What Is Positive Pay? Check Fraud Prevention
Positive pay is a bank fraud-control service that compares every check presented for payment on your account with the list of checks you issued, matching the check number, amount and, in payee positive pay, the payee's name. Any check that doesn't match is held as an exception for you to pay or return.
When a thief steals your mailed $615.25 check 2202 to a locksmith from a mailbox, washes off the ink and deposits it for $6,152.50, it lands in your exceptions queue the next morning instead of clearing, because your bank's list says $615.25.
Why positive pay exists
Check fraud surged in the early 2020s. In a February 2023 alert, FinCEN, the Treasury bureau that collects banks' suspicious activity reports, said banks filed more than 350,000 reports of possible check fraud in 2021 and over 680,000 in 2022, nearly double. The alert focused on checks stolen from the mail.
A common method is check washing: chemicals remove the ink so the thief can write in a new payee and, often, a bigger amount. A washed check is printed on your real check stock, with your real account number and signature. It can look normal to a teller or a deposit scanner. Positive pay ignores how the paper looks and compares the data with what you told the bank you issued.
Our comparison of ACH, wire and check payments covers what each one costs and how fast it moves.
How check positive pay works
The service runs as a daily loop between you and the bank:
- Each time you print checks, you send the bank an issue file listing the check number, amount, issue date and, for payee positive pay, the payee name. Upload it before any of those checks can reach the bank.
- As checks are presented for payment, meaning they reach your bank to be paid, the bank compares each one with the file.
- Matching checks post normally. Anything else becomes an exception: a check that isn't in the file, a wrong amount, a wrong payee, a check already paid, one you voided, or one older than the bank's stale-date limit, such as six months after the issue date.
- The bank alerts you, usually early in the morning, with an image of each exception.
- You decide to pay or return each one before the bank's cutoff time.
Voids need the same care as issues. If you void a check but never mark it void in the system, a thief who later presents it will find a perfect match.
The exception deadline and what happens if nobody decides
Your bank sets the cutoff in your positive pay agreement, but it is built around check law. Under the Uniform Commercial Code (UCC), the state law that governs checks, the paying bank must return a check it won't pay, or send notice that it won't, before its midnight deadline: midnight of the next banking day after the check reaches it.
A bank that misses that deadline generally has to pay the check and can't send it back. So your cutoff falls earlier that day, leaving time for your "return" decision to reach the bank.
Cutoffs and defaults vary by bank, and sometimes by service. One bank's positive pay guide sets a 3:30 p.m. Eastern cutoff and applies whatever default the client chose at setup, except for reverse positive pay, where an undecided item is paid. Another bank's ACH positive pay guide closes at 2 p.m. Central and returns anything nobody decided.
The default is what happens when nobody logs in. If your default is pay, a forged check you never looked at clears. If it's return, a real check you forgot to list bounces back to your vendor, and you have to reissue it and apologize. For most small businesses, return is the safer default: an annoyed vendor costs less than a cleared forgery.
Ask your bank, in writing, for your cutoff time, default decision and alert method. Then name two people who can decide exceptions, so a sick day doesn't leave the queue unattended.
Types of positive pay
Check positive pay
The basic version matches check number and amount. It catches counterfeit checks with made-up numbers and checks with altered amounts. It misses a washed check where the thief changed only the payee name.
Payee positive pay
Payee positive pay adds the payee name to the match, which closes that gap. It needs exact names: "LLC" on the check but not in the file may create a false exception, depending on how strict your bank's matching is.
Reverse positive pay
Here the bank sends you the list of checks presented each day, and you compare it with your records and flag the ones to return. The checking work is yours, and if you don't answer in time, silence can mean the check gets paid.
ACH positive pay and ACH debit blocks
ACH is the US network for bank-to-bank transfers. The difference between an ACH credit and an ACH debit matters here: a debit is pulled from your account by a company you've authorized, while a credit is pushed by the payer, as when you pay a vendor. Banks offer three levels of protection against unwanted debits.
An ACH debit block refuses every ACH debit on an account. It suits an account that should never be debited, such as a reserve account, or a payroll account that no payroll service or tax payment draws from. An ACH debit filter allows debits only from companies you list, identified by the company ID the sender uses. ACH positive pay goes one step further and holds any debit that doesn't match your rules as an exception, often with a maximum amount per sender.
Speed matters with ACH too. Nacha, the organization that writes the ACH network's rules, gives a bank returning an unauthorized debit to a business account until the opening of business on the second banking day after settlement, the day the money moved, to get it back to the sender's bank. A consumer account gets about 60 calendar days.
After the business window closes, your bank can't send a routine return, but under Nacha's warranty rules it can still make a claim against the sender's bank for up to one year after settlement. That route is slower and recovery isn't guaranteed, so report an unauthorized debit the day you see it.
Worked example: one morning's exceptions
A property management company pays vendors by check from its operating account and uses payee positive pay. On Wednesday morning, four items need a decision:
| Check | Issue file says | Check presented | Exception | Decision |
|---|---|---|---|---|
| 2202 | $615.25 to locksmith | $6,152.50 to locksmith | Amount mismatch | Return |
| 2203 | $4,200.00 to roofing contractor | $4,200.00 to an individual | Payee mismatch | Return |
| 2190 | Not in file | $389.00 to HVAC company | Paid, not issued | Pay, then add to file |
| 2178 | Voided Oct 2 | $1,150.00 to cash | Voided check | Return |
The three returns stop $11,502.50 from leaving the account ($6,152.50 + $4,200.00 + $1,150.00). Check 2203 is the one plain check positive pay would have missed. Its number and amount match the file, so without the name match that $4,200.00 would have cleared.
Check 2190 is the office's own fault: a handwritten check for an emergency furnace repair that nobody added to the file. The fix is a rule: no check leaves the building until it's in the issue file.
Common positive pay mistakes
- Writing a manual check from the office checkbook and never adding it to the issue file.
- Approving a new ACH debit without checking the rule it creates. The second bank's guide sets a new rule to no maximum amount and all transaction types unless you edit it.
- Protecting the operating account but not the payroll account, the security deposit account or an old account still open with checks in a drawer.
Positive pay and the rest of your payment controls
Positive pay compares what hits your account with your own records, so it can't fix records that are wrong. A check you wrote to a fake vendor matches your issue file perfectly. That risk is handled earlier, by approving each bill before it's paid and confirming vendor bank details by phone. A second approver for every new vendor covers most of it, and our guide to invoice approval workflows covers the approval steps themselves.
Clyr's bill pay and accounts payable tools sit on that side of the line. Vendors email invoices straight into Clyr, approvals route by your rules before a bill is paid, and you pay by ACH or check. Vendors enter their own ACH or check details through a link, so bank details come from the vendor rather than from someone retyping an email.
FAQs
If you write checks regularly, usually yes. Every check you mail is a chance for theft, and the daily review takes a few minutes when your issue file is clean. Banks price the service differently, so ask for the fee schedule. If you write only a handful of checks a year, move those vendors to ACH and keep check positive pay with a near-empty issue file, so any check that shows up becomes an exception.
When the vendor deposits it, it shows up as paid but not issued. You'll see the image, recognize the check and choose pay, then add it to the file. If you miss the cutoff and your default is return, the check goes back unpaid. Reissue it with a new check number and mark the old number void, so the original can't come back later.
No. Positive pay services cover checks and, if you add the ACH version, ACH debits. Wire transfers and card charges aren't matched against your issue file. A wrong card charge goes through your card issuer's dispute process, and a wire depends on the approval steps you set up with your bank before it's sent. Requiring a second person to release every wire is a sensible rule.
Someone who knows which checks went out this week, such as the AP clerk or office manager, with the owner or controller as backup. Ideally that person isn't the only one who can print checks and upload the issue file. If one person controls both, they could issue a check, leave it off the file and then approve it as an exception, and nobody else would see it.
