Positive Pay is a bank fraud-prevention service that checks every item presented against your account, whether a paper check or an electronic debit, against a record of what you’ve already authorized, and blocks anything that doesn’t match before the money leaves. Instead of finding fraud weeks later during reconciliation, the bank catches the unauthorized item at the moment it’s presented and holds it for your review.
The service comes in several forms covering checks and ACH debits separately, and for a business account it’s often the difference between a fraud loss you can reverse and one you simply absorb.
How Check Positive Pay Works
Check Positive Pay runs on a straightforward comparison. Each business day, ideally the same day you cut checks, you send your bank an “issue file” listing every check you’ve written: check number, dollar amount, issue date, and account number. That file has to reach the bank before any of those checks are presented, because without it there’s nothing to compare against.
When one of your checks reaches the bank, its processing equipment reads the magnetic ink character recognition (MICR) line along the bottom, which encodes the routing number, account number, and check number. The system then cross-references the check number and amount against your issue file. Match on both, and the check clears. Mismatch, or a check number that isn’t in the file at all, and the item gets flagged as an exception and held.
That logic catches the most common check fraud patterns: altered dollar amounts, counterfeit checks with fabricated check numbers, and checks drawn on stolen blank stock. What it doesn’t catch is payee manipulation, which is where the next layer comes in.
Payee Positive Pay
Standard Check Positive Pay doesn’t verify who the check is made out to. A fraudster who intercepts a check and chemically washes the payee line, leaving the amount and check number intact, will slip past basic matching. Payee Positive Pay adds the payee name to the issue file. When the check is presented, the bank uses optical character recognition to read the payee field on the check image and compare it to what you authorized. A mismatch triggers the same exception process.
Payee verification isn’t flawless. OCR depends on legible printing, and handwritten or smudged checks can generate false positives. For businesses issuing printed checks with machine-readable payee lines, though, it adds meaningful protection against check washing, one of the fastest-growing forms of check fraud.
How ACH Positive Pay Works
ACH Positive Pay takes a different approach because there’s no physical item to read. Automated Clearing House transactions are electronic, so instead of uploading a file of items you’ve issued, you set standing rules that tell the bank which companies are allowed to pull money from your account and under what conditions.
The core mechanism is a whitelist of approved Originator IDs. Every company that initiates ACH debits has an Originator ID that identifies it in the ACH network. You give your bank a list of the IDs you trust, and any incoming debit from an ID that isn’t on your list gets blocked automatically. You can layer additional controls on top: cap the dollar amount a given originator can pull, restrict how often it can debit, or block all incoming ACH debits and approve them one at a time.
These rules act as standing instructions. Once set, they apply to every incoming transaction without a daily file upload. You update them only when vendor relationships change.
Why It Matters More for Business Accounts
Consumer bank accounts get federal protection under Regulation E, which caps your liability for unauthorized electronic transfers and gives you 60 days to report a problem. Business accounts don’t. Regulation E defines a protected “account” as one established primarily for personal, family, or household purposes, and its definition of “consumer” is limited to a natural person.1Consumer Financial Protection Bureau. Electronic Fund Transfers Regulation E 1005.2 Definitions If yours is a commercial operating account, you’re outside that safety net.
The practical result is a much shorter fuse. Under NACHA rules, a business has roughly two business days from the settlement date to return an unauthorized corporate ACH debit. Miss that window and the money is gone, with no regulatory mechanism to claw it back, versus the 60-day window consumers get.2Nacha. Differentiating Unauthorized Return Reasons ACH Positive Pay fills that gap by blocking the unauthorized debit before it ever settles, so you never have to race a two-day clock you might not know is running.
Reverse Positive Pay
Not every business can maintain the daily discipline of uploading issue files. Reverse Positive Pay inverts the workflow. Instead of you sending the bank a list of checks you wrote, the bank sends you a list of checks presented against your account. You review the list each business day and flag anything you didn’t authorize. Items you approve clear normally; items you reject are returned unpaid.
The upside is operational simplicity: no issue files to generate or transmit. The tradeoff is that you review every presented check yourself, rather than only the exceptions the system surfaces. For a low-volume account it’s manageable. For a company writing hundreds of checks a week, it quickly becomes impractical. Think of it as a middle ground between no fraud protection and full Positive Pay, workable but entirely dependent on your ability to review and respond before the bank’s daily cutoff.
What Positive Pay Does Not Catch
Positive Pay is effective against a specific set of threats, not a comprehensive fraud solution. Its blind spots are worth knowing.
- Internal fraud. Positive Pay confirms that presented items match what you told the bank to expect. An employee with check-writing authority who issues an unauthorized check and includes it in the issue file will see it approved without hesitation. The fraud is “authorized” as far as the matching logic is concerned.
- Payee fraud without the payee add-on. Standard Check Positive Pay validates check numbers and amounts, not payee names. A washed check with the original amount and check number will pass basic matching. You need Payee Positive Pay to catch it.
- Authorized push payment fraud. If a scammer impersonates a vendor and tricks you into cutting a legitimate check to a fraudulent account, you’ll upload that check to the issue file yourself. Positive Pay only stops unauthorized items. It can’t protect you from payments you authorized based on a scam.
- Timing gaps. If your issue file isn’t uploaded before a check is presented, the bank has nothing to compare against. The item may be flagged with no matching record or processed under a default rule, depending on how your service is configured.
Positive Pay works best as one layer in a broader fraud strategy that also includes internal controls, dual authorization on payments, and vendor verification procedures.
Legal Liability and Why Declining the Service Is a Decision
Positive Pay doesn’t only prevent fraud. It can shift who bears the loss when fraud occurs, and that shift runs through the Uniform Commercial Code.
The default rule under UCC Article 4 is that a bank may only charge your account for items that are “properly payable,” meaning items you actually authorized.3Legal Information Institute. UCC 4-401 When Bank May Charge Customer Account An altered or forged check isn’t properly payable, so if the bank pays one, the bank absorbs the loss. Two provisions erode that starting point.
First, UCC 4-406 requires you to examine your bank statements with “reasonable promptness” and report any unauthorized signatures or alterations. If the same fraudster hits your account repeatedly and you don’t catch and report the first instance in time, you can lose the right to recover on later fraudulent checks from the same source.4Legal Information Institute. UCC 4-406 Customer Duty to Discover and Report Unauthorized Signature or Alteration
Second, UCC 3-406 goes further. If your failure to exercise ordinary care substantially contributed to a forgery or alteration, you’re precluded from asserting the fraud against a bank that paid in good faith.5Legal Information Institute. UCC 3-406 Negligence Contributing to Forged Signature or Alteration of Instrument Leaving blank check stock unsecured, mailing checks without basic safeguards, or declining fraud prevention tools your bank offered can all be characterized as failures of ordinary care.
Many banks now include Positive Pay clauses in their commercial deposit agreements. The typical provision says that if the bank offers Positive Pay and you decline it, you accept responsibility for fraud losses the service was designed to prevent. Courts have enforced those provisions; in one federal case, a commercial customer that repeatedly declined to implement Positive Pay was barred from recovering losses on altered checks because the deposit agreement permissibly allocated that risk to the customer, validly varying the default UCC “properly payable” rule. Even without an explicit contract clause, refusing an available fraud prevention tool gives the bank a strong argument under UCC 3-406 that your own negligence contributed to the loss.
Handling Exceptions
Whatever version of Positive Pay you use, the real test is what happens when something doesn’t match. When the bank flags an item, the clearing process stops and you’re notified, usually through the bank’s online portal. The notification shows the amount, check number, date, and often an image of the check itself.
You then have a limited window to tell the bank what to do. The decision is binary: pay or return. Pay is appropriate when the item is legitimate and your issue file just had a typo or wasn’t uploaded. Return means you’re confirming the item is unauthorized and directing the bank to reject it.
That window is tight, generally one to two business days depending on the bank’s cutoff. Miss it, and the bank applies its default disposition. Many banks default to returning unreviewed items, which is safer from a fraud standpoint but can bounce legitimate payments if nobody reviewed them in time. Some banks let you choose your default at the account level, so it’s worth discussing during setup.
The exception process puts real responsibility on your team. Someone needs to log into the portal every business day, review exceptions promptly, and decide before cutoff. Businesses that treat exception review as optional tend to find out the hard way that their default either let a fraudulent check through or returned a payment their vendor was counting on.
What It Costs
Positive Pay pricing varies by bank and is usually bundled into a treasury management fee schedule rather than priced as a standalone product. Most structures include a monthly service fee for the module itself, a per-account fee for each account enrolled, and per-item charges.
Per-item fees typically apply in two places: a small charge for each check recorded in your issue file and a higher charge for each exception item the system flags. Check Positive Pay and ACH Positive Pay generally carry separate monthly module fees, so enrolling in both means two sets of base charges. Payee Positive Pay is usually an add-on with its own monthly fee. Reverse Positive Pay tends to carry a lower monthly cost but still charges per exception.
The cost is modest relative to what a single successful fraud incident can drain from an operating account, particularly for a commercial account that has no Regulation E backstop. When comparing pricing, ask for the full treasury management fee schedule rather than a summary, because ancillary items like file import fees and fraud notification fees can add up.