From Theft to Deposit: How Check Fraud Happens—and How to Stop It
- Ethan Kratt
- May 6
- 2 min read
June 10th, 2025
1pm ET / 12pm CT
Check fraud continues to pose a significant and evolving threat within the financial ecosystem, fueled by a robust underground economy. In this presentation, we’ll take attendees deep into the cybercriminal underworld, where the sale of stolen checks is just the beginning. These illicit markets also traffic in check templates, USPS arrow keys, alteration tools, and mule recruitment services—forming an interconnected supply chain that supports large-scale fraud operations.
We’ll break down the methods fraudsters use to alter checks, including washing, reprinting, and digital editing, and examine how these counterfeit instruments ultimately make their way into the financial system through money mules. Attendees will leave with practical recommendations and key considerations to help financial institutions better detect, prevent, and respond to check fraud.
Key Takeaways:
Tracking the Underground Trade: Get a behind-the-scenes look at how stolen checks are bought, sold, and circulated across dark web forums—and what that means for your institution.
Spotting Alteration & Mule Activity: Learn how to recognize forged signatures, altered payee fields, and red flags tied to mule accounts used for fraudulent deposits.
Disrupting the Fraud Chain: Understand how fraudsters coordinate check scams and discover actionable steps your team can take to stop fraud before it hits your bottom line.
Meet the Presenters:
Mara Gibor, VP of Intelligence Operations at Q6 Cyber
Mara serves as the Vice President of Intelligence Operations at Q6 Cyber, where her leadership over the past 9 years has been instrumental in guiding teams of intelligence analysts who are responsible for darkweb/e-crimes intelligence research and analysis. She has been interviewed by news stations across the country for topics that include check fraud, malware, social engineering and more. Prior to Q6 Cyber Mara held roles as a cyber security analyst in Israel. She also has a MA degree in Counter Terrorism and Security.
Maria Noriega, Intelligence Products Manager at Q6 Cyber
Maria Noriega is the Intelligence Products Manager at Q6 Cyber and focuses on financial cybercrime trends. Over the past 3 years, Maria has been tracking the stolen check market and check fraud trends in underground communities and has been featured on CNBC and other media outlets. Maria’s background includes a MPhil from the Faculty of Law at the University of Oslo, Norway, and a B.S. in Criminal Justice from Florida International University, as well as certificates in forensic accounting and cryptocurrency. Maria is an experienced researcher and is internationally recognized and published for her work within the tech-centric criminal justice field.
