The Art of the Steal

  I told you about how forgers use Scotch tape to remove information off laser-printed checks. To solve this problem, when you buy laser paper for your checks you need to ask the supplier if it has “toner anchorage.” Sometimes this is called “LaserLock” or “Toner Lock.” This is a chemical that is put in the paper during the paper-making process to ensure that documents printed on a laser printer are secure. When the toner is applied, the chemical that is already in the paper is activated by the heat process and when the chemical and the toner mix, the toner is locked to the paper. It’s impossible to scrape it off and tape won’t remove it.

  When you print checks, you should remember to use a font that is 12-point or higher. If you use small type, there’s a lot less toner to take off. It’s easier to remove with a piece of tape. If there’s some residue, a forger just uses a bigger font to cover it up. A large font is less likely to be tampered with. It would take a forger all day with Scotch tape to remove the toner, and the process would leave a bigger area to cover up if anything does remain.

  There are so-called “secure-number fonts” that make tampering with check dollar amounts impossible. Secure-number fonts are software that is loaded into your printer so that the dollar amounts print in a style that can’t be altered. For instance, in the dollar amount box, the program reverses the toner, sending it to the back of the paper, so that numbers print white against a black background, and the toner background is permanent. The program will also print each numeral of a number in a different style, so that numerals can’t be moved to change the amount. A secure-number payee font that does the same thing for the payee name is available as well.

  A lot of times we number checks with a red ink or a black ink, and ink is removable. So I number checks with dye. It bleeds through the paper to the back of the check, and it stays on the check for the life of the check. This is known as dual-image numbering (in Canada, it’s called halo numbering), because you can see the number on both sides of the check, and it makes alteration nearly impossible.

  Very often, I encounter companies that are more interested in company image than inventory control. All they have is blank-check stock with their company logo printed on the paper, handsomely done in four color up on the left-hand corner. Everything else is blank.

  I always say to the company representatives, “What if I put one of these blank pieces of paper in my pocket? How would you know I had it?”

  “Uh, we wouldn’t.”

  “Well, think about that,” I say. “I’ve just walked out of your company with your check. I’ve got a laser printer at home. All I’ve got to do is run it through the printer.”

  If all your company is going to do is have its logo on blank-check stock, you should ensure that inventory check numbers are on the back of each page. That number will allow you to control your unprinted check inventory.

  One of the most basic and effective security features you can build into your checks is called a “void pantograph,” which is printed in the background of a check. The way it works is the word “void” is put into the background in a dot pattern that isn’t visible to the human eye. However, when a check with a void pantograph is copied or scanned, the word “void” appears along with it.

  Look closely at some checks and you’ll see what are called laid lines, which are evenly spaced lines on the back of the paper. I always put them on checks I design, because if someone takes a razor and slices the check and alters it, I want to know about it. Enhanced laid lines were introduced in 1997 that are similar in intent, but they use unevenly spaced lines and afford an even higher level of protection.

  Another relatively new security feature is thermochromic inks, which disappear or, in some cases, change color when they react to heat and moisture. They will actually fade and then reappear again. Thermochromic ink can be found on the back of a check in a pink strip beneath the endorsement. Or it can be found on the front of the check in a corporate logo or seal. Run your finger over it and the heat from your finger will cause it to vanish. Let go, it comes right back. Day after day, year after year, just touch it and it disappears and then comes right back.

  Other worthwhile antifraud techniques include artificial watermarks, messages that are visible only when the check is held at a 45-degree angle and aren’t picked up by copiers and scanners; warning bands, which are statements printed on checks that point out design elements to look for (no warning band is any good unless you add the words, “Do not cash,” “Do not accept,” or “Do not negotiate” before or after the warning); and microprinting, a technique where words or phrases added onto the check in letters so small they are legible only under a magnifying glass. It used to be that microprinting could only be done in a straight line, but circular microprinting is now possible so you can put messages in as logos, or pictures.

  Companies always ask me, “Well, we buy two hundred thousand checks a year, or a million checks a year, or two million, how much more will these things cost me if I incorporate them?” The answer is very little. With that kind of volume, adding these features won’t add much cost. One other thing that I tell businesses is you need to secure all of your checks, not just some of them. All the time, I encounter companies that use secure features in payroll checks and accounts payable checks, but not in refund checks.

  “Why not?” I ask them.

  “Oh, they’re always for small amounts,” they say.

  Their policy should be the exact opposite. Payroll checks go to employees who you know. Accounts payable checks go to vendors who you know. But refund checks go to complete strangers. They’re the checks most in need of protection. Unfortunately, what criminals do today doesn’t enter a comptroller’s mind until his company suffers a loss.

  BUT DO THEY WORK?

  Believe me, these features really work. In 1993, Imperial Bank in California hired me to redesign its company check. The bank was having big problems with check fraud—to the tune of $3 million a year. I came in, and working with the printer, gave them some security features and helped them tighten their internal controls. The bank began to offer the new check to its customers at the same price as its regular check. It looks just like a regular check, and comes in a lot of colors and styles. The check-fraud losses fell to about $120,000 by 1996, a 96 percent decrease after three years of using the new check. This check is called SafeCheck, and is manufactured by a company that goes by the same name.

  People often come up to me and say, You design these secure checks for corporations, why don’t you design a check for me, the consumer? So I’m working to produce a secure consumer check. It will have twelve security features, including paper that reacts to twenty-four different chemicals, high resolution borders that are difficult to duplicate, white “chemical-wash detection boxes” that change colors with chemical tampering, and embedded fibers that glow under ultraviolet lights. But I’ve also told the manufacturers that whenever it takes an order, it has to verify the order with the person’s bank. If someone changes his address, that has to be verified. It makes no sense to create a secure check if any criminal can order it.

  When I design a check, I follow a little routine. I send a sample to three places: a graphics house in Australia, an Australian forensic document examiner, and a U.S. institute of technology. I ask each of them to create their best replica, so I can test how secure it is. At the institute, they select a smart student and give him access to the most sophisticated computer equipment, literally millions of dollars of gear. The last check I sent there, the student took a month’s worth of manhours to produce a good replica. That told me I had a great check. As I’ve said, nothing is foolproof, but if it takes a clever student a month with millions of dollars of equipment to produce a counterfeit, I know few criminals have a prayer.

  The other thing I learn is which features work best. Lately, I’ve been working with prismatic printing, which puts a multicolored, rainbow-like background on the check. It’s very difficult to photocopy.

  YOUR FIRST LINE OF
DEFENSE IS YOU

  If we’re ever going to stop fraud, everyone has got to become a bit more vigilant. My guess would be that half of all Americans don’t bother to reconcile their bank statements. They don’t even open them. And what they don’t realize is that they’re liable for errors, because they generally have thirty days to notify their bank of a discrepancy, and sometimes less than that. Let’s say I did get hold of your check and I filled it out for $2,000, and you never bothered to look at your bank statement. A month or two later, your husband says, “Hey, we’re overdrawn at the bank.” You say, “That’s impossible. I’ve got $2,000 in the account.” The bank says, “Oh no you don’t, you’re overdrawn.” Now you go back and open that envelope and discover a check for $2,000 that you didn’t write. You didn’t sign it. Guess what? It’s too late. The bank is not going to restore your money. But most people don’t realize this until it happens to them.

  A Wisconsin man named Borowski had two checking accounts with Firststar Bank. One was his personal account and one was for his father’s estate. Borowski said that his fiancée stole $50,000 from his account, and $100,000 from the estate account. She did it with forged checks and unauthorized telephone transfers. She even left forged handwritten notes in the bank’s night depository box requesting cashier’s checks. When the monthly bank statements and $20,000 in cashier’s checks were sent to Borowski, his fiancée intercepted them. When Borowski discovered the theft, he sued the bank to get his money back. Presumably, he also called off his impending marriage.

  The case went to court. The bank pointed out that Borowski’s signature card agreements required notification to the bank of unauthorized checks within fourteen days of the statement date. Borowski said he hadn’t received the statements, because his fiancée got hold of them and lied about them.

  The court ruled in favor of the bank. It said that as long as the bank had mailed the statements to the customer’s proper address, it had upheld its part of the bargain. The court did rule in favor of Borowski on the $20,000 in cashier’s checks, however, because the bank didn’t include the handwritten notes with the bank statement.

  GET GOOD BACKUP: POSITIVE PAY

  There is a product out in the marketplace, and already about 60 percent of the nation’s major banks offer it. It’s called positive pay. I feel that positive pay is the greatest concept available to deal with the problem of forgery or fraud. In most cases, the bank provides it for a minimal fee. If it doesn’t, look on it as an insurance premium to guard against losses from fraud.

  The product is really quite simple. Say I’m a company and I write fifty checks a day. I could write five a day or five thousand a day, it doesn’t matter. At the end of each day, I download a list to the bank over my modem of all the checks I wrote that day and sent out in the mail. The list, called an issue file, simply runs through each check number and the amount of the check. The bank doesn’t want to know who I wrote the check to.

  The file goes down to the bank and is stored in a program called positive pay. The checks go out in the mail and, lo and behold, a forged check shows up. I wrote a check to a guy for $250 and he color-copied fifty of them. I don’t care. I’m on positive pay. I wrote a guy a check for $200 and he altered it to $2,000. I don’t care. I’m on positive pay. The point is, when the forger goes to cash that check, it will go to the first bank of deposit, and then it will come to your bank. But because that check doesn’t match a check on your list, it will be rejected. No match, no pay. If you didn’t write it, the bank isn’t going to pay it. The computer will say, I have one refund check for $250, but I don’t have fifty, so I’ll pay one and return forty-nine. I have one check for $200, but I’ve searched the file and I don’t have one for $2,000, so it returns the check unpaid.

  Now there are some small businesses that love the idea of positive pay, but they don’t have a computer. I ask them, Do you have a fax machine? Yeah, they have that. Well, your bank can put you on reverse positive pay. At eight-thirty in the morning, your bank will fax you a list of all the checks written by you that came into the bank last night to be paid today. You’ll have until two-thirty that afternoon to look over that list. If everything looks fine, you don’t have to do anything, just throw the list away. But if you find a discrepancy, you call the bank and tell them to fax you that check. If you look at it and it’s not your check, you tell the bank not to pay it.

  This product literally does away with the threat of forged checks, altered checks, stolen checks, and counterfeit checks. And positive pay is also on the bank’s teller line. So if I had taken your checks and they were drawn on, say, the Chase Bank, I would obviously go to a Chase branch to try to cash it. But when I go up to a teller at a Chase Bank and present a check, the teller would pull it up on the screen and say, “Sir, this check was never issued as of noon today. The company never wrote this check, so what is this?” So you’re stopped cold right at the teller.

  One of the most common questions I get about positive pay is, what if I send Frank Abagnale a check for five thousand dollars but a postal employee steals the check and Frank Abagnale never gets it? The employee types above my name, Bill Clark, and goes and cashes the check. The check number is the same and the amount of the check is unchanged. How will positive pay catch that?

  It won’t, but it’s not meant to. That’s because that is an altered payee, and under banking law, altered payee checks are the liability of the first bank of deposit, not your liability or your bank’s liability.

  Like any technology, positive pay is not foolproof. I recommend companies use both positive pay and a very secure check to close the loop, lock the lock, and throw away the key.

  WAITING FOR THE PAPERLESS TOILET

  A lot of companies and consumers figure, why worry too much about checks? With computers and debit cards, they won’t be with us that much longer. Well, anyone who thinks that checks are going away is dead wrong. People are always asking me, “When are we going to see the paperless society?” I tell them, “When you see the paperless toilet. No time soon.”

  I’ll be long dead, even if I live to a ripe old age, before checks will ever disappear. The amount of checks we write is growing at a rate of more than a billion checks a year. So they’re not even declining in use. They’re growing. I remember fifteen years ago, when we were writing 40 billion checks a year, people said it would never reach 50 billion, and now we’re at almost 70 billion.

  People happen to like checks. They’re familiar. Many consumers will say, “I like this check. It has some float to it. I like that much better than when the bank immediately goes into my checking account and takes the money out. I also like the idea that I can get the check back and see who I wrote it to and have a record of it.” And we have a very large generation that is not comfortable with smart cards and electronics. They’re leery of new ways of payments, and they don’t fully grasp them.

  Electronic banking is still much more of an unknown frontier. And there’s no forgetting the billions of dollars that banks have invested in electronic readers, sorters, and other check processing equipment. We’re not going to just scrap it and plow money into home banking. There are banks out there pushing electronics, but there are a lot of other banks that would just as soon stay with checks.

  So if we’re going to continue to use checks, you had better learn how to protect yourself. After all, awareness is 99 percent of solving the problem. The moment you accept the fact that fraud and forgery are so easy to accomplish, that’s the moment you’ve taken the first step toward combating it.

  3

  [COUNTERFEIT CAPERS]

  I once was interviewed about fraudulent documents by Sam Donaldson of ABC television. During the interview, I dug into my briefcase for a moment and pulled out a piece of paper. I handed it to him and said, “By the way, have you seen this letter?” He studied the sheet of paper and his eyes got very wide. “Wait a minute, where did you get this?” he said.

  It was a letter of reference on ABC stationery
, extolling the many virtues of Frank Abagnale. It was signed by Sam Donaldson.

  “You sent me a letter two days ago confirming our interview,” I said. “I scanned the ABC letterhead into my computer. I matched the paper—it was just standard linen paper—with paper I bought at the local stationery store. Then I wrote the new text and printed it out.”

  “But what about my signature?” he asked.

  “I scanned that off your letter, too,” I said.

  That was just a fun thing I did to illustrate a point. But I’m far from the only one doing it. We’re literally awash in phony documents, and I’m not talking simply about those fake IDs that teenagers buy in Times Square to allow them to purchase beer and gain entrance to clubs. Counterfeit documents of every imaginable kind have proliferated: birth certificates, death certificates, Social Security cards, driver’s licenses, store receipts, medical prescriptions, product labels, traveler’s checks, event tickets, amusement park passes, coupons, car titles, green cards, diplomas, college transcripts, passports, voter identification cards, and, the most counterfeited piece of paper of all, money itself. Almost anyone can professionally forge or counterfeit a wide variety of documents, day after day, for an investment of just a few thousand dollars.

  Because so much fake paper is floating around, I caution managers that when they hire someone for a sensitive position, it’s more than credentials that they need. They have to make phone calls. They have to write letters. Don’t trust a piece of paper, because anything can be replicated. Just ask Sam Donaldson.

  It’s gotten so bad, even the FBI is changing its credentials. Since the days of Hoover, they’ve had the same ones—reused. When an FBI agent retires, he turns in his credentials and a new agent receives them. Now the agency is redoing them with holograms to make them harder to counterfeit.