Security: Dealing with Dupes

Elizabeth Whalen

As remote deposit capture’s popularity soars, so does the opportunity for duplicate deposits. And the problems multiply when more than one bank is involved.

As remote deposit capture (RDC) grows in popularity among depositors for its convenience and among banks for its potential cost savings, a downside is emerging: the risk of duplicate deposits.

Before RDC, banks captured images of checks and maintained control over the remaining paper check. With RDC, though, the depositor—be it a consumer or business—creates the image, sends it to the bank, and keeps the paper check. That depositor could then deposit that paper check.

Exactly how much difficulty that second deposit causes depends to a large degree on where it’s made.

“Most banks have duplicate detections upfront on their RDC products,” says Phyllis Meyerson, executive vice president of the Dallas-based Electronic Check Clearing House Organization (ECCHO), which establishes rules for check-image exchange. “Within the bank, if you try to put in the same check twice, your bank is probably going to stop it.”

If someone takes the paper check to another bank, though, the problem becomes much more challenging, she says.

“If I deposit a check through RDC and then I walk across the street and I deposit the check at a different bank, those two banks don’t talk to each other. They have no way of knowing the check was deposited at two different banks,” Meyerson says.

More Pain

Contrast that with deposits made twice at the same bank, which are likely unintentional, says John Leekley, chief executive and founder of Remote DepositCapture.com, Alpharetta, Ga.

“When that accidental item happens, it’s an occurrence that’s easily corrected because, if you do that, you’re not going to withdraw twice as much as you were planning on. That money is still going to be in the account, if the bank gave you availability,” he says.

Unintentional duplicates may occur when someone is unsure that a deposit successfully went through the RDC application and, to be certain the deposit worked, either re-deposits the check through the application or deposits the paper check, says Leekley. They may also occur when one member of a household deposits a check through RDC and another member of the household deposits the physical check without knowing about the remote deposit.

Duplicate deposits of the same check at different banks, or cross-bank duplicates, are not a particularly large problem, according to Meyerson, but they do cause more pain to bankers responsible for returns and adjustments than other types of adjustments do.

The novelty of these duplicates only exacerbates that pain, says David Walker, ECCHO’s president and chief executive.

“Most of these are really new occurrences,” he says. “As a result, banks are having to learn how to recognize them and how to deal with them most efficiently. It’s not as easy for them to resolve because they don’t have as much experience resolving them and don’t already have standard processes in place.”

Banks that exchange check images under ECCHO rules or Federal Reserve rules do make warranties to each other against duplicate payments, says Meyerson. It’s important to note, she adds, that if a bank does pay on a duplicate transaction, those rules don’t govern which of the banks that sent the check image for payment must reimburse the paying bank. The rules also don’t favor the bank that has the paper check, she says.

‘A New Toy’

One issue in particular that ECCHO and its members are now facing is what’s known as a holder-in-due-course claim. This scenario begins with someone depositing a check through RDC to a bank account and then taking the check to a check-cashing store.

(For simplicity, this model assumes the person deposits the check only once through RDC. The person could actually deposit the check through RDC at multiple banks before taking the paper check to the check-cashing store.)

Later, the bank paying the RDC check image recognizes the duplicate and so refuses to honor the image that resulted from the paper check cashed at the check-cashing store. The check-cashing store may then file a holder-in-due-course claim against the drawer—the person or business who originally wrote the check.

“The check-cashing organizations are extremely savvy,” says Meyerson. “They’re savvy enough to know what their rights are. Let’s assume they did everything they were supposed to do. They took this check in good faith. They gave money for it. Now it comes back as a duplicate. They will—this is not an ‘if’ or a ‘but’—they will go after the drawer with a demand letter and say, ‘I have a holder-in-due-course claim. Pay me.’”

“And it’s a new claim process for them,” adds Walker. “Because they haven’t historically had holder-in-due-course claims. It’s a new toy they didn’t have before that will help them collect.”

Holder-in-due-course claims frustrate Meyerson. She doesn’t blame the check cashers, but she sees such claims as involving a party—the drawer—who did nothing to cause the problem. People and businesses issue checks and assume that, once a check is paid, they will not be asked to pay the same check again. However, holder-in-due-course claims put them at risk of having to do just that.

The holder-in-due-course concept comes from what Walker calls rather arcane provisions of the Uniform Commercial Code. Historically, the claims weren’t made very often because there were probably limited opportunities in previous iterations of the payments system, he says.

“But with the ability now to have the mix of electronic and paper copies of these checks floating through, it becomes more relevant than it has been for a while,” he says.

The newness of these claims, combined with their complexity, makes them difficult to deal with.

“This is not straightforward. Just having the original piece of paper doesn’t make you a holder in due course. There are certain requirements for a holder in due course,” Walker says. “So we’re all having to go back and try to figure out what this provision really means. But what creates the opportunity is the bank selling the RDC product to begin with.”

‘A Growing Concern’

ECCHO is working with its members to develop a set of suggested operational practices for banks to deal with duplicates, and Meyerson adds that at least one cross-bank duplicate detection system is available. Some of the big banks are using it, she says, but a comprehensive way to detect cross-bank duplicates is still in its infancy.

Banks that are experimenting with cross-bank duplicate detection are focusing on higher-value deposits because of the higher risk involved, says Bob Meara, senior analyst at Celent LLC, a Boston-based division of consultancy Oliver Wyman.

“But since there’s a cost to do a check, there’s a questionable [return on investment] in doing lots of those checks,” he says.

Losses related to RDC have historically been low, Meara adds, so spending money to reduce these losses can be difficult to justify.

To be truly useful, such a system would have to operate in real time, says Christine Barry, research director for wholesale banking at Boston-based consulting firm Aite Group LLC.

Otherwise, “somebody could still quickly make an RDC deposit and then run to the corner and make a deposit at a branch or another institution,” she says. “I don’t know if that’s something the industry would be able to take on.”

There’s no data on how many RDC duplicate deposits occur, Meara says, but Celent has surveyed hundreds of U.S. banks annually over the last three years, asking about the amounts of and sources of losses related to RDC.

Meara had thought the biggest source of losses would be consumers, “because there are millions of consumers now using smart-phone cameras to deposit checks, but that’s not where the losses have occurred,” he says. “They’ve occurred in a variety of ways, not just duplicates. There’s been check kiting and there have been altered fraudulent items that happen to be deposited via remote deposit.”

The surveys indicate that 90% of banks that offer RDC have not lost any money as a result of doing so, Meara says. “But there is a growing concern and a somewhat growing trend of loss incidence,” he says.

‘You Can’t Hide’

Banks that want to prevent those losses need to look at all their deposit channels, not just remote deposit, he adds.

“A significant percentage of banks in last year’s survey who said, ‘Yes, I incurred some loss,’ incurred that loss at the teller line because they gave funds availability to an item that was previously deposited at another bank using remote deposit,” he says. “The bank taking the loss didn’t have anything to do with remote deposit. It happened to be a teller deposit, but it could have been an ATM deposit also. In that context, you can run but you can’t hide. Whether you like it or not, your institution is exposed to duplicate-presentment risk.”

An increasing number of banks are applying availability schedules to all check deposits, says Leekley, as a way to mitigate this risk.

“I see more and more banks providing availability one or two days after deposit, which makes sense. That item needs to be cleared through the drawn-on bank. That drawn-on bank needs to process it, verify it’s a legitimate item, and either pay it or return it. That does take time. It’s faster than ever with remote deposit capture, but it does indeed take a day or two,” he says.

Another way banks can protect themselves from losses is by imposing daily limits on both the number of checks and total amounts that may be deposited, says Barry. She focuses on how corporations and small businesses have adopted RDC, and she notes that, overall, banks have exercised caution in deploying RDC to commercial customers.

She estimates that less than 20% and possibly less than 10% of corporates use RDC.

At least some of those low adoption rates stem from banks not doing a great job of clearly linking the service’s value to its cost to commercial customers, she says, but she emphasizes that banks have been very careful about which clients they offer RDC to.

“There’s a lot of risk management going on behind the scenes before they even make this product available to a customer,” she says. “It would be a customer the bank has a deeper relationship with where there’s a higher level of trust between the two. In that way, the bank significantly lowers the odds of purposeful fraud. Now, of course, that customer could accidentally make a repeat deposit, but the fraudulent ones will be minimized.”

Just how many RDC duplicates are fraudulent versus unintentional is impossible to determine, says Dan Fisher, president and chief executive of The Copper River Group, a bank-technology and payments-system consulting firm based in Fargo, N.D.

It’s also unclear whether the potential for RDC fraud is crimping the growth of RDC, says Fisher, in part because of the lack of data and in part because of other factors encouraging RDC.

“There’s a huge amount of pressure to go all-electronic,” he says. “More and more banks are going to be compelled to roll out consumer remote deposit capture and small-business remote deposit capture just to stay competitive with other financial institutions in the industry, so I don’t see the products diminishing.”

Although consumer checks will likely descend to extremely low numbers, Fisher says, businesses will likely continue to write checks to both other businesses and consumers. He believes something close to 15 billion checks will continue to be written annually.

“I don’t think checks are ever going to go away,” he says. 

Fisher suggests banks develop customer profiles similar to those used for credit cards to monitor all types of transactions. Such systems detect unusual behavior that could indicate problems like duplicates or fraud. He adds that banks’ agreements with their customers are another risk-management tool. Agreements should include specific standards about the types of behavior customers are permitted to engage in, he says.

ECCHO’s Meyerson adds that each bank should work with an attorney to ensure its agreement reflects the bank’s policies and what it wants its customers to do.

“That’s their only defense,” she says. “That agreement is the only thing the bank really has to go back on.”