A system comprising: a check image Record (CIR) database configured to store, for each of a plurality of accounts, a CIR, wherein each CIR comprises feature information related to features extracted from a plurality of reference checks associated with the associated account of the plurality of accounts; memory configured to store instructions; and a processor coupled with the CIR database and the memory, the processor configured to run the instructions, which cause the processor to: receive an image of a test check associated with an account of the plurality of accounts, extract feature information from the image, compare the features with the feature information stored in the CIR database for the account associated with the test check, generate a fraud score, and update each CIR by determining.