Positive Pay banking is an automated fraud detection service that compares every check and electronic debit hitting your business account against a record of payments you actually authorized, and flags anything that doesn’t match before the money leaves. Your company tells the bank what it issued; the bank refuses to pay anything else without your say-so. The service comes in versions for paper checks, ACH debits, or both, and for many businesses declining it now carries legal consequences beyond the fraud risk itself.
How Check Positive Pay Works
The mechanic is simple. Each time your company cuts a batch of checks, your accounting system generates an issue file listing the check number, dollar amount, and issue date for every check. You send that file to the bank through a secure portal before the checks reach the banking system.
The bank holds that data and waits. When someone deposits or cashes one of your checks, the bank compares the physical check against your issue file. Match on all three fields, and the check clears. Anything off, and the bank flags the item as an exception and notifies you.1Bank of America. Check Positive Pay
Exceptions tell you different stories. A check number that doesn’t appear in your issue file at all points to a counterfeit. A matching number with a different dollar amount points to alteration. Sometimes it’s just a data entry mistake on your end. Either way, you review the flagged item and tell the bank to pay it or return it.
Most banks also verify checks at the teller window in real time, so a fraudster who walks into a branch trying to cash a fake check gets stopped there too.2American Bank & Trust. Check Positive Pay That protection is typically bundled with Check Positive Pay at no extra setup.
Payee Match
Standard matching checks account number, check number, and amount. Payee Positive Pay adds the payee name, using optical character recognition to read the name on the check and compare it to your issue file. This catches check washing, where a thief lifts the payee name off a legitimate check and writes in their own without touching the amount.
The tradeoff is more false positives. OCR is only as good as the check image, and smudges, watermarks, unusual fonts, or wrinkled paper can all trigger a mismatch on a perfectly good check.3Johnson Financial Group. Payee Match Implementation Guidelines Businesses with inconsistent check stock or payee formatting will spend more time reviewing exceptions. Most still find it worthwhile, because payee alteration is one of the most common check fraud techniques.
How ACH Positive Pay Works
Checks aren’t the only way money leaves your account. ACH Positive Pay covers the electronic side, and it works differently. Instead of matching each item to an issue file, it uses standing rules that govern which ACH debits can post.
The strictest setup is a full debit block, which rejects every incoming ACH debit unless you’ve specifically approved it. A debit filter is more flexible: you maintain a whitelist of approved originators, identified by the Company Identification number that each ACH transaction carries in its batch header.4Nicolet Bank. NACHA ACH File Format Specifications Debits from anyone not on the list get flagged or bounced.
Some systems also let you filter by transaction type. If your business only expects corporate-to-corporate debits from vendors, you can set a rule that rejects consumer or web-initiated entries outright.5Jack Henry. Treasury Management ACH Filter Rules
ACH Positive Pay demands ongoing maintenance. Every new vendor that will debit you needs to be added to the approved list before their first pull, and if a vendor changes banks or processors their Company ID may change with them. Fall behind on updates and legitimate payments bounce, straining vendor relationships and triggering late fees.
Reverse Positive Pay for Smaller Businesses
Standard Positive Pay assumes you have accounting software that can produce a properly formatted issue file. If you don’t, Reverse Positive Pay flips the workflow. The bank sends you a daily list of every check presented against your account, and you review the whole list to flag anything that shouldn’t be there.6First Horizon Bank. Reverse Positive Pay
Setup is easier, but the responsibility shifts. You’re reviewing every check instead of just exceptions, and you’re the one spotting fraud rather than the bank’s algorithm. For a business writing a handful of checks a week, that’s manageable. For one issuing hundreds, it isn’t.
What Positive Pay Costs
Pricing varies by bank and by what you bundle. As a reference point, one mid-size bank lists Check Positive Pay with Payee Match at $60 per month per account and ACH Positive Pay at $25 per month per account.7Fremont Bank. How Much Does Positive Pay Cost Some banks add a one-time setup fee or a small per-item verification charge. Larger businesses often negotiate custom pricing inside a broader treasury management relationship.
Set that against the cost of a single fraud incident. A forged check that clears ties up cash, triggers investigation, and can take weeks or months to resolve through the dispute process. If your deposit agreement limits the bank’s liability because you declined fraud tools, the loss may sit entirely on your business.
The Legal Reason to Say Yes
Positive Pay isn’t only an operational tool. It’s woven into the legal rules that decide who eats the loss when a fraudulent check clears.
Under the Uniform Commercial Code, which governs bank-customer relationships in every state, you already have a duty to examine your statements promptly and report unauthorized transactions. Miss that window and you can lose the right to demand reimbursement, particularly for follow-on fraud by the same wrongdoer.8Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration If your own negligence substantially contributed to the forgery, you’re generally barred from holding the bank responsible at all.9Legal Information Institute. UCC 3-406 – Negligence Contributing to Forged Signature or Alteration of Instrument
The UCC also lets banks and customers adjust these duties by agreement, as long as the bank doesn’t disclaim its obligation to act in good faith.10Legal Information Institute. UCC 4-103 – Variation by Agreement Banks have used that provision to make Positive Pay a fixture of their deposit agreements.
A typical Positive Pay service agreement states that the bank has no liability for paying a forged, altered, or counterfeit check that was authorized, or deemed authorized, through the Positive Pay process.11Prosperity Bank. Check Positive Pay Service Terms Some agreements go further: if the bank offers Positive Pay and you decline it, the agreement may bar you from making fraud claims for the very losses the service was built to catch. Courts have found that kind of risk allocation commercially reasonable. In one federal case, a business that declined Positive Pay and later suffered check fraud was barred from recovering from the bank because the deposit agreement conditioned liability on the customer’s use of available fraud prevention tools.
Refusing Positive Pay doesn’t just leave you without an early warning. It can eliminate your legal recourse after fraud occurs.
Making It Work Day to Day
The technical setup matters, but the exception review process is where Positive Pay either earns its fee or quietly fails. Each morning, the bank posts your exception items to its online platform with the check number, amount, and often an image. Your authorized reviewer marks each item pay or return.
The deadline is tight. First Horizon, for example, sets its Reverse Positive Pay cutoff at 2:00 PM Central Time.6First Horizon Bank. Reverse Positive Pay The urgency traces back to the UCC’s midnight deadline rule: the paying bank generally must decide to pay or return a check by midnight of the next banking day, so it needs your call early enough to process the return in time. Miss the cutoff and your default disposition takes over.
When you set up the service, the bank asks you to pick that default. “Pay All” clears unreviewed exceptions. “Return All” bounces them.12Prosperity Bank. Positive Pay Quick Reference Guide Neither is really safe. Pay All defeats the whole point on the day you happen to be unavailable. Return All protects you but bounces legitimate checks, damaging vendor relationships and risking contract issues. Most fraud prevention professionals lean toward Return All on the reasoning that a bounced legitimate check is fixable and a fraudulent payment often isn’t.
Whichever default you pick, treat it as a backstop you never actually want to hit. The place businesses get burned is human, not technical: the one authorized reviewer takes vacation, a busy morning pushes the review to after lunch, and the deadline slips past. Build in at least two authorized reviewers who check the exception queue as a first-thing-in-the-morning priority. That single habit matters more than any configuration choice you’ll make during setup.