Criminals use Telegram to recruit 'walkers' as America's big banks see an 84% increase in check fraud

The photo and caption don't look suspicious at first glance, but the posting is actually advertising criminal services that cost U.S. banks billions of dollars a year, according to a cybersecurity expert.

The Covid-19 pandemic — and trillions of dollars in rescue funds that were disbursed across the U.S. in the form of paper checks — have given new life to an old scheme: check washing. It's a tried and true scam where criminals steal checks, wash out the names, write in new ones and cash them under false identities. Pandemic relief funds and new, secure messaging apps have made it all the more easy to execute and get away with the elaborate schemes.

"It's a big problem that's getting worse," said Paul Benda, senior vice president of cybersecurity and risk at the American Bankers Association.

In 2021, banks reported nearly 250,000 cases of check fraud nationwide, according to the Financial Crimes Enforcement Network, a unit of the U.S. Treasury Department. By last year, that number exploded: nearly 460,000 check fraud cases were reported – an increase of 84%.

One app in particular, Telegram, has made it easier for organized crime groups to recruit, train, organize and execute the schemes, according to Maria Noriega, a senior cyber-intelligence analyst at Q6 Cyber, a cybersecurity firm that is a consultant to CNBC.

"Check fraud, and perhaps fraud in general flourishes on Telegram mainly due to its unrestrictive nature," Noriega said.

Telegram told CNBC in a statement it actively moderates harmful content on its platform, including for potential fraud, and has "banned millions of chats and accounts for violating our Terms of Service."

Even so, Q6 Cyber was able to find at least 30 channels on Telegram dedicated to providing the latest tips and techniques to commit bank fraud. The largest of those groups had as many as 20,000 members. 

The platform, which allows users to send encrypted messages to each other and groups, is popular among criminals because they can hide their identity behind anonymous usernames, according to U.S. law enforcement officials. The encrypted data and anonymity of the site make it next to impossible for U.S. and international police to trace the messages back to the real users, Noriega said. 

While other mainstream platforms, including WhatsApp and Facebook, also have been exploited by criminals for illicit purposes, many of those apps regulate their content more carefully than Telegram, Noriega said. On platforms like WhatsApp and Facebook, users can more easily report posts and groups for illicit activity and they are generally removed faster than on Telegram, making it more difficult for fraudsters to advertise and communicate there, she said.

"Telegram is unfortunately a source for all things check fraud," Noriega said. "It's unfortunately turned into a one-stop shop for everything that you need to do to successfully take a check, to make counterfeit and deposit it."

Check washing schemes can happen one of two ways: Criminals can steal checks out of mailboxes and physically erase the name of the payee using technology like photoshop and replace it with a bogus identity and deposit it into their account or they can take or create counterfeit checks under a real account number and deposit it under a fake identity.

Noriega said she's seen people boast on Telegram that they have contacts inside some banks who've shared customer account balance and other information to ensure the checks that get cashed don't bounce.

Many of the chats show so-called walkers disguising their identity at hair salons while others seek accomplices to help carry out the elaborate scams. Some of the messages reviewed by CNBC advertise specific services: "If you need a male walker PM us." Another posting was offering $350 for someone to cash a fake check at a bank.

In criminal slang, "walks" are trips to the bank to cash those bogus checks. "Walkers" are the people who are hired to physically enter the banks to commit the fraud, taking a brunt of the risk in the scheme.

The elderly and homeless often serve as walkers because they'll frequently execute the crime for a low payout and bank tellers are less likely to question the credibility of an elderly person, according to Benda.

So-called brokers are one rung above walkers in the hierarchy of a criminal enterprise. They organize groups of walkers to go into banks, selecting them for age, race and gender, to be able to plausibly match the names on the checks they are cashing. To help with appearances, some of those brokers buy outfits for their walkers, or take them to the hair salon for a quick trim and color.

Those brokers, in turn, sell the walkers' services to other criminals who steal physical checks from the U.S. mail – including sometimes brazen thefts from blue postal boxes, home mailboxes and even apartment building mailrooms. The stolen paper checks are "washed," or forged, to change the name of the recipient and the amount on the face of the check. 

Using a fake identity, the walkers provide a combination of real and false personal information to open a bank account and prevent law enforcement officials from tracing the account to a specific person.

A freewheeling criminal bazaar on check washing flourishes in online chat rooms on Telegram: Brokers compete to offer services, using photos to advertise how credible their walkers are. They also post videos of themselves paying walkers in stacks of cash, in order to entice more walkers to work with them. And they brag when they've successfully ripped someone off, posting bank slips purporting to show deposits and withdrawals in the tens of thousands of dollars.

Noriega said it can be difficult for banks to flag some large deposits as abnormal because criminals develop a similar transaction history over a long period of time to make the accounts appear legitimate.

Noriega said in many of these cases, tellers can identify check walkers because they'll come in pairs – with a broker watching from afar as the walker approaches the counter and deposits a large check. In some cases, walkers wear earbuds, Noriega said, enabling the broker to listen in on the transaction and feed account information to the walker in real time.

Paper checks have been in use in the West since the 1400s, and from the very beginning, bankers have been concerned about check fraud.

In fact, in 1526 the city of Venice, Italy, banned checks outright because fraud was so rampant. But of course, that ban didn't last — checks were simply too efficient to eliminate from the financial system.

Benda, of the bankers' group, said the burden of stopping the crime too often falls to bank tellers, who aren't always trained to stop sophisticated, organized fraud. 

"That front-line bank employee wants to provide a good customer service," Benda said. "They've got a customer presenting that looks like the customer's supposed to look, that has the proper identification and documents that are in place, and they want to provide that customer service."

He also said Telegram has accelerated the sophistication and coordination of this crime.

"These guys have gotten really good at eliminating that signature and putting in a new signature," said Benda. "Gotten good at getting the fake IDs. I mean, they're hiring people off the street and then making them look pretty."

Noriega explains that check fraud exploded in 2021 after criminals – many of whom were first exposed to the mailed check process during the pandemic – recognized multiple weaknesses in the system. 

"You have clear weak points with the U.S. Postal Service and mailboxes are being compromised. Mail is being fished out of them," she said.

The Postal Service told CNBC it's been actively educating the public about how to prevent check theft, which includes information about check washing on its website. The Postal Service advises customers to deposit mail in blue collection boxes before the last pickup time to avoid mail being left overnight. It also says customers should have their mail held at the post office if they are going to be out of town.

But in addition to mail safety issues, Benda says law enforcement is not prosecuting enough of these cases.

The rapid development of this criminal skill set on Telegram coupled with the lack of prosecution has left banks in a bind. Benda says that's why financial institutions need government help. 

"They can't solve this problem," he said. "We really need help from law enforcement to prosecute these cases. We need the Postal Service and stop these checks from being stolen."

— Bria Cousins and Scott Zamost contributed to this story.