TL;DR: A fake voided check is a routing number and account number presented as a bank document, either a real check image edited after it was created or a check generated from scratch. The Association for Financial Professionals' 2026 Payments Fraud and Control Survey found checks were subject to fraud at 58 percent of organizations in 2025. A VOID mark and a bank logo survive a visual review and say nothing about whether the applicant controls the account.
A Voided Check Is a Payout Instruction
Payroll, accounts payable, lenders, and marketplaces collect a voided check so the routing number and account number can become an ACH credit destination or an ACH debit source. The VOID keeps the paper from being negotiated. The exposure is the instruction underneath. A file that would never clear as a deposit can still redirect a paycheck, a vendor payment, or a seller withdrawal.
Edited-after-creation starts with a real check. Someone scans it, or starts from a bank image, then changes the account number, the name, or the routing number, or places VOID on a check that was never voided on paper, and saves. The later save is the problem. This is the same tampering family as a fake bank statement that began as a real export.
Generated-from-scratch never passed through that bank. A template, a copied layout, or a generative model produces a page that names an institution, prints numbers, and carries a VOID. FinCEN's September 2024 analysis of mail-theft-related check fraud found the same split on negotiable items stolen from the mail: 44 percent were altered and then deposited, and 26 percent were used as templates to create counterfeit checks. Those percentages come from BSA reports on stolen checks.
A third file is authentic and still the wrong instruction. The image is a genuine voided check on an account the applicant does not control: a stolen specimen, a relative's check, or a mule account in a matching name. File history can be clean. The failure is ownership. Enrollment is the usual setting: a new hire attaches the check beside a pay stub for the same hire, a vendor uses one to change a remittance account, or a seller uses one to redirect withdrawals.
Tells That Still Work, and the Ones That Don't
A glance checks the parts that copy easily: a bank logo, a security background, the word VOID, and a line of digits along the bottom.
A routing number is assigned to an institution. The name on the check should be that institution, or a program whose deposits settle there. A fintech brand on a partner bank's routing number can be legitimate. A national bank's name on a routing number assigned to an unrelated institution is a different finding. So is the right bank beside an account number that does not belong to the person named.
The routing number, account number, and account holder should match the payroll form, the vendor portal, or the seller account. A one-digit drift, a personal name on a business payout, or a bank that appears nowhere else in the file is a consistency break. KYB document review already asks whether the business's other records name the same party, and the voided check has to agree.
A paper check voided in ink and then scanned is one production. When the void arrives in a later modification than the check image, the file says the mark and the specimen were made apart. Gateways and phone exports also resave files, so a later timestamp has to be read against what changed. Across enrollments, the same starter layout from unrelated applicants is a recycled pattern.
Competent fakes clear a glance. The 2026 Federal Reserve Financial Services Risk Officer Survey found that 63 percent of financial institutions reported check fraud attempts in the prior 12 months, and 32 percent reported an increase in counterfeit checks. Those figures count negotiable check fraud at banks, and the counterfeit is a document before it is a deposit.
How Detection Actually Works
Detection reads how the file was made, then asks whether the applicant can use the instruction. Six signal classes cover edited-after-creation and generated-from-scratch. Document fraud controls across a bank ask the same questions of statements.
Production method asks how the bytes were made. A paper scan, a bank image system, a consumer PDF editor, and a generative pipeline leave different records. Edited-after-creation and generated-from-scratch are separate findings, and the case note should say which one applies.
Timestamp trail asks whether creation, modification, and the void sit in a plausible order. A void that shows up only in a later save needs a plain explanation, such as a portal that rewraps uploads, before it is treated as tampering.
Issuer matching asks whether the file's producer and the named institution can be the same party. A consumer editor does not issue a bank's check images. The routing number still has to belong with the name on the page, including a partner-bank program that prints a different brand.
Consistency asks whether the routing number, account number, name, and payout form describe one account. The digits on the face and the account line along the bottom should name the same institution and the same account.
Model artifacts asks whether generative tooling, or an image-only wrapper, left traces a standard viewer does not show. A claimed photo of paper with no photographic production behind it belongs here, as does a page that imitates a check without the structure of a scan.
Recycled patterns asks whether this specimen, void stroke, or account number has already arrived from someone else. One upload cannot show serial reuse. Prior enrollments can.
A real photo of the right person's check can pass all six. File review answers whether the file is false. Account validation answers whether the instruction can be used.
What to Do With a Suspect File
Hold the payout instruction and keep the original bytes. Naming the failed field tells the applicant what to change on the next upload. Test the account with a method that reaches the bank.
Nacha's WEB debit account validation rule is the line a voided check blurs. On first use of an account number, or on a change to it, a WEB debit originator must validate that the account is open and can accept ACH entries. Open is the minimum. Ownership is a higher bar, appropriate when the originator's risk makes a stricter check commercially reasonable. Nacha points to a prenotification, a micro-entry the receiver confirms, a validation service from the ODFI or a third party, and an API. A voided check is absent from that list. An unreturned prenote shows the account can post, and a confirmed micro-entry shows the applicant can see it.
Sort the finding before the outcome. An edited or generated file leaves the instruction unverified, so the credit or debit waits on a successful validation. A clean file in the wrong name is an ownership failure. A matching file that fails micro-entry confirmation is an access failure. The case note should say which numbers disagree and whether the void shares the image's production history.
Reject the document when confirmation misses the policy window, and close the enrollment when no other proof is allowed. If the institution is a bank and the facts support suspicion, put the file in the fraud and BSA process and retain the bytes. Keep the failed signal out of anything the applicant will read. Before the note is final, check a document in the Watchdoc playground and compare the x-ray with the case. The first file is free, and no email is required.
Where Sphinx Fits
Sphinx scores the voided check and shows the evidence under the score. Watchdoc runs production method, timestamp trail, issuer matching, consistency, model artifacts, and recycled patterns, then returns a verdict with the manipulation highlighted. Clean files clear in under 28 seconds, published verdict accuracy is 94.3 percent, and the price is $0.45 per document with no seats and no platform fee. Teams can x-ray the file on the same playground, which includes a 50-document free tier.
Frequently Asked Questions
How can you tell if a voided check is fake?
Compare the bank name with the institution on the routing number, the numbers on the check with the payout form, and the VOID mark with the file's production history. A real logo and a clean VOID can sit on a fake, so a visual pass is a weak result on its own.
Does a VOID stamp prove a check is genuine?
VOID means the item should not be negotiated. The mark can sit on a real check, a stolen image, or a generated page. Whether the file is genuine depends on its production history and on whether the account belongs to the person who sent it.
Is a voided check enough to verify a bank account for ACH?
Nacha's minimum for WEB debit originators is an open account that can accept entries, tested with a prenote, a confirmed micro-entry, or a validation service. A voided check leaves open whether the account can post and whether the applicant can see it. Payroll credits need the same test, because the loss is a payment to the wrong destination.
What is the difference between an edited voided check and a generated one?
An edited voided check began as a real check image, and someone then changed the name, the routing number, the account number, or the void mark and saved. A generated voided check was built to look like a check and never came from that institution. A search for pages that look fake misses a real image that was edited.
Should you reject an employee or a vendor when the voided check fails?
Reject the payout instruction and follow written policy on the relationship. Keep the original file and test the account, for example with a micro-entry the person must confirm. Close the enrollment if confirmation never arrives, and leave the failed signal out of the message back.
.png)
