Cryptographically secure data integrity checking may not receive the same level of attention as encryption, but lies at the core of many security technologies from code signatures to passwords to cryptocurrencies. The problem of verifying that a message has not been modified may seem straightforward, but there is a variety of algorithms used to solve it (some good, some not so good, and some homemade and broken) and even standard approaches can fail if not implemented correctly. In this talk I demonstrate a number of catastrophic failures with notorious past examples, explaining how each one worked and the mistakes that the designers made. Then I briefly review the primitives used in message integrity, such as one-way functions, message authentication codes, authenticated encryption, and digital signatures, showing the capabilities and limitations of each.