Every check you mail hands a stranger everything printed on it: your routing number, your account number, your signature, and the exact format your bank expects. Now consider this: in the Association for Financial Professionals' 2026 fraud survey, 76 percent of U.S. organizations reported attempted or actual payments fraud in 2025, and checks were the single most-targeted payment method, named by 58 percent of respondents — ahead of ACH debits at 30 percent and wires at 25 percent. Your exposure is not theoretical. It is sitting in every envelope your bookkeeper drops in the mail.
Positive Pay is the bank service built for exactly this exposure. It matches every check presented against your account with a list of checks you actually issued, and holds anything that does not match for your decision. Most explanations stop there. But whether the service saves you or quietly fails you depends on the details: which fields your bank matches, what happens when you miss the daily deadline, and the fact that your check protection does nothing at all for ACH debits. This post walks through each of those mechanics so you can set the service up correctly the first time.
How the Matching Actually Works
The core idea is a daily matching game between two lists. The first list is yours: every time you issue checks, you send the bank a check-issue file — a simple record of each check's account number, check number, issue date, and dollar amount, usually with the payee name included. Most accounting systems can generate this file automatically, and many banks accept a manual upload through their treasury portal if your volume is low.
The second list is created at the bank. Every time a check drawn on your account is presented for payment — deposited at another bank, cashed at a branch, or cleared through the check image network — the bank's system extracts that check's details and looks for the corresponding line in your issue file.
When everything matches, the check clears with no friction. Nothing slows down, nobody calls you, and your vendor gets paid on schedule. The protection is invisible on good days, which is precisely why businesses underestimate it.
When something does not match, the check becomes an exception item. The bank holds it instead of paying it, and sends you an exception report — typically through an online portal, sometimes with an email or text alert — showing the check image and the reason it was flagged: amount mismatch, unknown check number, duplicate presentment, stale date, or a check against an account with no issue file on record. You review each exception and issue a decision: pay or return. That decision is the entire job, and everything below is about making sure it works when it matters.
Amount Matching vs. Payee Matching: The Tier That Decides What Gets Caught
Not all Positive Pay is the same, and the difference that matters most is which fields the bank compares. Banks generally sell two tiers.
Standard Positive Pay matches the check number and the dollar amount (plus the account number and date). This catches the most common crude frauds: a counterfeit check invented from scratch with a made-up number, a check with the amount altered upward, or a duplicate deposit of the same check twice. If the number was never issued or the amount was changed, the mismatch is automatic.
But standard matching has a blind spot you should understand clearly: it does not read the payee line. A thief who intercepts a legitimate check for $2,400 payable to your supplier, then chemically washes the payee name and rewrites it to themselves while leaving the amount untouched, presents a check whose number and amount match your issue file perfectly. Basic Positive Pay waves it through. Check washing is not a hypothetical technique — it is the reason mail-theft rings target business checks specifically, and an amount-only match cannot see it.
Payee Positive Pay (sometimes labeled "Positive Pay with payee match") closes that gap by comparing the payee name printed on the presented check against the payee name in your issue file. Now the washed check fails on the payee line and lands in your exception queue. Banks typically charge a modest add-on for this tier — often a small per-item fee on top of the base service — and it is the single highest-value upgrade in the package. If your bank offers it, take it.
One practical consequence: payee matching only works if your issue file carries accurate payee names. That means the payee in your accounting system must be spelled the way it prints on the check, including suffixes like "Inc." or "LLC." Sloppy vendor records generate false exceptions — checks you genuinely wrote, flagged because "Acme Supply Co" in your books printed as "Acme Supply Company" on the check. Clean up payee names before you enroll, or your first weeks will be noisy.
Exceptions: The Daily Decision You Are Signing Up For
The exception queue is where Positive Pay succeeds or fails in practice, because the service is only as reliable as your daily review habit. Here is what to expect and what to get in writing from your bank.
You get one short window per day. Most banks require exception decisions by late morning or early afternoon, bank time — commonly somewhere between 11 a.m. and 2 p.m. Eastern for checks. After the cutoff, the bank acts on your behalf according to your account's default action, which brings us to the most important question to ask at enrollment.
Know your default action: pay or return? Every Positive Pay agreement specifies what the bank does with an undecided exception after the deadline. Some banks default to return — the suspicious check bounces back unpaid, which is the safe outcome for fraud but can embarrass you if the exception was your own data-entry error on a legitimate vendor payment. Others default to pay — the check clears, which keeps legitimate payments flowing but means a missed deadline is the same as no protection at all. Neither default is standard across the industry, so confirm yours explicitly and make sure the person covering payables during vacations knows it too. A control that depends on one employee checking a portal every morning before 11 a.m. is a control with a single point of failure; assign a backup decision-maker from day one.
Not every exception is fraud. Expect routine exceptions from your own operations, especially early on: a check issued but uploaded late, a voided check that was never recorded as void, a legitimate check that cleared twice, or a hand-written check whose amount the bank's image software misread. Each of these gets a "pay" decision with a note, and each one is feedback about your own issuance discipline. Track your exception reasons for the first month — a pattern of "issued but not uploaded" means your file timing needs fixing, not your fraud controls.
Stale and duplicate presentments surface here too. Many banks flag checks presented more than six months after their issue date, and nearly all flag the same check number clearing twice. Both are legitimate fraud indicators — a stale check may have been stolen and held, and a duplicate may be a photocopy deposited through two mobile apps — so treat them as guilty until your records prove otherwise.
Reverse Positive Pay: Cheaper, Weaker, and Honest About It
Banks also sell a mirror-image variant called reverse Positive Pay, and you should understand exactly what you give up for the lower price. Instead of you sending an issue file in advance, the bank sends you a daily list of everything presented against your account, and you tell the bank which items to return.
The protection is real but entirely manual: on any day nobody reviews the list, everything presented that day clears by default. There is no automatic matching, no hold, no safety net for the day your reviewer is sick. Reverse Positive Pay converts fraud prevention from "the bank stops anything unknown" to "we notice anything unknown ourselves, every single day, without fail."
For a business writing a handful of checks a month with a disciplined daily reviewer, that trade can be rational — the service is often free or nearly so. For anyone else, it is a false economy. If you choose it, pair it with a genuine daily reconciliation habit, and revisit the decision the moment your check volume grows.
Why ACH Needs Its Own Filter
Here is the gap that surprises owners most: check Positive Pay does nothing about ACH debits. A check control matches check numbers and amounts. An ACH debit has neither — it pulls money straight from your account using only your routing and account numbers, the same numbers printed on every check you have ever written. The thief who cannot beat your check matching can simply originate an electronic debit instead, through the ACH network, with no check involved at all.
ACH fraud gets its own family of controls, keyed on the originator rather than the instrument:
- ACH debit blocks reject every ACH debit against an account, with no exceptions. They belong on any account that should never have money pulled out of it electronically — tax reserves, escrow, savings sweeps.
- ACH filters (sometimes called authorization rules) act as an allowlist: you preauthorize specific originator company IDs, often with dollar caps, and anything outside the list is blocked or flagged.
- ACH Positive Pay puts the flagged items into a pay-or-return exception queue, mirroring the check workflow — same daily deadline discipline, same need to know your default action.
The urgency is greater on the ACH side than most owners realize. A consumer gets roughly 60 days to dispute an unauthorized ACH debit. A business account generally must return it within about two banking days of settlement, or the straightforward reversal path closes. That short fuse is exactly why preventive controls matter more than detection here: a filter stops the debit from posting at all, while a monthly reconciliation habit discovers it weeks after the return window shut.
The practical setup is to treat the two systems as one project. When you enroll in check Positive Pay, ask the same banker in the same meeting which ACH controls are active on each of your accounts. Businesses that adopt check protection but leave ACH wide open have locked the front door while the side entrance stands unguarded.
What It Costs and How to Turn It On
Pricing varies widely by bank and relationship, which is why you should ask for the full fee schedule rather than the headline number. Some banks bundle basic check Positive Pay free with a business checking account; others charge a monthly service fee, a per-item verification fee, or both. Common add-ons include payee matching fees, per-item charges above an included volume, and fees for each issued-check record processed. For a small business writing dozens of checks a month, the all-in cost is typically modest — far below the cost of a single successful check fraud, with industry figures putting the average bank loss around $1,500 per fraudulent item.
Enrollment is straightforward. A practical sequence:
- Call your bank's treasury or business banking team — not the branch teller line — and ask for Positive Pay enrollment plus the fee schedule, the exception cutoff time, and the default pay-or-return action for each account.
- Clean up your payee records in your accounting system so the names that print on checks match the names in your vendor file exactly, especially if you are taking payee matching.
- Set up the issue file feed from your accounting software to the bank, and confirm the timing: the file must reach the bank before the checks can be presented, ideally the same day you print them.
- Name two exception reviewers — a primary and a backup — and put the daily cutoff on both calendars as a recurring morning task.
- Enroll your ACH controls in the same pass, starting with debit blocks on accounts that never need ACH debits.
- Run a first-month review of your exceptions to separate fraud signals from your own data problems, and fix the data problems.
Keeping the Control Honest in Your Books
Positive Pay changes your bookkeeping in small but important ways. First, the service fees belong in your ledger like any bank charge — if they drift through unrecorded, your bank reconciliation will always be off by a mystery amount. Second, your void discipline now has a same-day audience: every voided check must be recorded as void the day it is voided, or it becomes tomorrow's false exception. Third, daily exception review and daily reconciliation reinforce each other; the business that reviews its portal every morning has already done half of its bank reconciliation before month-end arrives.
In a plain-text ledger, the monthly fee and a fraud recovery each take one entry. A Positive Pay fee posts like any bank charge:
2026-10-21 * "First Bank" "Positive pay monthly fee - operating account"
Expenses:Bank-Fees:Fraud-Controls 32.00 USD
Assets:Checking:OperatingAnd if a fraudulent check slips through and the bank later reverses it, the recovery is a plain deposit against the loss account you booked, keeping the incident visible in your records rather than silently netted:
2026-10-24 * "First Bank" "Reversal - fraudulent check 4821 returned"
Assets:Checking:Operating 4850.00 USD
Expenses:Fraud-Loss:Check-Fraud-RecoveriesFinally, keep a simple log of your exception decisions — date, check number, pay or return, and reason. It takes seconds per item, it proves your review discipline if a dispute ever reaches your banker or your auditor, and it turns next month's repeat exceptions into a five-second decision instead of a fresh investigation.
Your Next Step
Positive Pay fails in exactly three ways: the bank matches too few fields, nobody reviews the exceptions before the cutoff, or the ACH side was never protected at all. All three are set at enrollment, which means one careful meeting with your banker prevents all of them. Call your treasury team this week, ask for check Positive Pay with payee matching, confirm your exception cutoff and your default action, and put ACH blocks and filters on the same agenda. Then assign your backup reviewer before you hang up. The fraud survey numbers at the top of this post describe businesses that, in most cases, could have bought this protection for less than the cost of the fraud they absorbed. Make sure yours is not among them next year.
