Final month, a significant regional financial institution filed swimsuit towards a New York entrepreneur, alleging a check-kiting scheme that processed greater than $72 million in fraudulent checks, leading to $27 million in direct losses. Whereas cost applied sciences
have advanced dramatically, conventional fraud strategies proceed to take advantage of elementary processes, leading to losses. Examine kiting could not generate the headlines of cyber-enabled crimes, however it stays a cloth threat for establishments.
In 2023, payroll government Najeeb Khan was sentenced for operating a scheme that finally price banks almost $150 million. For years, he deposited monumental volumes of checks throughout a number of establishments, usually hand-delivered by
courier, with day by day totals exceeding $100 million by the top. The transactions bore little resemblance to the professional money flows of a payroll firm, but the sample continued till one financial institution lastly refused to honor the deposits. The purple flags had been evident:
repetitive high-volume deposits, persistent discrepancies between collected and ledger balances, and a sample of exercise timed to coincide with posting deadlines. However they weren’t linked right into a coherent image till it was too late.
Earlier this 12 months, Andrew Blassie, an government vp at a group financial institution, admitted to a special variation of the identical tactic. Over the course of a 12 months, he used 4 private accounts throughout a number of banks to funnel
checks into his establishment, withdrawing almost $2.7 million in funds he knew didn’t exist. What made this case significantly damaging was the within position he performed in concealing it. By eradicating his personal identify from suspect-account reviews, he turned off the
very safeguards designed to show the scheme. Uncommon overdrafts, repeated inflows from accounts with inadequate funds, and tampered fraud reviews all pointed to misconduct, however insider entry allowed him to override the controls.
These instances illustrate that examine kiting will not be confined to a specific period or kind of perpetrator. It has ensnared small enterprise house owners, senior financial institution executives, and even massive monetary establishments. Every episode reinforces
the identical actuality: when gaps exist in detection and oversight, fraudsters will discover a method to exploit them.
The lesson is evident. Know-how has superior, funds have accelerated, and analytics have matured, however examine fraud nonetheless finds its means in.
Why Examine Kiting Persists
Examine kiting works as a result of it exploits the hole between when deposited funds are proven as obtainable and when the examine is lastly paid. Below Regulation CC, no less than $275 of most examine deposits should be obtainable the subsequent enterprise
day, and most remaining funds are typically obtainable by day two. Deposits at non-proprietary ATMs might be held till the fifth enterprise day. Exception holds apply to massive deposits and new accounts, with present greenback thresholds set at $6,725, and availability
that may lengthen to about seven enterprise days for big deposits and as much as 9 for sure new-account objects. Availability will not be settlement. The paying financial institution typically has till midnight of the subsequent banking day after presentment to pay or return an merchandise underneath
the UCC. That return window is the float fraudsters attempt to trip, transferring checks amongst accounts and throughout banks so every ledger appears wholesome lengthy sufficient to tug out actual cash.
At scale, the tactic creates layers of liquidity that aren’t money. Many banks select to launch funds sooner than the regulatory minimums as a matter of coverage and customer support. That’s permitted, and it is not uncommon. A coordinated sequence of deposits throughout
a number of accounts, repeated over a couple of days, can produce very massive “obtainable” balances whereas the collected stability lags. Weekends and holidays lengthen the sensible threat window. Cross-bank presentment and return cycles add extra delay. The sample is easy
to explain, but it’s sustained by velocity, symmetry, and repetition till the numbers balloon and the returns arrive.
The Stakes for Banks
Regardless of its lengthy historical past, examine kiting stays tough to detect, particularly in its early phases. It’s not often one suspicious transaction, quite it is a sample of habits that unfolds throughout time and accounts. Fraudsters depend on cross-entity complexity,
transferring funds throughout a number of banks and account varieties to obscure the view. They manipulate timing, benefiting from the float interval between deposit and clearing. The indicators might be refined like rounded quantities, repeated use of counterparty accounts, or deposits
timed excellent to keep away from consideration.
Every establishment implements its insurance policies in barely alternative ways, which makes coordinated detection more difficult. Conventional monitoring programs, designed to flag single anomalies, usually miss the larger image. The result’s that schemes can develop
till the losses are vital to disregard.Â
Greatest Practices for Detecting Examine Kiting
To counter this, banks are adopting behavior-based approaches that minimize throughout channels and accounts. As a substitute of treating every deposit or withdrawal as a stand-alone occasion, superior programs consolidate info from ATM, department, cell, and examine posting
exercise to construct a unified image of account habits. This makes it potential to detect round fund flows, deposits and withdrawals that mirror one another too neatly, or account exercise whose velocity not matches its regular profile.
Had such account-level visibility been utilized within the Khan case, the persistent mismatch between collected and ledger balances, coupled with repeated high-value deposits from the identical sources, would have stood out far earlier.
Detection additionally will depend on searching for the correct behavioral indicators. Establishments are monitoring transaction velocity, repeated use of the identical counterparties, rounded greenback quantities that counsel artificial fund motion, and sequences of deposits timed inside
hours of one another. On their very own, these patterns could seem innocent, however collectively they’re predictive indicators of examine kiting. In Blassie’s case, a mannequin tuned to flag repeated overdrafts linked to cross-bank deposits might have raised considerations, significantly
when the identical names and accounts reappeared in a number of cycles.
To strengthen accuracy and cut back noise, efficient packages use fraud enrichment strategies. They tag suspicious time home windows, apply inspection guidelines resembling “three deposits and three withdrawals inside three days,” and weight alerts in order that recurring patterns
are prioritized. In best-in-class packages, associated transactions are consolidated right into a single account-level alert, giving investigators the entire image with out overwhelming them. That is precisely the sort of narrative-level view that might have linked
the dots within the Khan matter earlier than losses escalated.
The target is early detection, generally throughout the first month of exercise. Nicely-tuned programs hold alert charges manageable whereas surfacing the instances that matter most. In addition they suppress alerts for trusted accounts, guaranteeing investigators focus consideration
the place it counts. These will not be simply theoretical ideas. At NICE Actimize, we’ve seen main establishments apply these practices to strengthen defenses, cut back losses, and provides their fraud groups the boldness to behave earlier.
Regulatory and Compliance Concerns
Examine Kiting isn’t just a fraud loss quantity, however it creates a regulatory publicity. Below BSA/AML necessities, establishments should file a Suspicious Exercise Report (SAR) inside 30 days of detecting potential fraud, extendable to 60 days if no suspect is
recognized.
The thresholds are clear: any quantity if insider abuse (as within the Blassie case) is concerned, $5,000 or extra if a suspect might be recognized, and $25,000 or extra if no suspect is thought. Most kiting occasions simply exceed these thresholds, making SAR filings unavoidable.
Examiners additionally look to see that SAR narratives clearly describe the behavioral sample, not simply remoted objects.
Whereas trendy information doesn’t get away kiting particularly, earlier FDIC evaluations confirmed that from 1996 to 2000, almost 18,400 SARs had been filed citing examine kiting — about 4% of all check-fraud associated filings. In the present day, FinCEN reviews that over 680,000 SARs associated
to examine fraud had been filed in 2024 alone, a quantity that reveals the size of ongoing threat even when the kiting subset will not be individually tracked.
FFIEC steerage on retail cost programs reinforces this expectation. Examiners emphasize that efficient examine fraud packages should determine patterns of habits—repeated deposits, persistent collected-versus-ledger stability gaps, and strange velocity—not
simply single transactions. Establishments are additionally anticipated to use risk-based exception holds underneath Reg CC, balancing customer support with security and soundness. Overly liberal availability insurance policies with out compensating monitoring might be flagged throughout exams.
Lastly, kiting exercise usually overlaps with AML typologies. Structuring deposits to handle availability, round fund flows with no financial goal, and insider manipulation of reviews can all floor in each fraud and AML monitoring. More and more, regulators
count on fraud and AML groups to share intelligence and coordinate responses. Treating kiting as each a fraud and a compliance threat positions establishments to fulfill their regulatory obligations whereas defending their stability sheets.
From Reactive to Proactive
The regulatory image makes clear that kiting is greater than a fraud operations challenge. It’s a compliance accountability, a reporting obligation, and an examination focus. When tens of hundreds of SARs have traditionally cited kiting, and a whole lot of hundreds
extra reference examine fraud annually, the sign is unmistakable: this can be a systemic threat that calls for sustained consideration.
In accordance with the Actimize Fraud Insights Report, US Retail 2025 version, examine fraud now represents 52 % of all fraud in retail banking. That determine alone reveals why establishments can’t afford to downplay the menace. The current kiting instances
illustrate how rapidly publicity can escalate when timing gaps and coverage selections are exploited.
For banks, the message is evident: fraud doesn’t disappear just because cost programs modernize. It adapts, it scales, and it checks the seams of oversight. The crucial now could be to behave, assessment funds availability insurance policies, strengthen behavioral monitoring,
and guarantee fraud and AML groups share intelligence quite than function in silos.
Establishments that take these steps can shut the gaps earlier than they’re exploited. Those who delay is not going to simply face monetary losses, they may face regulators, examiners, and clients asking why outdated schemes had been allowed to succeed once more.
