The check wasn't in the mail — it had been stolen.

But by the time Jeremy Dohm learned his $5,752.87 check to a Michigan supplier had been purloined and counterfeited, his New Prague car wash equipment business was out $55,752.87, the amount printed on the sham check.

"It was a stunning moment," he said.

He thought his bank, Minnwest, would cover the loss. But the bank claimed it wasn't responsible. The bank that accepted the counterfeit check in Michigan, JPMorgan Chase, finally ponied up his $55,753, after three tense weeks.

Dohm learned the hard way that check theft via the U.S. Postal Service has surged in recent years. While some thieves still simply plunder checks from residential mailboxes, the illicit trade has gotten more sophisticated and uglier.

The robberies of mail carriers have increased, and thieves also have targeted master keys that can open up collection boxes. And criminals have upped their game, using better technology to alter, counterfeit and market stolen checks.

"We are talking about organized crime," said David Maimon, a Georgia State University professor who specializes in cybercrime and has documented the burgeoning market for stolen checks on the dark web.

When Maimon started his stolen check research in 2020, he found about 400 checks on the dark web per month. Now, that number is around 7,000. The dark web is a marketplace for criminals, including peddlers of stolen identity and financial information.

A nationwide surge in check fraud targeting the U.S. mail started during the pandemic, according to the U.S. Financial Crimes Enforcement Center (FinCEN), a division of the U.S. Treasury Department.

From March 2020 through February 2021, USPS saw a 161% increase in mail thefts, with criminals generally looking for checks, according to the division. And from 2020 through mid-2023, bank reports of check fraud soared, FinCEN reported last month.

"Check fraud is at a scale we have not seen in the past," and mail theft is the "number one" cause, said Paul Benda, executive vice president of risk, fraud and cybersecurity at the American Bankers Association, a trade group. "The amount of money that can be made is staggering."

Thieves more sophisticated

The rise in check theft comes paradoxically as checks have been increasingly supplanted by electronic payments. Still, many companies, including Dohm's, use both payment systems.

"Some vendors just prefer a check," Dohm said.

His business, Autowash Systems Inc. (ASI), builds, repairs and services car wash systems, ringing up just north of $20 million in sales annually and employing about 50. The company focuses on the Upper Midwest, but has suppliers across the country.

ASI's pilfered check was headed to ABC Wash Systems in Rochester Hills, Mich. It was one of 15 checks picked up by a postal worker at ASI's office on Aug. 20. The other 14 checks arrived at their intended destinations.

Dohm said he discovered the missing check after ASI's controller, Stephen Mueller, received a call on Sept. 5 from a PNC Bank branch in Texas. PNC had been presented with a $5,753 check from Dohm's company, made out to a woman in Manvel, a city 25 miles south of Houston.

PNC asked for verification of the payee's identity. Mueller had never heard of her, but the check carried the same number and dollar amount as the check ASI had written to ABC in Michigan. PNC did not honor the bogus check.

After the PNC call, Mueller rushed to scrutinize ASI's checking account.

He found that another bogus check with the same number as the ABC check had been honored on Aug. 30 — but for $55,753. It was made out to a man in Harper Woods, Mich., a Detroit suburb about 30 miles southeast of ABC's location.

Dohm called his bank, Redwood Falls-based Minnwest, to figure out what happened.

He said the bank, which has a branch in New Prague, told him the check was cashed by JP Morgan Chase in Michigan. Dohm said Minnwest also told him that the checks presented to Chase and PNC were counterfeit versions of the check originally made out to ABC.

Minnwest told Dohm it was not responsible, and he would have to recover his stolen money from Chase. On Sept. 5, Minnwest sent an indemnity request to Chase.

Dohm reported the incident to the New Prague Police Department, which is investigating. He also filed a report with the U.S. Postal Inspection Service, which has been plenty busy in recent years dealing with the huge increase in check thefts.

Robberies of U.S. postal workers and property increased sevenfold between fiscal years 2019 and 2023, according to a May report from the U.S. Government Accountability Office.

Besides the surge in stealing "arrow keys" — the master keys that open collection boxes — postal inspection audits have also turned up lax security for arrow keys at post offices around the country, including in Minnesota. A Postal Service audit released earlier this year found that 17 arrow keys were missing at an Eagan branch.

Banks push prevention to customers

Dohm said he was dumbfounded that the $55,753 check was cashed in the first place, particularly since it was a fairly large amount originating from a business.

"We don't write checks often to individuals, if ever," he said.

The phony ASI check was deposited into a Chase account at an automated teller machine, the bank said, declining to disclose the ATM's location.

Suspicious the check could be fraudulent, Chase said it "restricted" the depositor's account the day after the deposit was made. That means the depositor couldn't access the funds, though the check was still debited from ASI's account at Minnwest.

Chase declined to comment further on the fraud's particulars.

On Sept. 20, Minnwest informed Dohm that Chase had recovered his $55,573 and the money had been credited to his account. The bank told Dohm he got his money back only because Chase still had access to the illicit funds on deposit.

Dohm said he wasn't too happy with Minnwest's response to the incident.

"The attitude was, 'I'm sorry and it's too bad that it happened, but there's not much we can do,'" Dohm said.

The bank, in a statement, said that "in any attempted fraud situation, Minnwest Bank prides itself on making every effort to remediate the impact to our customers, and to help educate our customers on how to best protect their operations against future fraud attempts."

Minnwest told Dohm that ASI was liable for the loss. That's because after an attempted check fraud earlier in 2024, ASI had declined a $35-a-month service from the bank called "positive pay," which individually reconciles each cleared check against the original.

Dohm said Minnwest didn't make it clear that he would be liable for check fraud if he didn't sign up. ASI did upgrade to a higher security check paper. But the new check paper didn't stop the counterfeiters.

Now, he's signed up for Minnwest's positive pay.

Banks "would really love to get people off checks," said Benda of the banking trade group. "Checks are an inherently insecure form of payment."