Finic
ContactTry the API
Payments and scams

Detect check fraud in mobile and branch deposits

Grayson decides whether a deposited check is counterfeit, altered, stolen or a duplicate, and whether to release funds, place an exception hold or reject it.

Grayson decides whether a check deposited through a mobile app or at a branch is counterfeit, altered, stolen or a duplicate, and whether to make the funds available on your normal schedule, place an exception hold or reject the deposit. It reads the account's activity and deposit history, your image-analysis, duplicate-detection and check-verification results, and what happened on the account around the deposit, and costs about $0.52 to $0.80 per 1,000 decisions.

  • Decides: Release, hold or reject a check deposit that may be counterfeit, altered, stolen or a duplicate.
  • Call it: When a mobile or branch check deposit is submitted
  • Questions: 1 score, 2 choice
  • Cost: $0.00052 to $0.00080 per decision ($0.52 to $0.80 per 1,000) for these examples' 14,765 to 22,948 input tokens
  • Latency: 212 to 291 ms for these examples, the median of 5 calls each through api.finic.ai from US-West

Examples

Three mobile deposits waiting in a review queue, each sent with a year of account activity, two years of check deposits, 90 days of logins and every vendor result on the item: a counterfeit "new employer" check from a member who just lost his job, a freelance designer's first check from a new client, deposited from a hotel on a new phone, and a laid-off member's final paycheck, handwritten from outside her employer's payroll series.

Open in Playground

Open in Playground

Open in Playground

A yes/no answer is Grayson's probability that it's true. A choice answer is the top option and Grayson's confidence: 0% when every option is equally likely, 100% when one option has all the probability. A score answer is the expected level, numbering the levels in its criteria from 0, with its confidence measured the same way and, when no level reaches 70%, each level's probability. A multiple-choice answer lists the options at 50% or more.

  • funds_action routes the deposit. An exception_hold on a check covered by Regulation CC means sending a notice that gives the reason.
  • check_problem sets the follow-up: call a likely scam victim the same day, confirm a doubtful check with its maker or the paying bank, find a duplicate's first deposit.
  • return_likelihood: set hold thresholds on the sum of "Likely" and "Very likely", choosing the cut-off from your own return history.

Call it from your code

Save an example as request.json, such as ambiguous.json, and send it with your API key in GRAYSON_API_KEY:

curl https://api.finic.ai/v1/decide \
  -H "Authorization: Bearer $GRAYSON_API_KEY" \
  -H "Content-Type: application/json" \
  --data @request.json

The problem

Customers expect deposited funds within a day or two, but a bad check can come back days later, after the money has left by P2P, ATM or debit card. Many people who deposit counterfeit checks are scam victims, and holding every unusual check frustrates good customers.

What to send

Send the account's history, the item with your vendors' results on it, and what happened around the deposit. The examples send a year of transactions and two years of check deposits; send as much as your case system shows an analyst.

  • Account activity and deposit history. Pay, bills and earlier checks show what's normal for this member, and a job loss, a run of overdrafts or a first large check stands out against them.
  • The maker and the customer's history with it. A first check from a business that has never paid them raises the question why.
  • Check number against the maker's range. A number far outside the maker's recent range is a strong counterfeit signal, though off-cycle checks such as a final paycheck can come from another series.
  • Image analysis. Mismatched amounts, or different ink on the payee or amount line, point to alteration; missing security features, or a layout unlike the maker's other checks, point to a counterfeit.
  • Duplicate detection. Whether the same item was already deposited, at your institution or through a shared image network.
  • Logins, devices and the deposit session. A new phone or an unusual location matters less when the record shows why.
  • Activity around the deposit. Money that leaves straight away, a new P2P recipient, or messages and calls asking for the funds suggest someone expects the check to bounce, or a scammer is pressing.

Add your own policy

Grayson follows your mobile deposit procedure when it's in the request, even where it's stricter than a general reviewer would be. This one rejects a mobile deposit instead of holding it when the member has never deposited a check from the maker and the check-verification service reports the number out of range or the maker's account closed, because members treat a held deposit as money they have.

Your mobile deposit procedure adds this to the state of the ambiguous example:

{
  "institution_policy": "Our mobile deposit procedure MD-4. Reject a mobile check deposit, rather than accepting it with a hold, when both of these are true: (1) the member has never deposited a check from this maker before; (2) the check-verification service reports the check number outside the maker's recent range, or the maker's account as closed. Do not credit the account. Call the member the same day: explain that we can't accept the check through the app, offer to take it at a branch under the standard hold rules, and warn them not to send money to anyone who asks for part of it back. We reject instead of holding because members see a held deposit in their balance, treat it as money they have, and send their own funds on before the check comes back. Branch deposits, and checks from makers the member has deposited before, follow the standard hold rules."
}
QuestionWithoutWith your mobile deposit procedure
return_likelihood1.12 of 4, confidence 50% (Very unlikely 60%, Unlikely 12%, Uncertain 3%, Likely 5%, Very likely 20%)1.64 of 4, confidence 26% (Very unlikely 41%, Unlikely 15%, Uncertain 7%, Likely 12%, Very likely 25%)
check_problemnone, confidence 61%none, confidence 41%
funds_actionexception_hold, confidence 55%reject, confidence 86%

Both conditions hold for the ambiguous example's final paycheck: the member has never deposited a check from her former employer, and its number is far outside the employer's recent range. So the funds decision moves from an exception hold to rejecting the deposit, even though the check may well be genuine (she can still bring it to a branch). The counterfeit is rejected with or without the procedure, and the designer's check, though her first from that maker, is numbered within its range.

Where to call it

  • Mobile deposits: after image analysis, duplicate detection and check verification return, and before the app confirms the deposit.
  • Branch deposits: when the teller scans the item, so a rejection happens while the check is still at the window.
  • When the answer is uncertain, hold rather than release and verify with the paying bank; call again if the customer tries to move the money.

Cost and latency

ExampleInput tokensPer decisionPer 1,000 decisionsLatency
Obvious14,765$0.00052$0.52212 ms
Legitimate22,948$0.00080$0.80291 ms
Ambiguous16,723$0.00059$0.59259 ms

You pay only for input tokens, at $0.035 per million, and each request is rounded up to the next millionth of a dollar, so a request with a larger state costs proportionally more; every response reports its size in usage.input_tokens. Latency is the median of 5 calls each through api.finic.ai from US-West, and grows with the number of input tokens. Add your own network time to api.finic.ai.

Evaluate on your own data

Score Grayson on your own past cases before you use it: a CSV with one row per case and a column with the right answer to each question. Every other column is sent as the case.

pipx install https://docs.finic.ai/downloads/grayson_cli-0.4.0-py3-none-any.whl
grayson eval my-cases.csv --questions https://docs.finic.ai/recipes/check-deposit-fraud/questions.json --label return_likelihood=<column> --label check_problem=<column> --label funds_action=<column>

Each --label names the column with that question's right answer:

  • return_likelihood: a level, such as "Very likely (over 90%)"
  • check_problem: none, counterfeit, altered, stolen, duplicate
  • funds_action: normal_availability, exception_hold, reject

Or run grayson on its own to set up your questions step by step. You get each question's accuracy and a CSV with Grayson's answer next to yours for every case.

Evaluate on your own data

How it works, what you get, and every option.

FAQ

Can an exception hold be based on Grayson's answer under Regulation CC?

For checks deposited at a branch or ATM, Regulation CC lets you extend a hold when you have reasonable cause to believe the check is uncollectible, based on facts that would cause a well-grounded belief in the mind of a reasonable person, not on the check or the depositor belonging to a particular class. The hold notice has to give the reason, so cite the facts Grayson weighed, such as a check number outside the maker's range, not a score. Regulators haven't settled whether Regulation CC's availability schedule covers mobile deposits, so many institutions set mobile availability in their mobile deposit agreement; confirm yours with your compliance team.

Can it tell a scam victim from someone depositing a bad check on purpose?

Add a question for it, such as a noul asking whether the account holder appears to be the victim of a fake-check scam rather than a participant. A message about a new job, an online sale or an overpayment and a long, ordinary account history point one way; a new account followed by ATM withdrawals at several locations points the other. The answer changes the conversation with the customer, not the hold.

What if I don't have check-verification or duplicate-detection data?

Send what you have. Without a check-verification service, Grayson can't compare the check number with the maker's range or confirm that the maker's account is open, so its answers will be less certain. Treat an uncertain answer as a reason to hold and verify with the paying bank, not to release.

Detect fraudulent incoming ACH credits and transfers

Release, hold or return an incoming credit that may be proceeds of BEC, account takeover or payroll diversion.

Detect money mule accounts

Whether an account is passing other people's money through, whether the holder knows, and what to do

Recipes

Every use case, with its questions and cost per decision.

Business email compromise

Decide whether a change to a vendor's bank details is business email compromise, and whether to release, hold or block the payment, from AP, email and login records.

Incoming payments

Decide whether an incoming ACH credit is the proceeds of fraud at the sender, and whether to release, hold or return it, from the account's history, the ACH entry and what happened after it posted.

On this page

ExamplesCall it from your codeThe problemWhat to sendAdd your own policyWhere to call itCost and latencyEvaluate on your own dataFAQCan an exception hold be based on Grayson's answer under Regulation CC?Can it tell a scam victim from someone depositing a bad check on purpose?What if I don't have check-verification or duplicate-detection data?Related recipes