Fake Check & Overpayment Scams: Cashier’s Check Fraud and Refund Schemes
A landlord’s guide to counterfeit cashier’s checks, mobile-deposit float-window exploitation, the “tenant overpaid — please refund the difference” scheme, and forged wire confirmations. What “funds available” really means — and the safe payment instruments that defeat the entire fraud category.
The single rule that defeats every overpayment variant: “funds available” is not the same as “check has cleared.” A deposited check can appear in your account, be available for withdrawal, and still be reversed weeks later when the issuing bank declines to pay. Never refund any overpayment from any instrument until the bank has confirmed final settlement — not provisional credit.
A new tenant arrives at lease execution with a cashier’s check made out for substantially more than first month plus security deposit. They explain — apologetically, plausibly — that their employer issued the check directly for a relocation package and the amount included moving expenses they intended to handle separately. They ask the landlord to deposit the check, hold the agreed amount for rent and deposit, and refund the difference by wire transfer or Zelle later that week. The landlord deposits the check; the bank shows the funds as available within a few business days; the landlord wires the refund. Three weeks later, the bank reverses the original deposit because the cashier’s check turned out to be counterfeit. The wired refund is gone, the deposited funds are gone, and the tenant has disappeared.
This is the operational reality of fake check and overpayment fraud. The variant above — sometimes called the “relocation package” or “executive bonus” overpayment — is among the most common ways a landlord loses money to financial fraud during a leasing transaction. The fraud exploits a structural gap in U.S. banking regulation: federal rules require banks to make funds available to the depositor relatively quickly, but final settlement of a check (when the issuing bank has actually paid and the funds become unrecoverable from the depositor) can take materially longer. During that window, the bank’s provisional credit looks indistinguishable from cleared funds — and the depositor who refunds money during the window will be on the hook when the original instrument is reversed. The defense is structural: never refund overpayment from an instrument that has not been confirmed-cleared with the issuing bank, and prefer payment instruments where the underlying clearing risk is borne by someone other than the landlord.
▶ Watch: Fake check & overpayment scams — and the safe payment instruments that defeat them
How Fake Check Fraud Actually Works
The mechanical structure of fake check fraud has remained stable for decades, even as the specific payment instruments and pretexts have evolved. The fraudster delivers an instrument that the recipient’s bank will provisionally credit but will eventually reverse when the issuing bank refuses to pay. During the window between provisional credit and final reversal — typically days to weeks, depending on the instrument and the issuing bank — the fraudster extracts value from the recipient by creating an urgent reason to send some portion of the funds back: an overpayment refund, a “shipment cost,” a deposit return for a deal that fell through, or a wire to a vendor.
The persistence of the fraud reflects the gap between the consumer-facing experience of banking and the underlying clearing process. A check deposited at a U.S. bank is governed by Federal Reserve Regulation CC, which sets out availability schedules — the timing by which the bank must make deposited funds available to the depositor. Depending on the type of check and the depositor’s account history, funds may be available the next business day, within two business days, or within several business days. Available for the depositor’s use is not the same as actually paid by the issuing bank. The issuing bank may take meaningfully longer to determine whether to honor or reverse the instrument. If the issuing bank declines, the depositor’s bank reverses the credit — leaving the depositor responsible for any funds withdrawn or refunded against the provisional credit.
Modern variants of the fraud have added layers of sophistication beyond the classic counterfeit cashier’s check. Mobile deposit increased the float window in many cases — physical inspection of the check is partial or absent, allowing more sophisticated forgeries. Forged wire confirmations let fraudsters claim payment has occurred without any payment actually entering the system. Money orders, certified business checks, and even forged escrow-company disbursement documents are all in active circulation. The common thread across every variant is the same: the recipient is induced to release value before the underlying instrument has been confirmed-cleared with the issuing institution.
The Five Overpayment Fraud Variants
Five fraud variants account for the majority of landlord-targeted fake-check losses. The defense in each case is the same — never refund overpayment from a not-confirmed-cleared instrument — but recognizing the variant helps catch it at the pretext stage.
💼 Relocation/Bonus Overpayment
The classic. A “cashier’s check from the employer” arrives for substantially more than first month plus deposit. The applicant asks for the difference back via wire or instant payment. The check turns out to be counterfeit weeks after deposit; the wired refund is unrecoverable.
📱 Mobile-Deposit Float
The applicant pays via mobile deposit of a counterfeit check, then immediately requests a “small refund” or wires off the equivalent of the deposit before the issuing bank has rejected the instrument. Mobile deposit increases the float window by reducing physical inspection.
📨 Money Order Counterfeit
Counterfeit money orders pass quick visual inspection — including by tellers in some cases — but are reversed when they reach the issuing post office or money-order service. The pretext is often a small overpayment “for the application fee my employer included.”
📄 Forged Wire Confirmation
The applicant produces a “wire confirmation” document showing the funds have already been sent — sometimes with realistic bank letterhead and confirmation numbers. The wire was never sent; the document is the only evidence and it’s fabricated.
🏠 Cancelled-Move-In Refund
An applicant who paid by check and then claims circumstances changed asks for the deposit and rent back via wire, before the original check has cleared. The original check was counterfeit; the wired refund leaves the landlord doubly exposed.
🏢 Escrow-Disbursement Forgery
For larger lease transactions or commercial leases, forged “escrow disbursement” documents purport to show that funds have been released to the landlord and request immediate counter-payment. The escrow account is fictitious or has not actually disbursed.
“Funds Available” vs. “Check Has Cleared” — The Two Critical Distinctions
Two distinctions are at the operational core of every fake-check fraud. Internalizing them — and acting on them in the leasing workflow — closes the fraud surface on the landlord side regardless of how the fraud is presented.
Distinction 1: Provisional credit vs. final settlement. When a check is deposited, the depositor’s bank applies provisional credit to the depositor’s account on the schedule required by Regulation CC. That credit is provisional — it can be reversed if the issuing bank declines to pay the check. Final settlement, the moment when the funds become irrevocable in the depositor’s account, occurs only after the issuing bank has actually paid. The window between provisional credit and final settlement is the float window the fraud exploits. Bank tellers and customer service representatives often will not volunteer this distinction; the depositor must ask explicitly: “Is this final, or provisional?”
Distinction 2: Check accepted vs. issuing bank verification. “My bank accepted the deposit” tells you only that your bank has not yet refused the instrument at intake. It tells you nothing about whether the issuing bank will pay. The only way to confirm that a cashier’s check is real is to call the issuing bank directly, using contact information looked up independently from the bank’s website (not from the check itself), and ask the bank to verify the specific check number, payee, and amount. Legitimate banks will perform this verification on request. The verification call is the structural defense; without it, every cashier’s check is potentially counterfeit until proven otherwise.
Cashier’s Check Verification Workflow
For any cashier’s check or money order delivered in connection with a leasing transaction, the verification workflow below should be applied as a standard intake step before keys are released, before any refund is processed, and ideally before the deposit is made.
The 6-Step Cashier’s Check Verification Workflow
- Identify the issuing bank. Read the bank name from the check itself. If the bank name is unfamiliar or appears generic, treat the check as suspect from this step forward.
- Look up the bank’s verification number independently. Use the bank’s verified website or a published industry directory — never the phone number on the check itself.
- Call the bank’s verification line. Provide the check number, the payee name, and the amount. Ask explicitly: “Was this cashier’s check actually issued by your bank, and is it currently outstanding?”
- Hold the check until verification is confirmed in writing or recorded. Note the date and time of the verification call, the name of the bank representative, and the verification result. Keep this in the leasing file.
- Wait for final settlement before treating any portion of the funds as cleared. Provisional credit is not final. Ask your bank explicitly when the deposited check has actually settled — not when the funds become available.
- Never refund overpayment from a not-yet-settled instrument. If an applicant requests refund of any portion of an overpayment, the answer is “after the original instrument has settled,” not “after the funds appear in the account.” This single rule defeats every overpayment variant.
Safe Payment Instruments — Use These Instead
The most efficient defense against fake-check fraud is to refuse to accept the instruments fraudsters use. Three categories of payment instrument are functionally fraud-resistant in landlord-tenant transactions, and substituting them for cashier’s checks and money orders eliminates most of the exposure described in this guide.
| Instrument | Why It’s Safer |
|---|---|
| ACH transfer through a property management platform | The platform initiates the transfer from the tenant’s bank to the landlord’s bank with both sides verified. Returned-payment risk exists but is structured and time-bound; the platform’s risk and dispute mechanics are well-defined and counterfeit instruments do not enter the flow. |
| Wire transfer initiated by the tenant from a verified bank account | Wire transfers are functionally final once received; reversing a wire is difficult and rarely happens outside fraud cases against the sending party. The receiving party (the landlord) has very low reversal exposure on a properly received wire. |
| Certified payment through a recognized rental-payment service | Services like RentRedi, AppFolio, Rentec, Avail, Buildium, and similar platforms structure the payment flow so that funds released to the landlord have already cleared the underlying source. The service bears the clearing risk; the landlord receives final funds. |
| In-person certified instrument with same-day verification | If a cashier’s check must be accepted, accept it only when the issuing bank can be reached for verification while the tenant is still present, and only after the verification confirms the instrument. Document the call and outcome in the leasing file. |
For multi-property landlords, standardizing on a single payment platform across the portfolio simplifies both the operational workflow and the fraud-resistance posture. Tenants who insist on paying with cashier’s checks or money orders despite a clearly stated platform policy are more often signaling a fraud attempt than a banking inconvenience; the platform requirement is a low-friction filter that catches a meaningful share of fraud at intake.
If You’ve Already Been Hit
If you’ve deposited a check that appears to be counterfeit, or if you’ve issued a refund and learned the original instrument was reversed, the immediate response sequence is similar to the breach response for any financial fraud — speed matters in the first 24 hours, but the recovery is rarely complete and managing the secondary exposure (reporting, fraud filing, identity protection if data was exposed) is often where the bulk of the work happens.
Call your bank’s fraud department immediately. Provide every detail — the check, the deposit timing, the refund (if any) issued, any communications from the depositor, and the bank’s reversal notification. Some banks can place a fraud hold or freeze the affected account; some have insurance products that cover specific categories of check fraud. Your bank’s fraud team will also direct you on whether to file a Suspicious Activity Report and any related compliance steps.
Report the fraud to the FBI’s Internet Crime Complaint Center (IC3) and to your state’s consumer protection agency. For mail-related fraud (counterfeit money orders, mailed cashier’s checks), file a report with the U.S. Postal Inspection Service. If the fraud involved a wire transfer to a recipient bank, request that your bank initiate a fraud-related wire recall — recovery is unlikely once funds have been received and withdrawn, but timely action sometimes recovers funds that are still in the recipient account. Document everything; preserve all evidence, including the original check itself if your bank returns it. If identity-related data was exposed (driver’s license, Social Security number on application materials), file an FTC identity-theft report and consider a credit freeze.
Real-World Fraud Scenarios
💼 The “Relocation Package” Overpayment
A polished applicant signs a lease and arrives at lease execution with a cashier’s check made out for substantially more than first month plus deposit. They explain that their employer issued the check directly for a relocation package and that the amount included moving expenses they intended to handle separately. They ask the landlord to deposit the check, hold the agreed amount for rent and deposit, and refund the difference by wire transfer later that week. The landlord deposits the check, sees funds available within three business days, and wires the refund. Two weeks later, the bank reverses the original deposit because the cashier’s check turned out to be counterfeit. The wired refund is unrecoverable; the original “deposit” never existed. The single rule that would have prevented the loss: never refund any portion of an instrument that has not been confirmed-cleared with the issuing bank.
📱 The Mobile-Deposit Float
An out-of-state applicant pays first month and deposit by mobile deposit of a cashier’s check. The next day, they ask the landlord to refund a small portion of the payment via Zelle, claiming a “calculation error” on their end. The amount is small enough that the landlord, who has already seen the funds appear in their account, processes the refund as a goodwill gesture before lease execution. Three weeks later, the bank reverses the original mobile deposit. The original payment is gone; the Zelle refund is gone; the applicant is gone. The mobile-deposit variant is particularly damaging because the landlord may never have physically inspected the check — and modern counterfeits pass mobile-deposit image review routinely.
📄 The Forged Wire Confirmation
An applicant for a higher-end lease sends the landlord a “wire confirmation” PDF showing that first month and deposit have been wired to the landlord’s account. The PDF includes realistic bank letterhead, a confirmation number, an amount, and timing. The landlord, seeing the confirmation, signs the lease and releases keys. Two business days later, no funds have arrived. Inquiry with the bank confirms no wire was ever received. The wire confirmation was fabricated; the lease is signed; keys have been released; the applicant is now in physical possession of the unit, requiring formal eviction to remove. The structural defense: never release keys based on a wire confirmation document. Verify with your own bank that the wire has actually arrived in your account.
Defeat the fraud at intake — screen, verify, and use safe payment instruments
The strongest defense against overpayment fraud is rigorous applicant screening combined with safe payment instruments. Tenant Screening Background Check has been verifying U.S. renters since 2004 — credit, criminal, eviction, and identity verification with no monthly fees. Catch the fraud profile at intake before any payment instrument is exchanged.
Start Tenant Screening →Frequently Asked Questions
What’s the difference between funds available and a check that has cleared?
Funds available is provisional credit applied by your bank under federal availability rules. The check has cleared only when the issuing bank has actually paid and the funds become irrevocable in your account. The window between the two is days to weeks depending on the instrument. During the window, your bank can reverse the credit if the issuing bank declines to pay — leaving you responsible for any funds you withdrew or refunded against the provisional credit. Always ask your bank explicitly: “Has this actually settled, or is the credit still provisional?”
Can a cashier’s check be counterfeit?
Yes, routinely. Modern counterfeit cashier’s checks are sophisticated enough to pass quick visual inspection, including by experienced bank tellers in some cases, and pass mobile-deposit image review. The only reliable verification is to call the issuing bank’s verification line — looked up independently from the bank’s verified website, never from the check itself — and confirm the specific check number, payee, and amount.
Is a money order safer than a cashier’s check?
Marginally safer in some cases, but not categorically. Counterfeit money orders are common, and the issuing institution can take time to detect and reverse them. The same verification posture applies — confirm with the issuing institution before treating the funds as cleared. For postal money orders, the U.S. Postal Service operates a verification system that can confirm authenticity.
What’s the safest way to accept rent from a tenant?
ACH through a property management platform, wire transfer initiated by the tenant from a verified bank account, or certified payment through a recognized rental-payment service. Each shifts the underlying clearing risk away from the landlord and produces final-settlement funds with very low reversal exposure. Standardizing on a single payment platform across the portfolio simplifies both operations and fraud-resistance.
What do I do if I think a check is counterfeit?
Stop the transaction. Do not refund any portion of the instrument. Call your bank’s fraud department, the issuing bank’s verification line (looked up independently), and report the fraud to the FBI’s Internet Crime Complaint Center. Preserve the check itself if your bank returns it. If you’ve already issued a refund, contact your bank immediately to attempt a fraud-related wire recall, though recovery is unlikely once funds have been received and withdrawn.
Should I ever accept overpayment from a tenant?
Treat any overpayment with extreme caution. The “the employer included extra” or “the relocation package was bigger than expected” pretexts are the dominant fraud variants. If you must accept an overpayment, hold the entire amount until the original instrument has fully settled — typically several weeks beyond the date funds appear available. Better practice: ask the tenant to remit the exact amount due through a safe payment instrument, with the surplus handled separately or through the originating party (employer, relocation service).
How long should I wait before treating a deposited check as cleared?
Long enough that the issuing bank has had time to either pay or reverse the instrument. For most cashier’s checks and personal checks, this can be two to four weeks beyond the date funds become available; for some instruments and out-of-area issuing banks, longer. The most reliable approach is to call your bank and ask explicitly when the specific deposited check has settled — not when funds were made available.
Is a wire transfer always safe to accept?
Wire transfers are functionally final once received and credited to your account — much safer than checks. The remaining risk is verifying that the wire has actually arrived, rather than relying on a “wire confirmation” document the sender provides. Always verify with your own bank that the wire has been credited; never release keys or sign a lease based on a wire confirmation document alone.
Published by Tenant Screening Background Check
Established 2004 · 20+ Years · All U.S. States & Territories · Statute-Based · Attorney-Reviewed
A Private Eye Reports™ service trusted by landlords, property managers, and attorneys.
⚖ Legal Disclaimer
This guide is provided for general informational purposes only and does not constitute legal, banking, or financial advice. Federal banking regulation (including Regulation CC), check clearing rules, and reversal mechanics are technical, fact-dependent, and may evolve over time. Specific timing windows mentioned in this guide are illustrative; always confirm current rules and timing with your own banking institution. If you have been victimized by check fraud, consult qualified legal and financial professionals and report the matter to your bank, the FBI’s Internet Crime Complaint Center, the U.S. Postal Inspection Service (for mail-related fraud), and your state consumer-protection agency. Browse free landlord resources.
