Review a Treasury Check Fraud Pattern

A controller calls you three times in one week about two checks with altered payee names, and by the third call she wants a promise that this will never happen again. That is the moment a treasury specialist can get this conversation wrong. You cannot guarantee fraud prevention, and you cannot investigate who altered the checks yourself, but you also cannot brush off a real pattern with a form letter. The way you handle this call decides whether the customer leaves with a usable plan or a vague sense that nobody is taking the problem seriously.

Why This Conversation Goes Wrong

A finance team that spots a second altered check in the same month is not calm. The controller wants certainty, and certainty is the one thing you cannot offer. If you try to soothe her by guaranteeing that a new control will stop future loss, you have made a promise the bank cannot keep and set up a worse conversation later. If you go the other direction and stay purely procedural, reciting policy without acknowledging the pattern, the customer hears indifference. Both failures come from the same root cause. The specialist treats the call as a single transaction dispute instead of what it actually is, a request for a repeatable response process.

There is a second trap specific to fraud calls. Employees under pressure often want to act fast, and fast sometimes means calling a phone number from an email that arrived that morning, or forwarding check images through an unsecured channel to speed things up. Your job includes slowing that impulse down without sounding like you are stalling.

How To Prepare Before You Pick Up The Phone

Before you respond to a suspected fraud pattern, map out four roles in your head. The observer is the employee who spotted the discrepancy. The internal decision maker is whoever at the company owns the response, usually the controller or treasurer. The verified bank contact is the specific fraud or treasury support channel your institution has published, never a number pulled from an inbound email. The update owner is the person who will receive the next factual update once the review starts.

Know your bank's verified contact information cold, and know the difference between it and anything that might arrive through an unexpected message. This distinction matters most exactly when the customer is anxious and wants to move quickly, because that is when people click the wrong link or dial the wrong number. Also review what information your fraud team actually needs to open a case, typically the check number, amount, date, payee as issued, payee as altered, and the account it drew from. If you know this list before the call, you can guide the controller through it instead of improvising.

One more thing worth checking ahead of time, since treasury specialists juggle more than one type of risk conversation. If you also handle currency questions for this same client, it helps to review how you discover a treasury foreign currency exposure so you keep the two conversations separate in your head. A fraud pattern call and an exposure review call require different tones, and mixing them confuses the customer.

What To Say When The Customer Reports A Pattern

Here is how a call like this can go. The controller from a construction supply company opens with urgency. She says, "This is the second check this month with the payee name changed after we issued it, and I need to know the bank is going to stop this from happening again."

You do not answer that request directly, because you cannot promise a future outcome. Instead you ask, "Where did your team first notice the altered payee, and what can you preserve right now without touching the original record, meaning the check image, the date it cleared, and who on your side first flagged it?" That question does two things. It moves her from a general fear to a specific, factual account, and it protects the evidence her own fraud review will need later.

She answers with the details, and then asks again, more directly, "Can you at least tell me if switching to positive pay would have caught this?"

You stay honest about the limits of what you know. You say, "I cannot tell you what would have caught a specific altered check without our fraud team reviewing the images, and I am not going to guess who made the change. What I can do is get this in front of the right team today. Here is the verified fraud reporting line, not anything from an email, and here is what they will ask for. I will also confirm who on your end should expect the next update and by when."

She agrees, and you close the call by repeating the two concrete outcomes, the report going in today through the verified channel, and a named person on her team getting the next factual update once the bank's review has something to share.

Mistakes That Avoid Undoing A Good Response

A few habits sink this conversation even when your intentions are good. First, do not guarantee that any control, positive pay, dual approval, or anything else, will prevent future fraud. Controls reduce risk. They do not eliminate it, and saying otherwise sets up a broken promise. Second, do not speculate about who altered the check, even when the controller is convinced it was a specific employee or vendor. That determination belongs to an investigation, not to a phone call. Third, do not use contact information the customer received through an unverified email or text, and do not let the customer's urgency push you into skipping that check yourself. Fourth, do not promise a recovery outcome or a timeline for reversing funds. You can promise a process and a next update, nothing more. Fifth, do not let the call end without a named owner for the next step on both sides. A vague "someone will follow up" leaves the customer anxious and gives you nothing to be held to.

How To Practice And Score This Call

This is a conversation that improves with repetition, because the instinct to reassure with a promise is strong and it does not go away just because you know better in theory. Run it with a manager playing the anxious controller, and push the role play to the point where the controller demands a guarantee twice, not once. Score yourself on three things, whether you asked for facts before offering direction, whether you avoided any promise about prevention or recovery, and whether you closed with a specific report the customer receives, meaning the verified contact used, the case details captured, and the name of who owns the next update.

If you want a structured way to run this without pulling a colleague away from their own work, DealSpeak's banking practice conversations let you rehearse this exact scenario against an AI counterpart that pushes back the way a stressed controller would, and it scores your response on the same criteria. Pair it with a treasury fraud response tree so your team has a shared reference for who does what once a call like this ends.

A treasury specialist who handles this well does not solve the fraud case on the phone. You give the customer a clear next step, protect the evidence they need, and hand the case to the people equipped to investigate it. That is the whole job, and doing it consistently is what customers actually remember.