How can an HOA protect its bank accounts from payment fraud?

By OurHOA · General information · Revised November 2, 2026

How a volunteer HOA board can stop fake vendor invoices, spoofed board emails, and check fraud, plus the online banking controls and first steps if money goes missing.

Part of the HOA board handbook: treasurer and money.

The threat is usually outside, not inside

When boards think about losing money, they think about a treasurer who embezzles, which is what fidelity insurance and the two-signature rule are for. Our guide on fidelity bonds and embezzlement covers that risk. The losses that hit small associations more often now come from outside. Someone spoofs a board member's email and asks the treasurer to pay an invoice today. A vendor's email account is hacked, and the next invoice arrives with new bank details. A dues check is stolen from a mailbox, washed, and cashed for a larger amount. None of these needs an insider, and a volunteer treasurer working from a personal laptop at night is an easy target. The fixes are cheap. Most of them are a written rule and a bank setting.

How the common scams work

Business email compromise is the one to plan for. The FBI's Internet Crime Complaint Center describes it as a scam aimed at anyone who transfers funds, usually through a compromised or look-alike email account. In an HOA it tends to look like this. An email that appears to come from the board president asks the treasurer to wire a deposit to a new contractor before the weekend. Or the landscaper's real email account, now controlled by a thief, sends a routine invoice with a note that the company changed banks. The message is polite, the amount is plausible, and the pressure is time. Check fraud is the second pattern. In February 2023 FinCEN, the Treasury bureau that tracks financial crime, issued an alert on a nationwide surge in check fraud tied to mail theft. Checks mailed to or from the association are stolen, altered with chemicals, and deposited. The third is account takeover: a thief gets a board member's online banking password, often reused from another site, and sets up a new payee.

Rule one: verify every change by phone

Adopt one rule and write it into the board's financial controls policy. Any change to where the association sends money gets confirmed by phone, using a number the association already had on file before the request arrived. Never use the number in the email asking for the change. That covers a vendor's new bank account, a new payee, a first payment to a new contractor, and any request to pay urgently outside the normal approval process. The same rule applies inside the board. If the president emails asking for a payment, the treasurer calls the president. A real board member will not mind a thirty-second call. A thief cannot answer it. Keep a short log of each verification: date, who was called, and at what number. It takes a minute and gives the next treasurer a habit to inherit.

Online banking settings worth turning on

Sit down with the bank's business services contact and go through these. Give each authorized person their own login; never share one username. Turn on multi-factor authentication for every user, and use an authenticator app rather than text messages where the bank supports it. Where the bank offers dual control, require one person to set up an ACH payment or wire and a second person to approve it. Set daily and per-transaction limits that match the association's real bills; a 60-home HOA rarely needs to send more than its largest monthly vendor payment in a day. Turn on alerts for large withdrawals, new payees, changed contact details, and new users, and send them to at least two board members. Give a non-treasurer director read-only access so someone besides the treasurer sees activity. Ask about positive pay, a service in which the bank checks each presented check against a list of checks the association actually issued and holds any mismatch for review. For an association that still writes paper checks, it is the strongest defense against washed checks.

Cut down on paper checks going through the mail

Every check in a mailbox is a check that can be stolen. On the outgoing side, pay regular vendors by ACH through the bank's bill pay, which also leaves an electronic record, and mail the checks you still write from inside a post office rather than a curbside box. On the incoming side, give owners an electronic way to pay dues so fewer checks travel by mail at all; our handbook guide on moving HOA dues to online payments covers the switch. If the association uses a bank lockbox, checks go straight to the bank. If a volunteer collects checks from a home mailbox, collect them promptly and deposit them the same week. Reconcile the accounts monthly and compare cleared checks against the check register, so an altered payee or amount is caught within weeks rather than at year end. Our guide on how an HOA reconciles its bank statement walks through that review.

Know your deadline for disputing a bad check

The bank statement is the only early warning for a washed or forged check, and the law puts the job of reading it on the association. Every state has adopted some version of the Uniform Commercial Code rule that a customer must review statements with reasonable promptness and report an altered check or a forged signature. The outer limits differ. In Texas, Business and Commerce Code Sec. 4.406(f), and in Colorado, C.R.S. 4-4-406(f), an association that does not report an altered check or an unauthorized signature within one year after the statement was made available loses the claim against the bank, however careless the bank was. Florida gives 180 days for alterations and unauthorized signatures, and one year for forged endorsements, under Fla. Stat. 674.406(6). The deadline that actually catches boards is shorter. In all three states, once the association has had a reasonable time to review a statement, never more than 30 days, the bank can refuse to cover later checks forged or altered by the same person and paid before the association reported the first one. A thief who gets one check through unnoticed can keep going for months on the association's dime. The deposit agreement can shorten these windows further, because the code lets the bank and customer change many of its rules by contract; Texas Sec. 4.103(a) is an example. Ask the bank for the reporting deadline in writing and put it in the controls policy. Electronic payments do not get the consumer safety net either. The federal error-resolution rules in Regulation E cover only accounts held primarily for personal, family or household purposes, so an HOA operating account runs on the business terms in its agreement. Assign a director other than the treasurer to open every statement within 30 days of its date.

Protect the email accounts that move money

Most of these scams start with an email account. Use association addresses for board roles, such as a treasurer address on the association's own domain, rather than personal accounts, so access can be handed over when volunteers change. Turn on two-factor authentication for every board email account. Use a password manager and a unique password for the bank login and the treasurer's email. Be suspicious of forwarding rules you did not create, because attackers often add a rule that hides the bank's replies. When a board member leaves, remove their online banking access and email access the same week, after confirming at least two current signers can log in. Update the signature cards at the bank at the first meeting after each election, and get written confirmation of the change. The handbook guide on board email, passwords and shared accounts covers the email setup in more detail.

If money goes out the door

Speed matters more than anything else. Call the bank's fraud line the moment you suspect a fraudulent wire or ACH payment, and ask for a recall or reversal. The FBI's Internet Crime Complaint Center advises victims to contact their financial institution immediately and says quick action may reduce or eliminate the loss. Then file a complaint at ic3.gov with the transaction details. Tell the full board in writing the same day. Notify the association's insurance agent, since a crime or fidelity policy may cover part of the loss and policies often require prompt notice. Preserve the emails, including headers, and do not delete the compromised account. Change passwords on every account the affected person used. If a check was altered, report it to the bank in writing the day you find it. Treat the deadlines above as the outer limit, not the target. Afterward, write down what happened and which control would have stopped it, and add that control to the policy.

Put it in a one-page controls policy

None of this works if it lives only in one treasurer's head. Adopt a short written policy by board vote. It should list the accounts and who can access each, the approval limits for checks and electronic payments, the phone verification rule for payment changes, who reviews statements and alerts, how access is removed when a director leaves, and what to do in the first hour after a suspected fraud, with the bank's fraud phone number written in. Review it each year when the board changes. Check your governing documents and state law first, since some states set their own requirements for reserve withdrawals or signatures; our guide on whether an HOA check needs two signatures covers those rules.

Sources

These guides are general education for HOA boards and residents, not legal, tax, or financial advice. Rules vary by state and by your community's governing documents - check with a professional for your situation.

More on dues & money

Or browse all hoa dues, fees & money guides.