Positive pay is a bank fraud-prevention service that lets your business pre-authorize every check it writes so the bank can reject anything that doesn’t match. You send the bank a file listing each check you’ve issued, and when checks come in for payment, the bank compares them against that list. Mismatches get held and sent to you for a pay-or-return decision before any money leaves the account. With 63 percent of organizations reporting attempted or actual check fraud in 2024, it has become one of the most practical defenses available to a business that still writes paper checks.
How the Matching Works
Each time you cut checks, you upload a digital file to the bank’s online portal. The file lists each check’s number, dollar amount, and issue date, and often the payee name. The bank stores this as a reference list. When a check is presented for deposit or cashing, the bank’s software compares the physical item against your list during normal clearing. If the number and amount line up, the check pays with no action from you. If anything is off, the check goes into an exception queue.
Banks provide a template for the issued check file, usually CSV or fixed-width text. Each one has its own specifications for column order, date formatting, and whether the dollar amount carries a decimal. Small formatting errors cause legitimate checks to be flagged, so the first file is worth walking through carefully. Most accounting software doesn’t generate positive pay files natively; businesses using platforms like QuickBooks typically need a third-party add-on or a manual export-and-reformat step to produce something the bank will accept.
Voided checks need the same discipline. If you void a check after uploading it, update the file or mark the check as voided through the portal. Skip that step and the system still sees the check as issued, which can let it clear if someone presents it.
What Happens When a Check Is Flagged
When the system spots a mismatch, it sends an exception alert, usually by email or text, to whoever you’ve designated as the account administrator. That person logs into the exception portal, reviews an image of the flagged check, and chooses pay or return.
Banks enforce strict cutoff times, often between 10:00 AM and 12:00 PM local time. Miss the window and the bank applies your default setting. The deadline exists because the bank has to meet clearinghouse settlement schedules. In practice, this means someone at your organization has to check the exception queue every business morning without fail. This is where most positive pay programs break down: the technology works, but the person responsible gets busy and stops reviewing on time.
Not every exception is fraud. Legitimate checks get flagged for data entry errors in the original file, presentment after the stale date (typically 180 days from issuance), or a payee name that doesn’t exactly match. Every exception still needs a decision.
Your Default Setting Matters
The bank will ask what to do with exceptions you don’t review before cutoff. The two options are “pay all” and “return all,” and the choice carries real weight.
Returning unreviewed items sends the check back to the presenting institution with a “Refer to Maker” notation. If the check was legitimate, you’ll issue a replacement. This is the safer setting because money stays in your account until you approve the payment. Paying unreviewed items does the opposite: the bank clears every exception you don’t act on, and if a forged check slips through because you missed the window, you’ve accepted the loss. For most businesses, reissuing an occasional legitimate check costs far less than absorbing a single fraud loss.
Payee Positive Pay for Altered Checks
Standard positive pay verifies only the check number and dollar amount. A fraudster who intercepts a legitimate check can alter the payee name, deposit it into their own account, and the system won’t catch it because the number and amount still match your file. This is called payee alteration, and it has grown with mail theft.
Payee positive pay adds the payee name to the verification. When a check comes in, the bank compares the printed payee against the name in your file. If “ABC Supplies” was changed to someone else’s name, the check gets flagged. The tradeoff is exact-match discipline: small differences like “ABC Supplies Inc.” versus “ABC Supplies” can trigger a false exception. Even so, this is the only automated defense against altered-payee fraud, and it’s worth turning on if the bank offers it.
ACH Positive Pay for Electronic Debits
Check positive pay does not protect against unauthorized electronic debits. ACH positive pay is a separate service that monitors incoming ACH debit requests against authorization rules you set in advance. You define which companies are allowed to pull money from the account and can set limits on dollar amounts and transaction frequency. Any debit that doesn’t match the approved list gets flagged for your review, the same way a mismatched check does.
When an unauthorized debit comes through and you reject it, the bank returns it with an “Unauthorized ACH Transaction” code. If the debit turns out to be legitimate but simply wasn’t on your list, you’ll need to work with the originator to get it added.
Reverse Positive Pay
Reverse positive pay flips the standard workflow. Instead of uploading a file of checks you’ve written, the bank sends you a list of every check presented against your account during the previous night’s processing. You review each item through online banking and flag anything you didn’t authorize.
The appeal is that you never prepare an issued check file. The downside is that you’re reviewing every check, not just exceptions, which gets tedious fast if you write dozens a week. Reverse positive pay fits organizations with low check volumes that want some fraud protection without the data preparation. It catches fraud after presentment rather than preventing it during clearing, so the window to act is narrower.
How Positive Pay Changes Your Fraud Liability
The legal stakes are the reason banks push this service so hard. Under the Uniform Commercial Code, a bank can only charge your account for items that are “properly payable,” meaning items you actually authorized. If the bank pays a forged check, the default rule puts the loss on the bank because you never authorized the payment.
That default comes with conditions. UCC Section 4-406 requires you to review your bank statements with “reasonable promptness” and report unauthorized checks. If the same forger hits your account more than once and you didn’t report the first incident within 30 days of receiving your statement, you lose the right to recover on later items the bank paid before it got your notice. There’s also a hard cutoff: if you don’t discover and report any unauthorized signature or alteration within one year of receiving the statement, you’re barred from claiming the loss regardless of negligence on either side.1Cornell Law Institute. Uniform Commercial Code 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
Positive pay sits directly on top of this framework. Banks increasingly use their treasury management agreements to shift fraud liability onto customers who decline available fraud prevention tools. A typical clause says that if your account is eligible for products designed to detect unauthorized checks and you choose not to use them, the bank has no liability for fraud those products would have caught. Federal courts have upheld these clauses, finding that the UCC allows banks and customers to vary the default rules by agreement, so long as the bank doesn’t disclaim responsibility for good faith or ordinary care and the standard isn’t “manifestly unreasonable.”2GovInfo. USCOURTS-ohsd-2_15-cv-03023 Refusing positive pay when your bank offers it can mean you absorb the full loss on a forged check.
What It Costs
Pricing varies by bank and account size. Most institutions charge a monthly service fee plus a per-item fee for exceptions. Monthly fees for check positive pay typically fall between $30 and $70, with exception items running an additional $1 to $3 each. ACH positive pay and payee positive pay may carry separate monthly charges. Some banks bundle these into treasury management packages where the cost is offset against earnings credits generated by your account balances.
Set against the potential loss from one forged check, the cost is modest. FinCEN reported more than $688 million in suspicious activity tied to mail theft-related check fraud alone during a single six-month review period.3FinCEN. FinCEN Issues In-Depth Analysis of Check Fraud Related to Mail Theft Individual losses run from a few hundred dollars to six figures depending on how many checks are compromised before someone notices. For a business that writes checks, the monthly fee buys insurance against a risk most will eventually face.