Xiaomi has just given a global launch to two of its latest flagship phones, the Xiaomi 17 and 17 Ultra, along with a Leica-branded Leitzphone edition of the Ultra. There’s no sign, however, of the 17 Pro, which launched in China with an additional display mounted next to the rear cameras.
Technology
Check washing crisis fueled by AI and mail theft
Once considered an old-fashioned crime, check washing has roared back to life with alarming sophistication.
Criminals are not just targeting personal checks anymore. They are exploiting every vulnerability in the mailing and banking system to cash in on stolen funds.
As check fraud incidents continue to rise sharply across the country, it is more important than ever to understand how check washing works and what you can do to protect yourself. Here is what you need to know to stay ahead of the scammers.
JOIN THE FREE CYBERGUY REPORT: GET MY EXPERT TECH TIPS, CRITICAL SECURITY ALERTS, AND EXCLUSIVE DEALS — PLUS INSTANT ACCESS TO MY FREE ULTIMATE SCAM SURVIVAL GUIDE WHEN YOU SIGN UP!
A pen placed on top of a blank check (Kurt “CyberGuy” Knutsson)
What is check washing fraud?
Check washing fraud happens when a scammer steals a check you have written, erases the ink using chemicals like acetone or nail polish remover, and rewrites it to a new recipient. Often, they will change the amount to something much higher. The altered check is then deposited or cashed, and the funds are drained from your account before you even realize something is wrong.
Why it’s dangerous:
- Check washing does not require much technical skill.
- It can happen with checks you leave in your outgoing mail.
- Even mailed bill payments are vulnerable if not handled securely.
FBI WARNS OF SCAM TARGETING VICTIMS WITH FAKE HOSPITALS AND POLICE
Unlike digital fraud, check washing often goes unnoticed until long after the damage is done. Because checks can take days or even weeks to clear through the banking system, criminals have plenty of time to deposit altered checks and move funds before victims realize anything is wrong.
By the time the missing money is discovered, tracing it back to the scammer can be extremely difficult. This delay makes it critical to monitor your accounts closely and act quickly if you spot any suspicious activity.
Illustration of check fraud in progress (Kurt “CyberGuy” Knutsson)
FBI WARNS OF SCAM TARGETING VICTIMS WITH FAKE HOSPITALS AND POLICE
How check washing has gotten worse
Since 2023, check fraud has exploded in the United States.
The surge in fraud reports reflects more than just isolated criminal acts. Organized crime rings are increasingly turning to check washing as a hybrid crime, blending old-school mail theft with new digital tools like AI. Fraudsters now use advanced technologies to forge identities, alter check images and exploit gaps in banking security, making check washing more sophisticated than ever. As financial institutions strengthen cybersecurity defenses, scammers are targeting physical mail systems as a weaker link to bypass digital barriers.
Real examples:
- Six people were charged with attempting to steal $80 million through fraudulent checks tied to COVID-19 relief funds.
- In Florida, a former mail carrier pleaded guilty to attempting to sell USPS arrow keys and stolen checks totaling nearly $550,000 to an undercover agent, leading to his arrest and confession.
s
New tricks criminals are using
Fraudsters have adapted their methods to stay ahead of law enforcement and banks.
- Mobile deposit fraud: Criminals alter check images or deposit the same check into multiple accounts.
- Synthetic identity fraud: Scammers create fake identities using AI-generated documents to open accounts and cash stolen checks.
- Business Email Compromise (BEC): Attackers impersonate executives or vendors to convince companies to send checks to fraudulent accounts.
Criminals are combining old techniques like mail theft with new digital strategies, making check washing harder to recognize and prevent without proactive security measures. Recent advancements in AI technology have made it easier for scammers to forge realistic-looking documents, generate convincing fake identities and create sophisticated phishing emails.
AI-generated fake IDs and altered check images can pass basic verification checks that would have caught manual forgeries in the past. This shift means check fraud is no longer just a matter of stealing a physical check, but exploiting digital vulnerabilities at every stage of the banking process.
A person going over a bank statement (Kurt “CyberGuy” Knutsson)
THIS IS WHAT YOU ARE DOING WRONG WHEN SCAMMERS CALL
How to protect yourself from check washing fraud
Here are 14 essential protective measures to shield yourself from check washing scams.
1. Use a black gel pen: When writing checks, always use a black gel pen. The ink is much harder to remove compared to regular ballpoint pen ink.
2. Bring checks directly to the post office when mailing them: If using a mailbox, make sure to drop off your mail before the final scheduled pickup so it is not left sitting overnight.
3. Sign up for USPS Informed Delivery: Stay ahead by signing up for USPS Informed Delivery. You will receive digital previews of incoming mail so you can monitor for any missing items early. Learn more about why it’s important here.
4. Monitor your bank accounts: Set up real-time alerts for check clearing and review your statements weekly to catch any suspicious activity. Also, ask your bank about any other fraud-prevention tools they offer to protect your accounts.
5. Switch to digital payments when possible: Use your bank’s mobile app to deposit checks without mailing or physically delivering them, reducing the risk of theft or tampering.
6. Use checks with built-in security features: Choose checks printed on paper with watermarks, chemical-sensitive coatings or other security features that make check washing much harder.
7. Limit the information on checks: Avoid unnecessary personal details. Do not print your Social Security number, driver’s license number or phone number on your checks. The less information available, the less a fraudster can use.
HOW CYBERSCAMS ARE DRAINING AMERICANS WALLETS BY THE BILLIONS
8. Store checks securely: Keep blank checks in a safe place. Store your checkbook in a locked drawer or safe, not in your purse, car or an easily accessible location at home.
9. Check your mailbox security: Install a locking mailbox. If possible, use a mailbox with a lock to prevent thieves from stealing outgoing or incoming mail.
10. Be cautious with endorsements: When endorsing checks, write “For Deposit Only” along with your account number to prevent others from cashing the check.
11. Enroll in identity theft protection with check fraud specialization: Choose services that specifically monitor for compromised check details on dark web marketplaces and alert you to suspicious check-cashing patterns. Identity theft protection services monitor your personal data across the dark web and public databases, alert you to suspicious activity and assist you in locking down your accounts if needed. See my tips and best picks on how to protect yourself from identity theft.
12. Invest in personal data removal services: Minimize exposure of sensitive details (like addresses or banking affiliations) that fraudsters could exploit for check-washing scams. Removing your personal information from these sites can help reduce your risk of becoming a victim. While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap and neither is your privacy.
These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you. Check out my top picks for data removal services here.
13. Shred sensitive documents: Shred old checks and bank statements. Don’t just throw them away. Shred any documents with sensitive banking information.
14. Report suspicious activity immediately: If you suspect check fraud or missing mail, report it to your bank and the U.S. Postal Inspection Service right away.
15. Use Positive Pay if you are a business: Positive Pay is a fraud prevention service offered by most banks to business customers. It works by matching the checks you issue with the ones presented for payment. If something doesn’t add up, like a changed amount or payee, the bank flags it for your review before it’s processed. You usually need to sign up through your bank, and there might be a fee, but it’s a smart way to protect your business from check fraud, especially if you write a lot of checks.
What to do if you are a victim
If you think you have been targeted by check fraud:
Time matters. The faster you act, the better your chances of recovering lost funds.
Kurt’s key takeaways
Check washing fraud is growing rapidly, and criminals are becoming more organized and sophisticated. Simple habits like using gel pens, securing your mail and monitoring your financial accounts closely can make a big difference. Services like USPS Informed Delivery, Positive Pay for businesses and personal data removal tools provide added layers of protection. Identity theft protection services can also offer critical support if you ever become a victim of check fraud.
Have you or someone you know experienced check fraud? Let us know by writing us at Cyberguy.com/Contact
For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter
Ask Kurt a question or let us know what stories you’d like us to cover
Follow Kurt on his social channels
Answers to the most asked CyberGuy questions:
New from Kurt:
Copyright 2025 CyberGuy.com. All rights reserved.
The 17 and 17 Ultra will apparently be available soon in the UK, Europe, and select other markets. The 17 — pitched as a rival to the likes of the iPhone 17 and Samsung Galaxy S26 — will cost £899 / €999 (about $1,200), while the larger and more capable Ultra starts from £1,299 / €1,499 ($1,750). The limited-edition Leitzphone will be substantially more expensive at £1,699 / €1,999 ($2,300), though it includes 16GB of RAM and 1TB of storage, along with a few extra accessories.
The 17 is an extremely capable small-ish flagship, with a 6.3-inch OLED display, Qualcomm Snapdragon 8 Elite Gen 5, and large 6,330mAh silicon-carbon battery (though sadly smaller than the 7,000mAh version launched in China). I won’t be writing a full review of the 17, but did spend a week using it as my main phone, and found that the battery cruised past the full-day mark, though wasn’t quite enough for two full days of my typical usage. That’s far better battery life than you’d find in similarly sized phones from Apple, Samsung, or Google.
The cameras impress too, with 50-megapixel sensors behind each of the four lenses, selfie included. Pound for pound, you won’t find many better camera systems in any phone this size.
1/10
The Ultra, unsurprisingly, takes things to another level. It’s much larger, with a 6.9-inch display, and weighs a hefty 218g. Despite that, the 6,000mAh is actually smaller, though I found it delivered pretty similar longevity.
The enormous camera is, as ever for Xiaomi’s Ultra phones, the highlight. There are 50-megapixel sensors for each of the main, ultrawide, and selfie cameras, with a large 1-inch-type sensor behind the primary lens. The periscope telephoto is even more impressive: 200-megapixel resolution, a large 1/1.4-inch sensor, and continuous optical zoom from 3.2x to 4.3x, the equivalent of 75-100mm. Xiaomi isn’t the first to pull off a true zoom phone — Sony’s Xperia 1 IV got there first in 2022 — but the telephoto camera here is far more capable than that phone’s, with natural bokeh and impressive performance even in low light.
The camera capabilities are supported by Xiaomi’s ongoing photography partner Leica, but it’s the pair’s Leitzphone that really emphasizes that. Slightly redesigned from the 17 Ultra Leica Edition that was released in China last December, this includes Leica branding across the hardware and software, a range of Leica filters and shooting styles, and a rotatable rear camera ring that can be used to control the zoom. It’s the first Leica Leitzphone produced by Xiaomi — after a trio of Japan-only Sharp models — and comes with additional branded accessories, including a case with a lens cap and a microfiber cleaning cloth.
Xiaomi has plenty of other announcements alongside the 17 series phones at MWC this year, including a super-slim magnetic power bank, the Pad 8 and Pad 8 Pro tablets, and a smart tag that supports both Google and Apple’s tech-tracking networks.
Photography by Dominic Preston / The Verge
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.
NEWYou can now listen to Fox News articles!
Free apps are supposed to cost you nothing but storage space. But in this case, they may have cost millions of people control over their own internet connections.
Google says it has disrupted what it believes was the world’s largest residential proxy network, one that secretly hijacked around 9 million Android devices, along with computers and smart home gadgets. Most people had no idea their devices were being used since the apps worked normally, and nothing looked broken.
But behind the scenes, those devices were quietly routing traffic for strangers, including cybercriminals.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
STOP GOOGLE FROM FOLLOWING YOUR EVERY MOVE
Google says it disrupted a massive residential proxy network that secretly hijacked about 9 million Android and smart devices. (AaronP/Bauer-Griffin/GC Images)
How your device became part of a proxy network
According to Google’s Threat Intelligence Group, the network was tied to a company known as IPIDEA. Instead of spreading through obvious malware, it relied on hidden software development kits, or SDKs, that were embedded inside more than 600 apps. These apps ranged from simple utilities to VPN tools and other free downloads. When you installed one, the app performed its advertised function. But it also enrolled your device into a residential proxy network.
That means your phone, computer or smart device could be used as a relay point for someone else’s internet traffic. That traffic might include scraping websites, launching automated login attempts or masking the identity of someone conducting shady online activity. From the outside, it looked like that activity came from your home IP address. You wouldn’t see it happening, and in many cases, you wouldn’t notice any major performance issues.
Google says in a single seven-day period earlier this year, more than 550 separate threat groups were observed using IP addresses linked to this infrastructure. That includes cybercrime operations and state-linked actors. Residential proxy networks are attractive because they make malicious traffic look like normal consumer activity. Instead of coming from a suspicious data center, it appears to come from someone’s living room.
What Google did to shut it down
Google says it took legal action in a U.S. federal court to seize domains used to control the infected devices and route proxy traffic. It also worked with companies like Cloudflare and other security firms to disrupt the network’s command-and-control systems. Google claims it also updated Play Protect, the built-in Android security system, so that certified devices would automatically detect and remove apps known to include the malicious SDKs.
However, Google also warned that many of these apps were distributed outside the official Play Store. That matters because Play Protect can only scan and block threats tied to apps installed through Google Play. Third-party app stores, unofficial downloads and uncertified Android devices carry far greater risk.
IPIDEA has claimed its service was meant for legitimate business use, such as web research and data collection. But Google’s research suggests the network was heavily abused by criminals. Even if some users knowingly installed bandwidth-sharing apps in exchange for rewards, many did not receive clear disclosure about how their devices were being used.
Google’s investigation also found significant overlap between different proxy brands and SDK names. What looked like separate services were often tied to the same infrastructure. That makes it harder for consumers to know which apps are safe and which are quietly monetizing their connection.
300,000 CHROME USERS HIT BY FAKE AI EXTENSIONS
Hidden software inside more than 600 apps allegedly turned phones and computers into internet relays for cybercriminals. (David Paul Morris/Bloomberg via Getty Images)
7 ways you can protect yourself from Android proxy attacks
If millions of devices can be quietly turned into internet relay points, the big question is, how do you make sure yours isn’t one of them? These steps reduce the risk that your phone, TV box or smart device gets pulled into a proxy network without you realizing it.
1) Stick to official app stores
Only download apps from the Google Play Store or other trusted app marketplaces. Some apps hide small pieces of code that can secretly use your internet connection. These are often spread through third-party app stores or direct app files called “APKs,” which are Android app files installed manually instead of through the Play Store. When you sideload apps this way, you bypass Google’s built-in security checks. Sticking to official stores helps keep those hidden threats off your device.
2) Avoid “earn money by sharing bandwidth” apps
If an app promises rewards for sharing your unused internet bandwidth, that’s a major red flag. In many cases, that is exactly how residential proxy networks recruit devices. Even if it sounds legitimate, you are effectively renting out your IP address. That can expose you to abuse, blacklisting or deeper network vulnerabilities.
3) Review app permissions carefully
Before installing any app, check what permissions it requests. A simple wallpaper app should not need full network control or background execution privileges. After installation, go into your phone’s settings and audit which apps have constant internet access, background activity rights or special device permissions.
4) Install strong antivirus software
Today’s mobile security tools can detect suspicious app behavior, unusual internet activity and hidden background services. Strong antivirus software adds an extra layer of protection beyond what’s built into your device, especially if you’ve installed apps in the past that you’re unsure about. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.
5) Keep your devices updated
Android security updates patch vulnerabilities that proxy operators may exploit. If you’re using an older phone, tablet or Android TV box that no longer receives updates, it may be time to upgrade. Unpatched devices are easier targets for hidden SDK abuse and botnet enrollment.
6) Use a strong password manager
If your device ever becomes part of a proxy network or is otherwise compromised, attackers often try to pivot into your accounts next. That’s why you should never reuse passwords. A password manager generates long, unique passwords for every account and stores them securely, so one breach does not unlock your email, banking or social media. Many password managers also include breach monitoring tools that alert you if your credentials appear in leaked databases, giving you a chance to act before real damage is done. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.
7) Remove apps you don’t fully trust
Go through your installed apps and delete or uninstall anything you don’t recognize or haven’t used in months. The fewer apps running on your device, the fewer opportunities there are for hidden SDKs to operate. If you suspect your device has been compromised, consider a full reset and reinstall only essential apps from trusted sources.
ANDROID MALWARE HIDDEN IN FAKE ANTIVIRUS APP
Threat groups and state-linked actors allegedly used compromised devices to mask online activity and automate attacks. (Photo Illustration by Serene Lee/SOPA Images/LightRocket via Getty Images)
Kurt’s key takeaway
Residential proxy networks operate in a gray area that sounds harmless on paper but can quickly become a shield for cybercrime. In this case, millions of everyday devices were quietly enrolled into a system that attackers used to hide their tracks. Google’s takedown is a major move, but the broader market for residential proxies is still growing. That means you need to be cautious about what you install and what permissions you grant. Free apps are rarely truly free. Sometimes, the product being sold is you and your internet connection.
Have you ever installed an app that promised rewards for sharing bandwidth, or used a free VPN without thinking twice about it? Let us know your thoughts by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter
Copyright 2026 CyberGuy.com. All rights reserved.
Related Article
This week, Anthropic delivered a master class in arrogance and betrayal as well as a textbook case of how not to do business with the United States Government or the Pentagon.
Our position has never wavered and will never waver: the Department of War must have full, unrestricted access to Anthropic’s models for every LAWFUL purpose in defense of the Republic.
Instead, @AnthropicAI and its CEO @DarioAmodei, have chosen duplicity. Cloaked in the sanctimonious rhetoric of “effective altruism,” they have attempted to strong-arm the United States military into submission – a cowardly act of corporate virtue-signaling that places Silicon Valley ideology above American lives.
The Terms of Service of Anthropic’s defective altruism will never outweigh the safety, the readiness, or the lives of American troops on the battlefield.
Their true objective is unmistakable: to seize veto power over the operational decisions of the United States military. That is unacceptable.
As President Trump stated on Truth Social, the Commander-in-Chief and the American people alone will determine the destiny of our armed forces, not unelected tech executives.
Anthropic’s stance is fundamentally incompatible with American principles. Their relationship with the United States Armed Forces and the Federal Government has therefore been permanently altered.
In conjunction with the President’s directive for the Federal Government to cease all use of Anthropic’s technology, I am directing the Department of War to designate Anthropic a Supply-Chain Risk to National Security. Effective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic. Anthropic will continue to provide the Department of War its services for a period of no more than six months to allow for a seamless transition to a better and more patriotic service.
America’s warfighters will never be held hostage by the ideological whims of Big Tech. This decision is final.
Lifestyle7 minutes ago
‘The Fall and Rise of Reggie Dinkins’ falls before it rises — but then it soars
Technology19 minutes ago
Xiaomi 17 is a small(ish) phone with a big(ish) battery
World25 minutes ago
World leaders split over military action as US-Israel strike Iran in coordinated operation
Politics31 minutes ago
Iran fires missiles at US bases across Middle East after American strikes on nuclear, IRGC sites
Health37 minutes ago
Common nighttime noise exposure may trigger heart problems, study suggests
Florida1 year ago
Florida High School Football Rankings: Top 25 teams – Oct. 21
Connecticut2 years ago
Cleary's 21 help Le Moyne down Central Connecticut State 69-64 in OT
Oregon2 years ago
How old is Bo Nix? What to know about Oregon quarterback ahead of 2024 NFL Draft
Virginia2 years ago
99th annual Pony Swim held in Virginia
Indiana1 year ago
Indiana Members Credit Union announced as new anchor tenant at Bottleworks District
Politics31 minutes ago
Iran fires missiles at US bases across Middle East after American strikes on nuclear, IRGC sites
World2 hours ago
Israel strikes two schools in Iran, killing more than 50 people
News2 hours ago
Anthropic CEO says he’s sticking to AI “red lines” despite clash with Pentagon
Politics13 hours ago
ICE blasts Washington mayor over directive restricting immigration enforcement
World14 hours ago
Did the EU bypass Hungary’s veto on Ukraine’s €90 billion loan?
-
World2 days agoExclusive: DeepSeek withholds latest AI model from US chipmakers including Nvidia, sources say
-
Massachusetts3 days agoMother and daughter injured in Taunton house explosion
-
Montana1 week ago2026 MHSA Montana Wrestling State Championship Brackets And Results – FloWrestling
-
Louisiana5 days agoWildfire near Gum Swamp Road in Livingston Parish now under control; more than 200 acres burned
-
Denver, CO3 days ago10 acres charred, 5 injured in Thornton grass fire, evacuation orders lifted
-
Technology1 week agoYouTube TV billing scam emails are hitting inboxes
-
Technology1 week agoStellantis is in a crisis of its own making
-
Politics1 week agoOpenAI didn’t contact police despite employees flagging mass shooter’s concerning chatbot interactions: REPORT