Logo for The Security Title Guarantee Corporation of Baltimore

The Check-Swap Scam That Keeps Paying

Jan 6, 2026 | Blog Posts

Don’t Let Predictability Become a Map for Thieves

The margin for error is tight with real estate transactions and many rely on overnighting checks. That short delivery time helps preserve customer satisfaction. The problem is that there are predictable touchpoints in this process that criminals are picking up on. One intercepted overnight envelope can cascade into rejected deposits, reconciliation nightmares, potential fiduciary exposure, and reputational harm with your referral partners. Old-school check crime hasn’t disappeared. It’s evolved and isn’t going away for one simple reason: it still pays.

How it works

  • Package interception & swap
    The attacker emails an .ics calendar invite that Outlook/Microsoft 365 renders as a calendar event. The event appears legitimate because it’s “already on your calendar.”
The envelope likely came through a drop box at month-end (high-volume times are prime). Thieves are known to open, remove the real check, insert a counterfeit, and reseal—so a legitimate-looking package still arrives, buying them time.
  • "Check cooking" from a quick photo
    The attacker emails an .ics calendar invite that Outlook/Microsoft 365 renders as a calendar event. The event appears legitimate because it’s “already on your calendar.”
Even if the original check never leaves the envelope, an on-the-spot photo of the front is enough to reproduce the MICR line and create a digitally forged check with the same account and routing, but a different payee to a mule.
  • Why it's hard to catch
    The attacker emails an .ics calendar invite that Outlook/Microsoft 365 renders as a calendar event. The event appears legitimate because it’s “already on your calendar.”
Basic Positive Pay flags amount/number mismatches, but not a changed payee line. Unless you’ve enabled Payee-Match, a washed or cooked item can clear. And if the recipient doesn’t scrutinize the replacement check, the counterfeit may not raise alarms until the first bank rejects it.

The good news: In this incident, no payoff or large proceeds were affected. But the mechanics are the same ones being used right now against title agents.

Defense in Layers

Instead of a checklist, think in layers that remove opportunities, shorten exposure, and install tripwires.

Layer 1: Remove the target where you can

Prefer wires or ACH for payoffs and proceeds because paper in transit is the risk vector here. Yes, wire fraud is its own domain, but eliminating paper removes this particular attack surface.

Layer 2: If you must mail a check, close the gaps in transit

Picture the thief’s job: find envelopes that scream “value,” access them unobserved, and get enough data to cash in. Now make each step harder.

 

  • Avoid drop boxes, especially at month-end. Use staffed counters and keep a receipt; require adult signature on delivery.
  • Neutral, tamper-evident packaging. Nothing on the label should hint at “escrow,” “settlement,” or a title company.
  • Set expectations up front. Tell the payee exactly what’s coming (amount, carrier, tracking) and ask for same-day confirmation of safe receipt.
  • Tight internal custody. Limit who can print, sign, and package checks; log hand-offs from printer to envelope to carrier.

Layer 3: Tripwires at the bank

Ask your escrow bank for Positive Pay with Payee-Match, not just amount/number matching. Tools like Rynoh play well here, giving you visibility and alerts that cut the discovery time from days to hours.

Layer 4: If a check goes missing, act like a responder

  • Call your bank immediately to place a freeze/exception-only review on presented items until you’ve reconciled.
  • Notify local law enforcement
  • Document timestamps (print, hand-off, drop-off, tracking scans, call-backs). It speeds bank remediation and any law-enforcement follow-up.

A lot can happen in 10 minutes

It can take less than 10 minutes for a thief to open an envelope at a drop box, photograph the check, and reseal it. That’s all they need. If your bank only runs basic Positive Pay, a washed payee line can slip through. If your recipient doesn’t know to confirm same-day receipt, you may not spot the swap until a deposit bounces and by then a cooked item could be in the clearing system

What changes the ending? Payee-Match + no drop boxes + same-day confirmation. You’ve removed the target, shortened the window, and installed a tripwire.

How to turn theoretical into practical

1. Ask your escrow bank to enable Payee-Match on Positive Pay.

2. Update your disbursement SOP: no drop boxes, adult signature, neutral packaging, and same-day receipt confirmation.

3. Default to wires/ACH for high-value items; keep strict verbal verification procedures.

4. Run a 30-day audit of mailed checks (carrier, timing, outcomes). Look for end-of-month spikes and retire those habits.

Security Title’s Committment

At Security Title Guarantee, we understand the risks our agents face daily. We work closely with our independent agents to promote secure escrow management practices that protect both funds and reputations.

If you have questions about fraud prevention, positive pay services, or escrow account security, reach out to your Security Title agency support representative.

Together, we can ensure that your funds and your clients stay protected.

Back to Blogs

Introducing Secure 1031 Exchange Services, LLC!