Technology
Check washing crisis fueled by AI and mail theft
Once considered an old-fashioned crime, check washing has roared back to life with alarming sophistication.
Criminals are not just targeting personal checks anymore. They are exploiting every vulnerability in the mailing and banking system to cash in on stolen funds.
As check fraud incidents continue to rise sharply across the country, it is more important than ever to understand how check washing works and what you can do to protect yourself. Here is what you need to know to stay ahead of the scammers.
JOIN THE FREE CYBERGUY REPORT: GET MY EXPERT TECH TIPS, CRITICAL SECURITY ALERTS, AND EXCLUSIVE DEALS — PLUS INSTANT ACCESS TO MY FREE ULTIMATE SCAM SURVIVAL GUIDE WHEN YOU SIGN UP!
A pen placed on top of a blank check (Kurt “CyberGuy” Knutsson)
What is check washing fraud?
Check washing fraud happens when a scammer steals a check you have written, erases the ink using chemicals like acetone or nail polish remover, and rewrites it to a new recipient. Often, they will change the amount to something much higher. The altered check is then deposited or cashed, and the funds are drained from your account before you even realize something is wrong.
Why it’s dangerous:
- Check washing does not require much technical skill.
- It can happen with checks you leave in your outgoing mail.
- Even mailed bill payments are vulnerable if not handled securely.
FBI WARNS OF SCAM TARGETING VICTIMS WITH FAKE HOSPITALS AND POLICE
Unlike digital fraud, check washing often goes unnoticed until long after the damage is done. Because checks can take days or even weeks to clear through the banking system, criminals have plenty of time to deposit altered checks and move funds before victims realize anything is wrong.
By the time the missing money is discovered, tracing it back to the scammer can be extremely difficult. This delay makes it critical to monitor your accounts closely and act quickly if you spot any suspicious activity.
Illustration of check fraud in progress (Kurt “CyberGuy” Knutsson)
FBI WARNS OF SCAM TARGETING VICTIMS WITH FAKE HOSPITALS AND POLICE
How check washing has gotten worse
Since 2023, check fraud has exploded in the United States.
The surge in fraud reports reflects more than just isolated criminal acts. Organized crime rings are increasingly turning to check washing as a hybrid crime, blending old-school mail theft with new digital tools like AI. Fraudsters now use advanced technologies to forge identities, alter check images and exploit gaps in banking security, making check washing more sophisticated than ever. As financial institutions strengthen cybersecurity defenses, scammers are targeting physical mail systems as a weaker link to bypass digital barriers.
Real examples:
- Six people were charged with attempting to steal $80 million through fraudulent checks tied to COVID-19 relief funds.
- In Florida, a former mail carrier pleaded guilty to attempting to sell USPS arrow keys and stolen checks totaling nearly $550,000 to an undercover agent, leading to his arrest and confession.
s
New tricks criminals are using
Fraudsters have adapted their methods to stay ahead of law enforcement and banks.
- Mobile deposit fraud: Criminals alter check images or deposit the same check into multiple accounts.
- Synthetic identity fraud: Scammers create fake identities using AI-generated documents to open accounts and cash stolen checks.
- Business Email Compromise (BEC): Attackers impersonate executives or vendors to convince companies to send checks to fraudulent accounts.
Criminals are combining old techniques like mail theft with new digital strategies, making check washing harder to recognize and prevent without proactive security measures. Recent advancements in AI technology have made it easier for scammers to forge realistic-looking documents, generate convincing fake identities and create sophisticated phishing emails.
AI-generated fake IDs and altered check images can pass basic verification checks that would have caught manual forgeries in the past. This shift means check fraud is no longer just a matter of stealing a physical check, but exploiting digital vulnerabilities at every stage of the banking process.
A person going over a bank statement (Kurt “CyberGuy” Knutsson)
THIS IS WHAT YOU ARE DOING WRONG WHEN SCAMMERS CALL
How to protect yourself from check washing fraud
Here are 14 essential protective measures to shield yourself from check washing scams.
1. Use a black gel pen: When writing checks, always use a black gel pen. The ink is much harder to remove compared to regular ballpoint pen ink.
2. Bring checks directly to the post office when mailing them: If using a mailbox, make sure to drop off your mail before the final scheduled pickup so it is not left sitting overnight.
3. Sign up for USPS Informed Delivery: Stay ahead by signing up for USPS Informed Delivery. You will receive digital previews of incoming mail so you can monitor for any missing items early. Learn more about why it’s important here.
4. Monitor your bank accounts: Set up real-time alerts for check clearing and review your statements weekly to catch any suspicious activity. Also, ask your bank about any other fraud-prevention tools they offer to protect your accounts.
5. Switch to digital payments when possible: Use your bank’s mobile app to deposit checks without mailing or physically delivering them, reducing the risk of theft or tampering.
6. Use checks with built-in security features: Choose checks printed on paper with watermarks, chemical-sensitive coatings or other security features that make check washing much harder.
7. Limit the information on checks: Avoid unnecessary personal details. Do not print your Social Security number, driver’s license number or phone number on your checks. The less information available, the less a fraudster can use.
HOW CYBERSCAMS ARE DRAINING AMERICANS WALLETS BY THE BILLIONS
8. Store checks securely: Keep blank checks in a safe place. Store your checkbook in a locked drawer or safe, not in your purse, car or an easily accessible location at home.
9. Check your mailbox security: Install a locking mailbox. If possible, use a mailbox with a lock to prevent thieves from stealing outgoing or incoming mail.
10. Be cautious with endorsements: When endorsing checks, write “For Deposit Only” along with your account number to prevent others from cashing the check.
11. Enroll in identity theft protection with check fraud specialization: Choose services that specifically monitor for compromised check details on dark web marketplaces and alert you to suspicious check-cashing patterns. Identity theft protection services monitor your personal data across the dark web and public databases, alert you to suspicious activity and assist you in locking down your accounts if needed. See my tips and best picks on how to protect yourself from identity theft.
12. Invest in personal data removal services: Minimize exposure of sensitive details (like addresses or banking affiliations) that fraudsters could exploit for check-washing scams. Removing your personal information from these sites can help reduce your risk of becoming a victim. While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap and neither is your privacy.
These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you. Check out my top picks for data removal services here.
13. Shred sensitive documents: Shred old checks and bank statements. Don’t just throw them away. Shred any documents with sensitive banking information.
14. Report suspicious activity immediately: If you suspect check fraud or missing mail, report it to your bank and the U.S. Postal Inspection Service right away.
15. Use Positive Pay if you are a business: Positive Pay is a fraud prevention service offered by most banks to business customers. It works by matching the checks you issue with the ones presented for payment. If something doesn’t add up, like a changed amount or payee, the bank flags it for your review before it’s processed. You usually need to sign up through your bank, and there might be a fee, but it’s a smart way to protect your business from check fraud, especially if you write a lot of checks.
What to do if you are a victim
If you think you have been targeted by check fraud:
Time matters. The faster you act, the better your chances of recovering lost funds.
Kurt’s key takeaways
Check washing fraud is growing rapidly, and criminals are becoming more organized and sophisticated. Simple habits like using gel pens, securing your mail and monitoring your financial accounts closely can make a big difference. Services like USPS Informed Delivery, Positive Pay for businesses and personal data removal tools provide added layers of protection. Identity theft protection services can also offer critical support if you ever become a victim of check fraud.
Have you or someone you know experienced check fraud? Let us know by writing us at Cyberguy.com/Contact
For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter
Ask Kurt a question or let us know what stories you’d like us to cover
Follow Kurt on his social channels
Answers to the most asked CyberGuy questions:
New from Kurt:
Copyright 2025 CyberGuy.com. All rights reserved.
Technology
SpaceX cuts a deal to maybe buy Cursor for $60 billion
SpaceX and Cursor are now working closely together to create the world’s best coding and knowledge work AI.
The combination of Cursor’s leading product and distribution to expert software engineers with SpaceX’s million H100 equivalent Colossus training supercomputer will allow us to build the world’s most useful models.
Cursor has also given SpaceX the right to acquire Cursor later this year for $60 billion or pay $10 billion for our work together.
Technology
Fake Windows update installs hidden malware
NEWYou can now listen to Fox News articles!
If you’ve ever clicked “Check for updates” and trusted what you saw, you’re not alone. That’s exactly what this latest scam is counting on.
The page mimics official branding, includes a believable knowledge base number and presents a big blue download button that feels familiar.
The catch? The download installs malware designed to steal passwords, payment details and account access.
According to researchers at Malwarebytes Labs, a cybersecurity research and threat intelligence team inside Malwarebytes, the site uses a typosquatted domain that looks close enough to a real Microsoft URL to fool a quick glance. That small trick is often all it takes.
APPLE APP PASSWORD SCAM EMAIL WARNING
Cybersecurity researchers warn a fake Microsoft update site uses a look-alike URL and a familiar download button to deliver data-stealing malware. (Michael Nagle/Bloomberg via Getty Images)
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Why this fake Windows update malware slips past detection
At first glance, nothing seems off. The file looks like a standard Windows installer. It even lists “Microsoft” in its properties. That’s where this attack gets clever. Instead of using obvious malicious code, the attackers built the installer with legitimate tools and layered the attack in stages. Each piece looks harmless on its own.
Here’s what’s happening behind the scenes:
- The installer launches what appears to be a normal app
- That app quietly runs hidden scripts
- A disguised process loads a full Python environment
- Data theft tools activate in the background
Because each step looks routine, many security tools fail to flag it right away. Researchers also noted that antivirus engines initially showed zero detections for key parts of the attack. That does not mean the file is safe. It means the malicious behavior is well hidden.
What this fake Windows update malware is stealing
Once installed, the malware gets to work fast. It collects details about the infected device, including location and IP address. Then it reaches out to remote servers to receive instructions and upload stolen data.
The targets include:
- Saved browser passwords
- Login sessions and cookies
- Payment details
- Discord account tokens
It even tries to shut down other processes on your system to avoid interference while it works. In some cases, it modifies apps like Discord to intercept account activity in real time.
How the fake Windows update malware stays on your system
This malware is designed to stick around. It creates entries that look like normal system processes, so they blend in. One registry entry mimics Windows Security Health, which most users would ignore. It also drops a shortcut in your startup folder with a familiar name like Spotify. That makes it easy to overlook. Two different persistence tricks mean it can survive a reboot and keep running.
FAKE WINDOWS UPDATE PUSHES MALWARE IN NEW CLICKFIX ATTACK
A fake Windows update page is tricking users into downloading malware that steals passwords, payment details and account access. (Beata Zawrzel/NurPhoto)
Why this fake Windows update scam feels so real
There’s a bigger trend behind this. Researchers say campaigns like this often target regions where large data breaches have already exposed personal information. When attackers already know your name, provider or habits, they can build scams that feel tailored to you. That makes a fake Windows update page far more believable than a generic phishing email.
It also highlights something important. Today’s malware often hides inside legitimate tools and trusted frameworks. That makes it harder to detect and easier to trust. This campaign shows how far scammers have come. They are no longer relying on sloppy emails or obvious fake links. Instead, they are building layered attacks that look and behave like trusted software.
Even experienced users can get caught off guard when everything appears normal. The biggest takeaway is simple. A clean scan result or a familiar interface does not guarantee safety.
Microsoft says it’s aware of the threat
Microsoft confirmed it is tracking this type of activity and urges users to be cautious when downloading updates from unfamiliar sources.
“We are aware of reports of fraudulent websites impersonating Microsoft, and we actively work to detect and disrupt malicious activity across the internet,” A Microsoft spokesperson told CyberGuy. “We encourage customers to be cautious of unexpected prompts or downloads and to verify that they are interacting with legitimate Microsoft domains. As a best practice, we recommend users verify the legitimacy of a link by going directly to our website from your own saved favorite, from a web search, or by typing the domain name yourself.”
For more guidance on how to protect against online phishing scams, you can refer to Microsoft’s official support page at support.microsoft.com.
MICROSOFT CROSSES PRIVACY LINE FEW EXPECTED
A convincing Windows update scam is spreading malware that can grab saved passwords, cookies, payment data and Discord tokens. (Todor Tsvetkov/Getty Images)
Ways to stay safe from fake Windows update malware
You don’t need to be a security expert to avoid this. A few habits make a big difference.
1) Only update Windows from your settings
Go to Settings > Windows Update and check for updates there. Avoid downloading updates from websites.
2) Double-check the URL
Real Microsoft pages use microsoft.com. Anything else, even if it looks close, should raise a red flag.
3) Be cautious with urgent update prompts
If a site or message pressures you to install an update, stop and verify it manually.
4) Use strong antivirus software with behavior detection
Traditional antivirus software, which often comes built into your device or as basic security software, mainly looks for known threats using signature matching, which means it can miss new or well-hidden attacks like this one. Strong antivirus software uses behavior detection to monitor what programs are doing in real time, helping flag suspicious activity even if the malware hasn’t been seen before. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.
5) Use a data removal service to limit your exposure
If your personal information is already circulating online from past breaches, it can make scams like this more convincing. A data removal service helps reduce how much of your information is publicly available, making it harder for attackers to target you with tailored phishing attempts. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com
6) Turn on two-factor authentication
Two-factor authentication (2FA) adds a second layer of protection if your passwords are stolen.
7) Avoid downloading installer files from unknown sites
Legitimate updates rarely require manual downloads.
Kurt’s key takeaways
Fake updates are one of the most effective tricks because they tap into something we all trust. Keeping your system secure should not put you at risk, yet that’s exactly what attackers are exploiting here. The safest move is to slow down, verify where updates come from and stick to built-in tools whenever possible.
Are tech companies doing enough to keep fake updates from putting your data at risk? Let us know your thoughts in the comments below. Let us know by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Copyright 2026 CyberGuy.com. All rights reserved.
Technology
The Vergecast Vergecast, 2026 edition
We get a lot of questions about how The Verge works. And how The Vergecast works. And how we make money. And whether some of that money helps Nilay buy more jackets, several yachts, or something else entirely. So, every once in a while, we spend an episode of the podcast answering as many questions as we can.
On this episode of The Vergecast, Nilay and David are joined by The Verge’s publisher, Helen Havlak, to talk about ads, subscriptions, our website, our audience, and more. Then, Nilay and David answer some more questions about how we think about journalism, our relationship with Verge alumni, video podcasts, and (of course) Brendan Carr.
Thanks to everyone who sent us questions for this episode, and please keep them coming! You can always call the Vergecast Hotline (866-VERGE11) or send us an email (vergecast@theverge.com) with your questions, thoughts, feelings, and misgivings about everything we’re up to. We truly love hearing from you. And if you want to be part of everything we’re up to, and help make The Verge even bigger and better, the best thing you can do is subscribe! You even get all our podcasts ad-free.
Oh, and also, in case you missed it yesterday, be sure and check out our emergency pod on the news that Tim Cook is stepping down as Apple CEO. We’ll be talking more about the future of Apple on Friday’s show, too, so send questions if you have ’em!
-
Entertainment2 minutes agoReview: Monica Lewinsky, a saint? This devastatingly smart romance goes there
-
Lifestyle8 minutes agoWhat are Angelenos giving away in one Buy Nothing group? All this treasured stuff
-
Politics14 minutes agoCommentary: He honked to support a ‘No Kings’ rally. A cop busted him
-
Sports26 minutes agoSun Valley Poly High’s Fabian Bravo shows flashes of Koufax dominance
-
World39 minutes agoMoldovan oligarch sentenced to 19 years in prison over $1bn fraud
-
New York3 hours agoTrump’s Immigration Crackdown Pervades Long Island Suburbs
-
Detroit, MI3 hours agoChris Simms projects Detroit Lions first-round NFL draft pick
-
San Francisco, CA3 hours agoSan Francisco sets $3.4B price tag for public takeover of PG&E