check was bad, the scammer has the money you sent — and you are the one repaying the bank.
“The check cleared” is not a fact you can rely on. In everyday speech it means the money showed up. At the bank it means something else entirely, and the difference is the whole scam.
One detail worth knowing, because it is the closest thing to a reliable tell: the scammer often asks which bank you use.
It sounds like ordinary logistics. It is not. A check drawn on the same bank where you deposit it can frequently be verified almost at once, which would collapse the scheme before any money moved. By steering around your bank, the scammer protects the delay the whole thing depends on. If a stranger sending you money wants to know where you bank, the question itself is the warning.
Two more that hold up:
The story changes; the structure never does. In every version you receive more than you are owed and are asked to pass part of it to a third party.
If you remember one sentence from this page, make it this one: a genuine payment never requires you to send part of it somewhere else. No employer, client, buyer or agency works that way. When that instruction appears, the transaction is fraudulent regardless of how convincing everything around it looks.
This is the part that tends to arrive as a shock, because the warnings usually stop before it.
None of this is meant to frighten anyone into silence — it is the argument for the opposite. The difference between a victim and a suspect is very often just who spoke first. Reporting it yourself, early and in person, is the single most useful thing available to you.
Do this in order. Speed matters more than dignity, and embarrassment is the thing that costs people the most money in this scam.
If you have not sent anything onward yet, you are very probably fine. Stop there and go to step 2.
One thing to expect: anyone who contacts you offering to recover the money for a fee is running the follow-up scam. It targets people who have just been defrauded precisely because they are desperate, and it is remarkably effective. No legitimate recovery service finds you.
Almost every version of this begins in an inbox — a job offer, a client inquiry, a buyer, a landlord. The check is the second act. By the time paper is involved, the persuasion has already been done in writing, over days, by someone patient.
That is the part a spam filter is not built to catch. A message with no link, no attachment and no malware, sent from a real account by a real person, is technically clean; it is the intent that is wrong. Reading for intent, across a conversation rather than a single message, is what a monitoring service does — and it is the difference between catching this at the offer and discovering it at the bank.
Sources & further reading: U.S. Federal Trade Commission, How To Spot, Avoid, and Report Fake Check Scams and the FTC's fake check scams resource hub · report fraud at ReportFraud.ftc.gov and IC3.gov. General information, not legal or financial advice — your bank's own terms and your state's law govern your account.
No, and this is the single most damaging misunderstanding about this scam. Banks generally have to make deposited funds available to you quickly, often within a day or two, but it can take weeks for the bank to learn that a check is fraudulent. “Available” means you can withdraw it. It does not mean the check has been verified, and it does not mean the money is yours. The gap between those two things is not a loophole in the scam — it is the entire mechanism of it.
Yes. The Federal Trade Commission is explicit that if you deposit a check that turns out to be no good, you are responsible for repaying the bank the amount of the check. The bank can take the money back out of your account, and may also charge you a fee. This is true even though you were the victim, and even though you never knew the check was fake.
It can. From the bank's side, an account that deposited a forged instrument and quickly moved money out looks like the pattern of a scam, and banks may close accounts on that basis. A closure for suspected fraud can also be reported to a deposit-account screening bureau such as ChexSystems, which other banks check when you apply, so it can make opening a new account harder. This is why reporting it yourself, in person and early, matters so much.
Often you cannot tell by looking, because modern forgeries are drawn on real accounts at real banks and reproduce genuine security features. Judge the situation rather than the paper. A check that arrives with instructions to send part of the money onward is fraudulent essentially every time, whatever it looks like. So is any check for more than you are owed, any printed or emailed check image, and any request paired with urgency.
So that the forged check is not drawn on your own bank. A check drawn on the same institution where you deposit it can often be verified almost immediately, which would end the scam before any money moves. By steering around your bank, the scammer preserves the delay the scheme depends on. If someone sending you money asks where you bank, treat the question itself as the warning.
Family Sentinel reads every message in a monitored inbox and flags the dangerous ones before anyone has to judge them — then warns a person you choose. Read-only, and never able to send or delete.