Positive Pay works by matching every check and electronic debit hitting your business account against a list of payments you told the bank to expect, and anything that doesn’t match gets held for your review before it clears. You feed the bank a daily roster of authorized checks. The bank measures each presented item against that roster. Mismatches become exceptions you either approve or reject, usually within a few hours the same morning. That is the entire mechanism, and everything else is a variation on it.
The Issue File You Send the Bank
The workflow starts on your side. Each time your accounting system prints checks, it generates an “issue file” listing every check you’ve authorized. The file typically includes check number, dollar amount, issue date, account number, and optionally the payee name.1Farmers & Merchants Bank. Positive Pay Check Issue File Overview Some banks also want a check-type indicator so voided checks can be flagged in the same upload.
You transmit that file to the bank through its commercial online portal or a secure file transfer channel. Once received, it becomes the reference list every incoming check is measured against.
Timing matters. Upload on the same day you print, or at least before those checks could plausibly reach the bank for clearing. If a legitimate check arrives before its record does, it will be flagged as an exception and slow down the payee. Most businesses build the upload into the daily check-run so it happens automatically.
How the Bank Matches Each Check
Once your issue file is loaded, every check presented against your account runs through an automated comparison of check number and dollar amount.2Infor Documentation Library. Positive Pay Check Data Functionality There are three possible outcomes:
- Match. The check number and amount align with your file. The item clears automatically and you do nothing.
- Mismatch. The amount is different, the check number isn’t in your file, or both. The bank holds the item and sends it to you as an exception.
- Stale or duplicate. The check already cleared, was previously voided, or falls outside an acceptable age window. Depending on your bank’s setup, these are either routed for your review or automatically returned.
The check doesn’t have to arrive through the clearing system for the match to run. Banks that offer teller-line validation can flag suspicious items in real time when someone tries to cash a check at a branch, comparing the item against your issue file before the money leaves the drawer.3Regions Bank. Positive Pay – Detect and Prevent Check Fraud
Payee Name Verification
Standard matching ignores who the check is made out to. A fraudster who intercepts a legitimate check, washes off the payee, and writes in their own name will clear the standard check because the number and amount are unchanged. Payee Positive Pay closes that gap.
When your issue file includes the payee name, the bank uses optical character recognition to read the name printed on the physical check and compare it against your record.1Farmers & Merchants Bank. Positive Pay Check Issue File Overview If the scanned name doesn’t match, the item becomes an exception even when the number and amount are correct.
The optical matching isn’t perfect. Handwritten checks, smudged ink, and abbreviations like “Corp” versus “Corporation” can trigger false exceptions. A false positive you clear in two minutes is a better problem than a real forgery that clears silently.
ACH Positive Pay for Electronic Debits
Standard Positive Pay covers paper checks only. A separate layer, ACH Positive Pay (sometimes called an ACH filter), handles electronic debits pulled through the Automated Clearing House network. Instead of individual transactions, you give the bank a list of approved ACH Company IDs, the unique identifiers assigned to every business that originates ACH debits. The bank blocks any debit from a Company ID not on your approved list.4Baker Boyer. What Is an ACH Filter and How Does It Work With Positive Pay
You can also set dollar limits and restrict transaction types for each approved originator. If a vendor authorized for $5,000 monthly debits suddenly tries to pull $50,000, the filter catches it. That matters because ACH fraud often uses a legitimate-looking Company ID for an unauthorized amount, or an unknown originator testing your account with small debits before attempting a large one.
Reviewing Exceptions on a Same-Day Clock
When the match flags an item, the bank alerts you (usually by email) and posts the exception to your online banking portal. You’ll typically see a scanned image of the check next to the details from your issue file so you can compare them. For each exception you make one of two choices: pay the item, or return it. The decision is binding once submitted.
Paying an exception is common when the mismatch is a data-entry error on your end, like transposing digits when you built the issue file. Returning tells the bank to reject the check as unauthorized.
The window is tighter than most businesses expect. Banks make exception reports available early in the morning and want your decisions later that same morning. One common cutoff runs 8:00 AM to 11:00 AM Eastern, with hourly reminders if you haven’t acted.5Needham Bank. Positive Pay User Guide Other banks set cutoffs in the early or mid afternoon. Either way, this is a window measured in hours. Someone on your team needs to own the task every business morning.
What Happens if You Miss the Cutoff
The consequence depends on how the service is configured. Some banks default to returning all undecided items, which protects you from fraud but bounces legitimate checks your vendors were expecting. Other banks default to paying undecided items, which keeps vendors paid but defeats the purpose of the service when the item is actually fraudulent. Many banks let you choose your default at enrollment, and some set different defaults for different services (for example, automatically returning ACH exceptions while letting you choose for check exceptions). Ask your bank which default applies and make sure it matches the risk you’d rather absorb.
Reverse Positive Pay: The Alternative Model
Reverse Positive Pay flips the workflow. You don’t upload an issue file. Instead, the bank sends you a list of every check presented against your account that day, and you tell the bank which items to pay and which to return.
The obvious drawback is workload. With standard Positive Pay you only review the handful of exceptions that failed matching. With the reverse model you review everything. A business that writes 200 checks a week is manually reviewing 200 items instead of a few. The model also doesn’t include payee-name matching, so name-washed checks are harder to catch without careful scrutiny. It suits businesses with strong internal reconciliation processes that want a second set of eyes on every transaction, or those whose check volumes or formats don’t fit the standard issue-file workflow. For most businesses, the standard model catches more fraud with less daily effort.
What It Costs
Banks charge a monthly maintenance fee for the service plus a per-item fee for exceptions. Pricing varies, but one major bank’s published 2026 schedule lists standard check Positive Pay maintenance at $73.50 per month, ACH Positive Pay maintenance at $22.50 to $36.75 depending on the account package, and $5.50 per exception item.6Truist Bank. 2026 Price Changes Compare that against your check volume and average check amount rather than looking at the fee in isolation. A single intercepted forgery on a large check usually covers years of the service.
Why It Matters for Your Liability
Even without Positive Pay, the law already puts a duty on you to catch check fraud. Under the Uniform Commercial Code, adopted in some form by every state, you must examine your bank statements with “reasonable promptness” and notify the bank if you spot unauthorized signatures or alterations.7Legal Information Institute (LII) / Cornell Law School. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
If you fail to review and the bank shows it suffered a loss because of your delay, you lose the right to hold the bank responsible for the forged or altered check. Repeat fraud makes it worse. If the same person forges multiple checks and you didn’t catch the first one within a reasonable period (most states cap this at 14 to 30 days), you’re typically barred from recovering on the later forgeries that cleared before you finally reported the problem. And there’s an absolute one-year deadline: any unauthorized signature or alteration you don’t discover and report within a year of the statement being available is permanently yours to absorb.7Legal Information Institute (LII) / Cornell Law School. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
Positive Pay intersects with that duty in a practical way. A business that declines the service and then takes weeks to review statements is in a weak position to argue it exercised reasonable promptness. Running the service doesn’t just prevent fraud; it shows you have controls in place, which strengthens your position if a fraud still slips through.