Positive Pay: How It Works, What Fraud It Stops, and Whether It's Worth It

Positive pay is a bank service that stops check fraud by paying only the checks you actually wrote. Each day you send your bank a list of the checks you issued, with check number, amount and date. When a check is presented against your account, the bank compares it with that list. A check that matches is paid. A check that doesn't match, such as an unknown check number, a changed amount or a duplicate, is held as an "exception" until you tell the bank to pay or return it.

Positive pay is a business banking service, and it targets the most common payments fraud businesses face. In the Association for Financial Professionals' 2026 survey, 58% of organizations reported check fraud in 2025, more than reported ACH or wire fraud. This page explains what positive pay means in banking, how it works step by step, which kinds of fraud it catches and which it misses, the different versions, what it costs, and who bears the loss when a bad check gets through. It is general information as of September 2026. Your bank's service agreement sets the actual terms.

What Positive Pay Means in Banking

The Office of the Comptroller of the Currency's check-fraud booklet, prepared by an interagency working group of bank regulators and law enforcement agencies, gives the standard definition. Positive pay "allows a company and its financial institution to work together to detect check fraud by identifying items presented for payment that the company did not issue." The company sends the bank a list of the checks it issued, and the bank "verifies checks received for payment against that list and pays only those on the list," per Check Fraud: A Guide to Avoiding Losses.

The word "positive" is the point. A traditional account pays every check unless you say stop, which is how a stop payment works. Positive pay flips the default for anything unexpected. The bank pays what you have confirmed in advance and questions everything else.

Banks usually sell positive pay as part of their treasury management or cash management services, alongside ACH controls, lockbox and wire services. It is designed for business, nonprofit and government accounts that write checks in volume. If you only have a personal checking account, ask your bank whether it offers anything similar.

How Does Positive Pay Work? Step by Step

The daily cycle has five steps.

1. You issue checks and send the issue file. Your accounting or payables system exports a file of that day's checks, with the account number, check number, amount, issue date and, for payee positive pay, the payee name. You upload it through the bank's online portal, or it is sent automatically, before the bank's cutoff.
2. Checks come in for payment. Payees deposit or cash your checks, and the checks come back through the clearing system to your bank, today mostly as electronic images.
3. The bank matches. Each presented check is compared with your issue file. Matches are paid.
4. Exceptions are held for you. Mismatches appear in the portal, usually with the check image, the same business day. You look at each one and choose pay or return.
5. The bank acts on your decision, or on the default. If you miss the cutoff, the bank applies the default you chose at setup, and that default is usually return.

Why the tight deadline? Under the Uniform Commercial Code, a paying bank that holds a check must pay it or return it before its "midnight deadline," which is midnight on the next banking day after it receives the check. After that, UCC 4-302 makes the bank accountable for the amount. Positive pay has to fit inside that window, so exception decisions are due the same day. At Western Alliance Bank, for example, the treasury agreement requires the customer to decide each exception "on the same Business Day by the Cutoff Time." If the customer has not chosen a default, the bank returns any exception left undecided.

Positive Pay Check Verification: What Gets Matched

Positive pay checks data. It does not check handwriting or signatures. The standard match compares:

• Account number and check number. These catch checks that were never issued, including counterfeits with made-up numbers and stolen blank checks.
• Amount. This catches a raised amount, such as $950 changed to $9,500.
• Issue date. Banks can also flag stale checks. The OCC booklet lists checks "that carry dates long past due" among the items rejected.
• Paid status. A check number that has already cleared is flagged as a duplicate. This catches the second copy of a counterfeit or a check deposited twice.
• Payee name, with payee positive pay only. This catches a "washed" check whose payee line has been erased and rewritten.

Two limits are worth knowing. First, a matching check gets paid. Western Alliance's terms, for example, say the bank "is not obligated to verify signatures on any Checks that match the information Company provides." Second, standard positive pay does not read the payee line, so a check with only the payee changed passes unless you have payee positive pay.

Positive Pay for Check Fraud: Why Businesses Use It

Check fraud rose sharply after the pandemic, even as check use declined. In February 2023 the Treasury's Financial Crimes Enforcement Network issued an alert on mail theft-related check fraud. It reported that check-fraud suspicious activity reports rose from more than 350,000 in 2021 to over 680,000 in 2022, "nearly double the previous year's amount of filings." The alert noted that business checks "may be more valuable because business accounts are often well-funded and it may take longer for the victim to notice the fraud."

FinCEN's follow-up trend analysis counted 15,417 reports and more than $688 million in suspicious activity tied to mail theft-related check fraud in just six months (February 27 to August 31, 2023). That figure includes attempted as well as completed transactions. It also broke down what criminals did with the stolen checks:

That mix explains why positive pay is a standard defense. Altered checks, the largest group, are caught when the amount changes, and caught when the payee changes if you have payee positive pay. Counterfeits made from a stolen check are caught unless the counterfeit copies an issued check exactly and reaches the bank first. The third group, checks fraudulently signed, depends on whose signature was forged, as the next section explains.

Regulators are still focused on the problem. In June 2025 the Federal Reserve, FDIC and OCC requested public comment on ways "to help consumers, businesses, and financial institutions mitigate risk of payments fraud, with a particular focus on check fraud."

Fraud Protected by Positive Pay, and What Slips Through

Positive pay protects well against three things: counterfeit checks (fake checks with your routing and account numbers), altered checks (amount changed, or payee changed if you have payee positive pay), and forged checks written on stolen blank stock, because those check numbers were never issued.

It does not stop:

• A genuine check stolen and cashed unchanged. A thief who deposits your real check with a forged endorsement, or into an account opened in the payee's name, presents a check that matches your file perfectly. That is a forged-endorsement problem, handled through the banks' warranty claims and the rules in the Uniform Commercial Code, not by positive pay.
• Fraud inside your own company. If an employee both writes a fraudulent check and uploads the issue file, the check matches. Separate those duties.
• Electronic debits. Check positive pay does not screen ACH debits. That takes ACH positive pay or an ACH debit block, described below. The site's entry on the automated clearing house covers how those debits flow.
• Checks the bank has already paid or is already bound to pay. Western Alliance's terms exclude items it "has already cashed, negotiated or paid or which Bank is already committed to honor or pay under applicable laws or regulations." Some banks offer "teller positive pay" so that tellers check your issue file before cashing a check over the counter.
• Fraud on checks you receive. Positive pay protects your outgoing checks. It does nothing about a bad check a customer gives you.

Types of Positive Pay: Standard, Payee, Reverse and ACH

Standard (classic) positive pay matches check number, amount and date. It is the basic version the others build on.

Payee positive pay adds the payee name to the match. Given how much current check fraud involves washing and rewriting the payee, it is often worth the extra setup. Your check-printing software has to put the payee name in a form the bank can read reliably, so check with the bank about formatting.

Reverse positive pay moves the matching to you. The OCC booklet describes it this way: the company, not the bank, "maintains the list of checks issued." The bank sends you the list of checks presented, and you tell it which match. It suits companies that can't produce an issue file easily. But it puts the work and the deadline on your staff, and if a review is missed, the default in your agreement decides what happens to the checks.

ACH positive pay and ACH debit block apply the same idea to electronic debits. In Western Alliance's service description, a debit block "automatically returns all incoming debit Entries," while ACH positive pay "allows Company to review and confirm debit Entries prior to posting." If you pay some bills by ACH debit, filtering rules can usually let known billers through and block everything else.

Is Positive Pay a Scam?

No. Positive pay is a standard fraud-control service offered by banks, and federal bank regulators have described it as a check-fraud prevention measure since at least the OCC's 1999 booklet. If "Positive Pay" appears on your business account statement, it is most likely your bank's fee for the service. Some banks enroll customers automatically: Western Alliance's agreement says that for customers using its full check-printing service, the bank "may automatically enroll Company in Bank's Positive Pay Service." Ask the bank if you don't recognize the charge.

The scam risk is impersonation of your bank. Positive pay gets your staff used to approving checks, and a request to approve a payment is exactly what bank impersonators ask for. The Federal Trade Commission reported in 2023 that bogus bank fraud warnings were the most common text message scam, "often by asking people to verify a large transaction they did not make." Real positive pay exceptions are decided inside your bank's authenticated online portal. If a call, text or email asks you to approve an exception, change a default decision, release a check, or give login codes, hang up. Then call the bank on the number you already have.

Is Positive Pay Worth It? Costs and a Worked Example

For most businesses that write checks regularly, yes. The cost is small next to a single fraudulent check, and your bank's agreement may leave you with the loss if you turn the service down.

Pricing varies by bank. It is usually a monthly fee per account, plus per-item or per-exception charges. As one published example, Western Alliance Bank's business fee schedule effective February 2, 2026 prices check, payee, reverse or ACH positive pay on its Small Business Advantage accounts at $25.00 per account per month when bundled with at least one other qualifying service. It lists issued items at $0.13 each and exception items at $3.00 each. Ask your own bank for its schedule.

Worked example at those prices. A contractor writes 300 checks a month and gets 4 exceptions a month (mostly its own data-entry errors):

• Check positive pay service (bundled price): $25.00
• Issued items: 300 × $0.13 = $39.00
• Exceptions: 4 × $3.00 = $12.00
• Total: $76 a month, or $912 a year.

One washed check with the payee rewritten and $950 raised to $9,500 costs ten times that year's fees. Payee positive pay catches that check on both counts. And cash isn't the only cost. A fraud loss means staff time spent on affidavits, a possible account closure and reissued checks, and a dispute with the bank.

The stronger argument is legal. Some business account agreements say that a customer who declines a recommended fraud tool bears the losses it would have prevented. Western Alliance's treasury agreement provides that if the company "fails to implement such a tool despite Bank's recommendation, Company shall be precluded from asserting a claim against Bank for paying an unauthorized, altered, counterfeit, or other fraudulent item that the recommended tools were designed to detect or deter." Read your own agreement for similar language. If it is there, declining positive pay effectively means insuring your own checks.

Who Bears the Loss: Positive Pay and the Law

Without any agreement to the contrary, the UCC's default rules favor the account holder. Under UCC 4-401, a bank may charge your account only for an item that is "properly payable," meaning "authorized by the customer and ... in accordance with any agreement between the customer and bank." A counterfeit check or one with a forged drawer signature is not properly payable. If an altered check is paid in good faith, the bank may charge only the original terms of the check.

Three things erode that protection:

• Your duty to review statements. UCC 4-406 requires you to examine statements with "reasonable promptness" and report unauthorized signatures or alterations. However careful either side was, you are barred from asserting them against the bank after one year. Business account agreements can shorten these windows, so check yours.
• Your own negligence. Under UCC 3-406, if your "failure to exercise ordinary care substantially contributes to an alteration" or a forged signature, you are precluded from asserting it against a bank that paid in good faith. If the bank was careless too, the loss is split by comparative fault.
• The agreement itself. UCC 4-103 lets the bank and customer vary Article 4 by agreement. They cannot "disclaim a bank's responsibility for its lack of good faith or failure to exercise ordinary care," but they may set the standards for measuring it "if those standards are not manifestly unreasonable." That flexibility is what allows banks to write clauses like the one quoted above.

The UCC is state law. Every state has adopted Article 4, with some local variations. For a disputed loss, talk to a lawyer about your state's version and your agreement.

Setting Up and Running Positive Pay

Positive pay is only as good as the routine around it. An issue file sent late turns good checks into exceptions. An exception nobody reviews falls to the default. And a single employee who controls both the checks and the file defeats the whole design. The habits below close those gaps.

• Choose payee positive pay if your bank offers it and your check printing supports it.
• Automate the issue file from your accounting system, and send it before any check leaves the building, including manual and emergency checks.
• Split duties. The person who writes checks should not be the only person who uploads the file or decides exceptions. Western Alliance, for one, recommends "a dual control environment" for issue files.
• Set the default to return, and name backups so exceptions are decided even when someone is out.
• Add ACH debit block or ACH positive pay on the same accounts, and use a separate account with a block on all debits for check disbursements if your volume justifies it.
• Reconcile daily, and keep reviewing statements. Positive pay does not replace the review the UCC expects of you.

FAQ

What types of fraud does positive pay protect against?

Counterfeit checks, checks with altered amounts, checks written on stolen blank stock, duplicate presentments and stale-dated checks. With payee positive pay, it also catches checks whose payee name was changed. It does not stop a genuine check cashed unchanged by a thief, insider fraud where the issue file is also falsified, or ACH debits.

Is positive pay a legitimate bank service?

Yes. It is offered by banks as part of business treasury management and has been described by federal bank regulators as a check-fraud control since at least 1999. Be wary of anyone who calls or texts asking you to approve a check or share login codes. Real exception decisions are made in your bank's online portal.

What happens if I don't respond to a positive pay exception?

The bank applies the default decision on your account. Most customers choose to return unapproved checks, and at some banks return is the default if you set nothing. Because banks must pay or return a check by their UCC midnight deadline, a missed cutoff usually cannot be undone the next day.

What is the difference between positive pay and reverse positive pay?

With positive pay, you send the bank a list of issued checks and the bank does the matching. With reverse positive pay, the bank sends you the list of presented checks and you do the matching and approve them. Reverse is easier to set up but relies on your staff meeting the deadline.

Sources

• Office of the Comptroller of the Currency (Check Fraud Working Group of the interagency Bank Fraud Working Group), Check Fraud: A Guide to Avoiding Losses (February 1999): definitions of positive pay and reverse positive pay
• Financial Crimes Enforcement Network, FinCEN Alert on Nationwide Surge in Mail Theft-Related Check Fraud Schemes Targeting the U.S. Mail, FIN-2023-Alert003 (February 27, 2023): check-fraud SARs of 350,000+ in 2021 and 680,000+ in 2022
• Financial Crimes Enforcement Network, Mail Theft-Related Check Fraud: Threat Pattern & Trend Information, February to August 2023 (released September 9, 2024): 15,417 reports, $688 million, altered 44% / counterfeit 26% / fraudulently signed 20%
• Federal Reserve Board, Federal bank regulatory agencies seek comment to address payments and check fraud (June 16, 2025)
• Association for Financial Professionals, 2026 AFP Payments Fraud and Control Survey Report: 58% of organizations reported check fraud in 2025; 465 respondents
• Federal Trade Commission, New FTC Data Analysis Shows Bank Impersonation is Most-Reported Text Message Scam (June 8, 2023)
• Uniform Commercial Code (Cornell LII), § 3-406, § 4-103, § 4-302, § 4-401, § 4-406, and the midnight deadline definition in § 4-104
• Western Alliance Bank, Treasury Management Services Agreement (November 2024): Check Positive Pay and ACH Positive Pay service descriptions; fraud prevention tools clause
• Western Alliance Bank, Business Banking and Related Services Schedule of Fees and Charges (effective February 2, 2026)