Deposit fraud and check kiting schemes continue to present operational and financial risks for banking institutions. These activities often involve patterns of deposits and withdrawals designed to exploit the timing of funds availability, creating artificial balances or masking underlying account deficiencies. When such schemes go undetected or are not addressed in a timely manner, disputes may arise regarding whether the institution’s monitoring and response were consistent with commercially reasonable practices.

​

Common Characteristics of Deposit Fraud and Check Kiting

Check kiting typically involves the movement of funds between accounts, often across multiple financial institutions, to create the appearance of available balances that do not reflect collected funds. Deposit fraud may also include counterfeit checks, altered items, repeated redeposits of returned checks, or coordinated activity across related accounts.

These schemes frequently exhibit identifiable patterns, including rapid movement of funds, repeated deposits followed by immediate withdrawals, large dollar amounts inconsistent with account history, and activity across multiple accounts with similar ownership or control. While not all unusual activity constitutes fraud, such patterns often serve as indicators requiring further review.

​

Account Monitoring and Detection Expectations

Financial institutions are generally expected to maintain systems and procedures capable of identifying unusual or suspicious account activity. This includes both automated monitoring tools and manual review processes. Effective monitoring depends on timely alert generation, consistent review of flagged activity, and escalation where appropriate.

Detection failures may occur when monitoring thresholds are not properly calibrated, alerts are not reviewed in a timely manner, or account activity is not evaluated in the context of customer history and risk profile. In some cases, the issue is not the absence of monitoring, but inconsistent application or follow-up.

​

Relationship to Funds Availability and Transaction Timing

Deposit fraud and check kiting often rely on the timing of funds availability. As a result, these schemes frequently intersect with issues governed by Regulation CC, including when funds are made available and whether holds are applied appropriately.

In litigation, analysis may focus on whether the institution’s handling of deposits and availability of funds contributed to the continuation of the scheme. This includes evaluating whether earlier identification of suspicious patterns, application of holds, or account restrictions could have mitigated losses.

​

Operational Controls and Response Measures

A bank’s response to suspected fraud is as important as its ability to detect it. Institutions are generally expected to have procedures for escalating suspicious activity, restricting accounts when appropriate, and documenting investigative actions.

Operational failures may include delayed response to suspicious patterns, failure to restrict accounts after identifying red flags, or lack of coordination between departments responsible for fraud detection, deposit operations, and compliance. In some cases, repeated suspicious activity without meaningful intervention may indicate broader control weaknesses.

​

Litigation Considerations

In disputes involving deposit fraud or check kiting, the central issues often involve what the institution knew or should have identified, how it responded to suspicious activity, and whether its actions were consistent with internal policies and industry practices.

It is important to distinguish between the occurrence of fraud and the adequacy of a bank’s response. Not all fraud can be prevented; however, patterns of activity, repeated alerts, or unexplained inaction may raise questions regarding the effectiveness of monitoring and control systems.

​

Evaluating Commercially Reasonable Practices

Evaluation of these matters typically involves review of account statements, deposit and withdrawal activity, alert logs, internal communications, account relationships, and institutional policies. Consideration is also given to how similar activity has been handled in comparable situations.

A well-supported analysis focuses on whether the institution maintained appropriate monitoring systems, whether suspicious activity was identified and escalated, and whether responses were timely and consistent with established procedures.