Blank check for fraud

When Shereen Greene recently scanned her bank statement, she found a $139 charge from a company she had never heard of — Pharmacycards.com.

The Atlanta paralegal dug out her canceled check and easily saw it was fake. The name on it was her maiden name, which she had not used in seven years. The address was five years old and her signature was missing. In its place, was a brief message: “Authorized by your customer. No signature required.”

Still, the numbers at the bottom of the check belonged to Greene’s bank account, and in the increasingly automated world of check processing, that was all that mattered.

Greene is one of the latest victims of checking-account fraud. In her case, it was a large-scale scam that tried to extract $12 million from 90,000 bank accounts, according to a lawsuit filed by the Federal Trade Commission in May.

“This is the e-commerce equivalent of a mugging,” said Howard Beales, director of the FTC’s consumer protection division.

Such scams are on the rise, partly riding the huge increase in the volume of automated checking account withdrawals and deposits as part of the nation’s wide acceptance of online banking. The system that processes all these requests is clearing 10 billion electronic transactions a year as consumers have their payroll or social security funds deposited directly to their accounts or have many of their bills — such as mortgage, monthly gym fee or telephone bill — automatically debited from their accounts.

Regulators at the Federal Reserve issued a warning to banks last year citing “alarming changes” in the automated check-clearing process, in which “dishonest persons are using the automated clearing house to originate unauthorized debits.”

Some scammers use sophisticated and cheap technology to print checks and take advantage of a banking practice that allows companies to write unsigned, paper checks on a consumer’s behalf for one-time transactions, such as when a consumer wants to pay a bill at the last minute or buy from a telemarketer.

Through these unsigned checks and automated withdrawals, thieves can seed thousands of bogus payment requests. Crooks can walk away with millions without having so much as a phone conversation with the people they are defrauding.

Banks are supposed to refund any unauthorized withdrawals, but there are fewer consumer protections than there are for fraudulent credit card charges. It is not always easy to convince a bank a charge is fraudulent, since banks often argue that using the correct account number is proof it was authorized, consumer advocates say.

There are no federal rules instructing banks what to do when a depositor challenges an unsigned paper check. Practices differ among states, including whether the merchant’s bank or the customer’s bank is liable for the loss. For electronic debits, Federal Reserve Board rules require banks to promptly investigate consumer complaints, and put any money back in a customer’s account if the probe takes longer than 10 days. If the bank decides the charge is valid, it can take the money out again.

Credit card companies are liable for fraudulent charges and customers do not have to pay until charges are proven to be valid.

The days are long gone when only banks had access to account numbers. On the front line, there are the merchants who traditionally have not been held to the same strict security rules for managing sensitive customer information as have banks, said Rick Fischer, a District of Columbia attorney who advises financial institutions on their security systems.

“That’s the gap and it is being exploited” by criminals, Fischer said.

Behind the scenes are third-party processing firms that handle many transactions for merchants, depositing customer checks into banks or processing the customer’s electronic account information. These companies weaken the connection between the bank, which is obligated under law to “know the customer,” and the merchant who is generating the payment request.

“Third-party processors play a pretty major role in the payments business,” said Elliott C. McEntee, president and chief executive of Nacha, the electronic payments association. “When a bank permits a third party to process transactions on behalf of a merchant, it’s putting a lot of confidence in the third party.”

“Unfortunately in a few cases,” McEntee added, “banks have not exercised their fiduciary responsibilities and they have allowed third parties to enter payments” that are not valid.

The electronics payment association tightened its rules last summer, requiring banks that use its automated clearing system to more vigorously question companies that had high rates of consumer chargebacks. Now, if more than 2.5 percent of a company’s monthly transactions are rejected by consumers, a bank is required to investigate. If the chargebacks remain high, banks should stop processing that firm’s automated payments.

Twelve states now say the merchant’s bank should be liable for unauthorized customer charges made through unsigned checks, called demand drafts, such as the one posted to Greene’s account. The Federal reserve board wants to make that a national rule, on the premise that it will force banks to be more diligent in policing customers.