Why Would a New Employer Send You a Check Before You've Even Started Work?
An email confirms a new remote job, and before a single shift has been worked, a check shows up in the mail for “equipment” or “training materials,” with instructions to deposit it and send part of it elsewhere. It feels generous. It’s also one of the more common patterns behind employment-related check fraud.
The short answer
A legitimate employer generally doesn’t need a new hire to receive and redirect money before they’ve started working — payroll, equipment purchases, and vendor payments are normally handled directly by the company itself. A check arriving early with instructions to deposit it and forward a portion elsewhere is a well-documented pattern used in check fraud schemes, regardless of how official the surrounding communication looks.
How this pattern typically works
- A check is issued for more than it should cover. The stated reason varies — equipment, software licenses, a signing bonus — but the amount is usually higher than the supposed expense.
- The new hire is asked to deposit it and send part back. Instructions often point to a specific payment method or a “vendor” who needs to be paid from the deposited funds.
- The original check later turns out to be fraudulent. Because bank deposit rules often make funds appear available before a check has fully cleared, the money sent onward has already left the new hire’s account by the time the original check bounces.
- The person left holding the loss is usually the account holder. Banks generally hold the depositor responsible for a check that fails to clear, even if the funds looked available for a period beforehand.
Why the setup feels convincing
These schemes tend to work because they borrow legitimate-sounding language: an offer letter, a company logo, a friendly HR contact. The mechanics resemble other patterns worth recognizing, like being asked to receive and forward money on someone else’s behalf, which shares the same core structure of using one person’s account as a pass-through. The employment framing just adds a layer of apparent legitimacy that makes the request feel routine rather than unusual.
Why urgency is part of the design
A hallmark of many scams that involve checks or wire instructions is that they push for a fast response, well before there’s time to verify anything independently — the same pattern shows up in reports of pressure to pay immediately for concert tickets or a request to wire a deposit before ever seeing an apartment. Urgency limits the time available to notice inconsistencies, which is exactly the point.
Ways this generally gets verified
- Contacting the company through an independently found number. Reaching out via a number or address pulled from the company’s own official website, rather than one provided in the check-related message, is a standard verification step.
- Confirming with the bank whether a check has actually cleared. Funds showing as “available” in an account is not the same as a check having fully cleared, and banks can generally confirm the difference on request.
- Reporting suspected fraud. Federal consumer protection agencies and financial institutions generally accept reports of this kind of activity, which helps build a broader record even after an individual case is resolved.
The bottom line
A check that shows up before work has even started, paired with instructions to send part of it elsewhere, follows a recognizable and well-documented fraud pattern rather than a normal onboarding process. Verifying independently, through channels not provided by the message itself, is a widely used way to tell a genuine offer from one built around a check that was never good in the first place.