Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Chase has this app that allows you to snap a picture of a check with your phone and deposit that check into your account.

How do they prevent:

  1. Someone from depositing a check that's not written to them? (I can’t imagine this app is smart enough read the scribble “to” Filed) Are they leaving it up the check writer (who may not even be a Chase customer) to catch this and complain?
  2. What's to stop someone from depositing the check to Chase by Phone,then 2 mins later walk into another non-Chase bank and deposit it there?
  3. What's to stop someone from depositing the same 12 every other month?

The only thing I can think of I that they are simply hoping that these thing will happen in such small quantities that they can handle it on a case by case basis IF the check writer complains...

You can literally walk into you AR Dept when the clerk is out to lunch and snap a picture of a 100k check! Sure, it's stupid to be so bold with such a large check but what about small ones? In my mind there there is a good chance check will not be rejected when the clerk deposits it in the company's bank that afternoon.

share|improve this question

migrated from programmers.stackexchange.com Jan 3 '13 at 16:18

This question came from our site for professional programmers interested in conceptual questions about software development.

1  
@apsillers that's the question! Are\Can they automate this? How? There is NO WAY Chase is checking each one manually. –  Morons Jan 3 '13 at 14:22
3  
How can they automate physical deposits of checks? They either do or don't process each one manually -- there's no reason why the policy should suddenly change because the check is submitted by image. (Also, as for you concern #2, individual checks each have a check number, which the originating bank would likely verify and work to manually resolve duplicates submissions.) –  apsillers Jan 3 '13 at 14:26
1  
Also, it's generally assumed that the severe legal penalties for check fraud will incentivize people not to break the law. –  apsillers Jan 3 '13 at 14:30
    
In regards to point #1, it's possible to sign over a check written to you to someone else. If I do that, the equivalent operation is that I deposited the check, then write you a new check for the same amount - we're just making this a little simpler for us (but not the bank). This may be how some check-cashing (payday loan) operations work. In that case, it's none of the original writer's business what I'm doing with the money. –  Clockwork-Muse Jan 3 '13 at 22:45
    
Our company has just encountered two payroll checks that were deposited by smart phone and then waiting a a month to physically deposit the paper check. Two different individuals did this. It's a good thing we conduct bank reconciliations every month. Now what to do with the employees....... –  user32847 Nov 5 '13 at 20:59

5 Answers 5

up vote 9 down vote accepted

This is precisely as secure as depositing a check at the ATM.

You could go up to an ATM, pop in your debit card and say you're depositing $3500, put a blank piece of paper in a deposit slip and deposit it.

Same rules apply with the tech you describe as an ATM: Try to fool it, and when time comes around to actually push the routing numbers and bank account on the check through for a debit on the other end, the debit fails and upon inspection they realize it's not a bounced check and it's your fault. The money is debitted back out of your account and you get penalized for being a wanker, they may even close your account for such behaviour altogether as it's against their TOS.

share|improve this answer
    
The ATM Takes the Check (so you no longer have it).. and each check is looked at by a person in that Branch. –  Morons Jan 3 '13 at 14:25
2  
@Morons, there isn't someone inside the ATM that examines it immediately, it can be a couple days before the deposited checks are examined. Banks have had to deal with straight up paper check forgery for years, they've got a grip on how to manage it. –  whatsisname Jan 3 '13 at 16:06
3  
@Morons - Most checks have code that is read by a machine. The only data that isn't readable by a machine is the amount which is easily handled by OCR in the majority of cases. I would be shocked if more then 10% of checks scanned at an ATM is actually seen by a human unless there is a reported problem with said check. They have tools to filter out everything that can be handled by machine. The bank will take your word on the amount for the check until it fails to be withdrawn from the account in question. –  Ramhound Jan 3 '13 at 17:17
1  
This is only correct for envelope depositors. Newer devices include OCR that can read the check, allowing you to deposit without an envelope and providing extra security for the bank. –  Yamikuronue Jan 3 '13 at 21:07

Spacing out the time of deposits could be a way to get around the system. That is, if you deposit via mRDC today, then wait three months, you could deposit (or cash) via walk-up teller, and probably the system is not going to go back several months to compare check numbers or amounts.

share|improve this answer

My bank requires that any check deposited using a smartphone camera be endorsed by the depositor with the words "For E-Deposit Only At (My Bank Here)". This is a derivative of the very well-known measure to prevent check-cashing fraud; writing "For Deposit Only" on the check, thereby preventing anyone who finds or is entrusted with the check from cashing it.

Basically, check depositing by image is really no different than depositing by any other means, including in person at the teller window. The check is scanned, the amount entered (and verified, at some stage), and the information about the payer and payee accounts, check identification info, and the amount is turned into an ACH transfer request. Those are sent between banks in a matter of seconds or minutes (they're usually accumulated and transmitted in batches), while the check then leisurely makes its way by mail or courier back to the bank holding the account against which the check was written.

There are already many security measures inherent in this system; A double-payment of a single check is something they already look out for and prevent, notifying the account holder who will work it out with the real payer and both banks. During this process, the exact nature of any fraud will be uncovered; did the real payee attempt to deposit it twice? Did a third party get ahold of the check and e-deposit it with their bank? Finance and accounting is full of checks, balances and a very strong paper trail; it's usually very easy to trace what really happened.

share|improve this answer

These questions aren't really specific to the app, they all relate to physical deposit issues as well. I doubt anyone will be able to tell you how it is truly done, but here are some general ideas:

  1. What happens if someone deposits a check (in branch) intended for someone else with a similar name? Someone has to complain at some point, it could be the check writer, or it could be the real recipient when they try to deposit the check in earnest and it bounces. At this point there is a known situation, and the source bank can track down where the money went, at which point they would know who falsely deposited the check and would report them to the police.
  2. The source bank needs to clear the funds before the transfer can be made; the source bank will not allow funds withdrawn twice on the same check number.
  3. See 2.
share|improve this answer

Chase or any bank large enough to offer mobile deposit is going to be more sophisticated than waiting until some one complains to prevent fraud in mobile or in person deposits.

They start out by limiting their risk. If chase is typical of other banks they limit the size and number of checks a customer can mobile deposit in a day or a week. They would also have a hold on funds based on a number of different factors including the relative amount, past experience with the customer, who the check was from etc.. These would more complex than simple rules think more like heuristics that compare past fraud with current activity. I would imagine this software would screen out checks that are questionable for varying levels of verification and follow up.

Chase probably still takes on some (additional) risk but you have to keep in mind that attempting to submit the same check multiple times or to multiple banks would be considered fraud and would likely be pretty easy for them to prosecute.

share|improve this answer

protected by Community Jan 23 at 23:41

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.