The customer swears the check was mailed.
Your books still show the invoice open.
You assume the mail is slow.
Then the customer says something that changes the whole file:
“The check already cleared.”
Now we have a problem.
Not an accounts-receivable problem.
A money-is-somewhere-it-should-not-be problem.
That is the piece of a recent Minnesota case that caught my attention.
Federal prosecutors say six defendants were involved in a scheme using business checks stolen from the U.S. Mail. According to the indictment, the checks were not simply altered and cashed.
The scheme allegedly went further.
Much further.
The defendants are accused of taking the identities of real businesses, registering new Minnesota LLCs using those business names, using fake identification to open bank accounts, and then depositing checks connected to the real companies.
More than $5.1 million in checks were allegedly deposited or attempted. Prosecutors say more than $1.5 million actually got through.
The defendants have been charged, not convicted.
But the mechanics of the alleged scheme are worth looking at because there is one detail I would put a big red circle around:
The fake business had real paperwork.
That makes things messy.
Start with the stolen check
According to prosecutors, one of the defendants was working for the U.S. Postal Service and allegedly pulled mail containing business checks and sold those checks to other members of the group.
At first glance, that sounds like ordinary mail theft.
It wasn’t, at least according to the indictment.
A business check is useful for more than the dollar amount written on the front.
Look at what is sitting there.
Business name.
Bank.
Account information.
Payee.
Signature.
Address.
A real transaction between two real companies.
If you are trying to impersonate a business, that is a pretty good piece of evidence to have in your hand.
Then add public business records.
Now add fake identification.
Now register a company with a name that looks like the real one.
Suddenly the fraudster is not walking into a bank with a random stolen check.
They are walking in with a story.
And pieces of paperwork that appear to support it.
The LLC filing is the part I would not ignore
State business filings carry weight.
They look official because they are official.
That is exactly why this alleged scheme is interesting.
If someone registers a company using the name of an existing victim business, the filing itself can help make the impersonation look legitimate.
Imagine what a bank employee sees.
A state registration.
An ID.
A business check.
A person claiming to represent the company.
Nothing there necessarily looks ridiculous.
The problem is that the documents may all be pointing back to the same fake setup.
That is a very different fraud from somebody scribbling a new payee name on a stolen check.
They allegedly built a second business identity around the first one.
The first clue may be sitting in accounts receivable
This is where I would tell a business owner to stop thinking like a collector for a minute.
You have an invoice that is 30 days past due.
You email the customer.
They say they paid it.
You ask when.
They give you the check number.
You still do not have the money.
That is not the time to send another “friendly reminder.”
Ask whether the check cleared.
If they say yes, ask for the image.
Front and back.
The back matters.
Where was it deposited?
What endorsement is on it?
Do you recognize the bank?
Does the endorsement even belong to your business?
That check image may tell you in five minutes that you are not dealing with a late payment at all.
You are dealing with diverted money.
One missing check is annoying. Three is a pattern.
This is where small businesses can miss fraud because the clues are spread out.
One employee is chasing a customer for payment.
Another gets a strange bank call.
Someone else sees an odd state filing.
Nobody connects them.
Each problem gets handled in its own little box.
Lost check.
Weird call.
Wrong filing.
Move on.
That is exactly how a larger fraud can stay invisible.
If I were looking at this file, I would start putting those small events next to each other.
Did several customers say checks were mailed?
Did several say the checks cleared?
Were the checks all missing during the same time period?
Did an unfamiliar bank appear on the endorsements?
Did a state filing show up around the same time?
Did anyone try to open an account using the company name?
That is when you stop looking at incidents.
Now you are looking at a pattern.
I would want to know exactly what happens to incoming checks
Not theoretically.
Actually.
Who gets the mail?
Where does it sit?
Who opens it?
Who logs the check?
Who deposits it?
Is there any point where checks sit unattended?
Can one person take a check from the mailbox all the way to the deposit without anyone else ever knowing it existed?
That matters.
You do not need a giant procedure manual.
You need a trail.
Customer.
Check number.
Amount.
Date received.
Deposit date.
Done.
If a customer later says, “We sent you check 1846 for $12,700,” you should be able to answer one question quickly:
Did we ever receive it?
If the answer is no, the investigation moves outside your office.
If the answer is yes, now you are looking at what happened after it came in.
Very different file.
Do the same thing with outgoing checks
The front of one of your own checks tells a thief quite a bit too.
So if you are still mailing checks, do not treat outgoing mail like junk mail.
Large checks sitting overnight in an unlocked box are an invitation.
Use a secure mailbox.
Take high-value checks inside the Post Office.
Ask your bank whether positive pay and payee matching are available.
And actually review the exceptions.
I have seen controls become useless because people approve every alert just to clear the queue.
That is not a control.
That is a button-clicking habit.
Then check your own business name
This is the part most owners probably never think about.
Go to your state business registry.
Search your exact company name.
Then search close versions.
Misspellings.
Extra words.
Similar LLC names.
You are looking for something that should not exist.
If your state offers business filing alerts, use them.
You should not find out that someone created a second version of your company because a bank investigator calls six months later.
If the customer says the check cleared, believe the clue
Not the conclusion.
The clue.
The customer may be right that the money left their account.
That does not mean it reached yours.
Those are two different facts.
Get the image.
Get the endorsement.
Find the deposit bank.
Call the customer using a number you already know.
Call your bank using a number you already know.
Do not use contact information that arrives in the suspicious email or letter.
And save everything.
Emails.
Check images.
Bank alerts.
Mail envelopes.
Invoices.
Camera footage.
State filings.
Anything that helps answer one question:
Where did the real payment stop being yours?
That is the trail.
And in this Minnesota case, that trail allegedly did not stop with a stolen piece of mail.
It kept going through business registrations, fake identities, bank accounts, and deposits.
That is why the missing check matters.
It may not be the theft.
It may be the first clue that somebody has already built another version of your business.
