# Altered Check Images: What to Look For

- Author: PreciseBankFlow (https://precisebankflow.com)
- Published: 2026-10-17
- Category: Fraud and forensic review
- Canonical: https://precisebankflow.com/blog/altered-check-images

> How to review altered check images from a bank statement: payee and amount changes, mismatched endorsements and how to request originals from the bank.
Altered check images show their changes in a few predictable places: a payee line in different handwriting or ink, a written amount that disagrees with the figures, and an endorsement on the back that does not belong to the named payee. Compare each image with the check register, then ask the bank for front and back images at full resolution.

## Where do the check images on a bank statement come from?

The check images on a bank statement are pictures the bank captured when the check was presented, not the paper check itself. Since the Check 21 Act, banks can process checks electronically and destroy the paper, so the image you see may be of the original item or of a substitute check printed from an image.

The [Federal Reserve's Check 21 questions and answers](https://www.federalreserve.gov/paymentsystems/regcc-faq-check21.htm) explain the pieces. A substitute check is a paper reproduction that is the legal equivalent of the original when it accurately shows the original's information and carries the legend "This is a legal copy of your check." Banks are not required to keep the paper original for any set time. Some send image statements with several small check pictures per page, and those pictures may show either the original or a substitute.

That chain matters for a reviewer. The thumbnail on a statement has usually been shrunk, compressed and converted to grayscale. Fine details such as a second ink color, a scraped surface or a correction fluid patch may be invisible at that size. Treat statement thumbnails as a screening tool and ask for better images before you draw conclusions.

### What each image should show

A complete set for one check has two sides:

- **Front:** date, payee line, numeric amount (often called the courtesy amount), written amount (the legal line), memo, signature, and the MICR line along the bottom with routing, account and check numbers.
- **Back:** endorsement, any deposit or "for deposit only" stamp, and the processing stamps of the banks that handled it.

If the statement shows only fronts, the most useful evidence is missing.

## Payee name changes visible in check images

Payee name changes are common because they redirect money without changing the amount, which keeps the books and the bank in balance. Look for a payee line in a different hand, ink weight or font than the date and amount, extra words squeezed before or after a name, or a name that is not in the vendor list.

Common patterns in the image:

- **Added text.** "ABC Supply" becomes "ABC Supply or J. Moore". The original payee is still there, so a quick glance passes it.
- **Overwritten text.** A short name is written over with a longer one. Look for letters with doubled strokes or a darker area where ink sits on ink.
- **Printed checks with a handwritten payee.** If the business prints its checks, a handwritten payee on one item is out of pattern even when the name looks legitimate.
- **Spacing that does not fit.** Printed payees usually start at the same position on every check. A name that starts further left or runs into the amount box was probably added later.

Compare every image payee with the check register or the accounting system. A mismatch between the ledger payee and the image payee is the single most useful finding in this whole review, because it can only arise if someone changed the check, changed the ledger, or both.

## Amount and date changes in a check image

Amount and date changes show up as disagreements between the parts of the check that should say the same thing. The written amount, the numeric amount and the amount encoded on the MICR line by the bank should all match, and the date should fall inside the period when that check number was in use.

Check these four points on every image:

1. **Written versus numeric amount.** A raised check often changes the figures more easily than the words. "Two hundred fifty" with a numeric 2,250.00 is a classic case.
2. **MICR amount.** The bank that first took the deposit usually encodes the amount at the bottom right. That figure shows what the bank processed, regardless of what the face now says.
3. **Ledger amount.** The amount in the books should match the cleared amount. A check recorded at 250.00 that clears at 2,250.00 shows up as a reconciling difference unless someone has also changed the ledger.
4. **Date and number.** A check dated months away from the checks numbered around it suggests old or stolen stock.

Digits that are easy to extend give clues too. A 1 becomes a 4 or a 7, a 3 becomes an 8, and a leading digit appears in the space before the first figure. Zoom in on the space to the left of the amount, where an added digit tends to sit.

## Back-of-check endorsements that do not fit the payee

Back-of-check endorsements tell you who actually received the money, which can differ from the payee on the front. An endorsement in an employee's name on a check payable to a supplier, or a deposit stamp from a bank the supplier does not use, points to the person who benefited.

Read the back of each image against three facts:

- **Who the payee is.** A supplier usually deposits with a company stamp. A handwritten signature on a check to a corporation is unusual.
- **Where it was deposited.** The deposit stamp often names the bank of first deposit. A run of checks to different suppliers all deposited at the same bank is a pattern worth noting.
- **Whose account it reached.** The account number in a deposit stamp may be partly legible. If it matches an employee's payroll account, the case changes character.

Some endorsement patterns are innocent. Small businesses do endorse by hand, payees do use mobile deposit, and a factoring company may legitimately deposit a supplier's check. Record what you see and let the pattern across many checks carry the weight.

## Can a check image show who altered the check?

A check image can show that a check was altered, but it rarely shows who altered it. The image records the item as the bank saw it at presentment, after any change was already made. Who held the check, who wrote on it and who benefited are questions for other records and for interviews.

What the image can establish:

- The face of the check differs from the ledger entry.
- The written and numeric amounts disagree with each other or with the MICR line.
- The endorsement names someone other than the payee.

What it cannot establish:

- Whether the change happened before the check left the office or after a third party stole it from the mail.
- Whose handwriting the change is in. That is a question for a qualified document examiner working from the original, if the original still exists.
- Intent.

That is why an altered image is a starting point. When the question becomes who did it and whether the loss is large, [when to hire a forensic accountant](/blog/when-to-hire-a-forensic-accountant) is worth reading, and the difference between a routine audit and an investigation is set out in [forensic audit vs financial audit](/blog/forensic-audit-vs-financial-audit).

### When not to rely on the image alone

Do not rely on a statement thumbnail when the case may go to court, when the image is too small to read the back, or when the bank can still produce the original or a substitute check. Never rely on an image supplied by the person whose conduct is in question. Get it from the bank.

### An example review sheet for check images

The sheet below shows how one reviewer worked through five check images for a single month. Names and amounts are invented for illustration.

| Check no. | Ledger payee | Image payee | Amounts agree? | Endorsement | Outcome |
| --- | --- | --- | --- | --- | --- |
| 4411 | Harbor Paper Co | Harbor Paper Co | Yes | Company stamp | Cleared |
| 4412 | City Water | City Water | Yes | Bank stamp only | Cleared |
| 4413 | Ridge Freight | Ridge Freight or D. Lane | Yes | Handwritten, D. Lane | Exception: added payee |
| 4415 | Office rent | Office rent | Written 1,800, numeric 7,800 | Landlord stamp | Exception: raised amount |
| 4416 | Void per register | Atlas Tools | Yes | Mobile deposit | Exception: voided check cleared |

Three exceptions in five items is far above what a normal month produces. The next step is the bank request in the section below, then a wider test of every check over the period. The duplicate, gap and pattern tests that scale this up are described in [fraud detection techniques in forensic accounting](/blog/fraud-detection-techniques-in-forensic-accounting) and in [audit data analytics for bank transactions](/blog/audit-data-analytics-for-bank-transactions).

## Requesting original check images and deposit records from the bank

Requesting original check images means asking the bank for front and back images at full resolution, and for the deposit-side records of where each check went. The account holder, or someone acting with their written authority, makes the request. Banks are required to keep many of these records for years, so older items are often still available.

Banks must keep check and deposit records under the federal Bank Secrecy Act recordkeeping rules. [31 CFR 1020.410](https://www.law.cornell.edu/cfr/text/31/1020.410) lists the records, including statements and most checks and debit items over $100, with exemptions, and [31 CFR 1010.430](https://www.law.cornell.edu/cfr/text/31/1010.430) sets the retention period at five years. In practice that means you can usually reach five years back.

Work through the request in this order:

1. **List the items.** Give check numbers, dates and amounts for each item you want. A precise list gets a faster and more complete answer than "all checks for 2025."
2. **Ask for both sides.** Request front and back images, in color and at the highest resolution the bank offers.
3. **Ask for a substitute check where it matters.** For a key item, ask whether the bank can supply a substitute check or the original. The Federal Reserve page above notes the bank may give the original, a substitute check or a copy.
4. **Ask for deposit information.** For checks you suspect, ask which bank and account received them. Your own bank may not be able to tell you the receiving account; that may need a subpoena or the receiving bank's cooperation.
5. **Record what came back.** Log each image received, the date and the format, and keep the files unchanged.

Once the images arrive, reconcile them back to the ledger. PreciseBankFlow reads cleared check numbers and amounts from statements and flags gaps in the sequence, which tells you which checks to request first; reading handwriting and endorsements on the images stays with you. To try it on a client's statements, [ask to join the early group](/get-started).