Positive Pay: How It Stops Check Fraud and What It Costs

Positive pay is a bank fraud control that matches every check presented against your account to a list of checks you actually issued. Any check that does not match on number, amount or date, or on payee name with payee matching, is flagged as an exception. You decide whether to pay or return it before money leaves the account.

It is one of the most effective, and least glamorous, tools a US business can use against check fraud. This guide explains how it works, what banks typically charge, how ACH positive pay extends the idea to electronic debits, and why check fraud is still a live problem in 2026.

Why check fraud is still a problem

Checks feel old-fashioned, yet many US businesses still write them to suppliers, landlords and contractors. That makes them a favorite target. The Association for Financial Professionals' 2025 Payments Fraud and Control Survey reported that 79% of responding organizations experienced attempted or actual payments fraud in 2024, and that checks were the payment method most often targeted, cited by 63% of respondents.

FinCEN, the US Treasury bureau that collects suspicious activity reports, has also flagged the problem. In a February 2023 alert it noted that check fraud reports had roughly doubled from 2021 to 2022. A follow-up FinCEN analysis published in 2024 looked at about 15,000 reports tied to mail theft filed over six months in 2023, covering more than $688 million in suspicious activity, including attempted transactions. Common patterns were stolen checks that were altered (often the payee and amount were "washed" and rewritten), stolen checks used as templates for counterfeits, and stolen checks endorsed and deposited by someone else.

The federal government itself is moving away from paper. A March 2025 executive order directed federal agencies to phase out paper checks for most payments, which says something about where official thinking is heading. Figures like these change each year, so check the latest AFP and FinCEN publications for current numbers.

How positive pay works, step by step

The mechanics are simple. Most banks follow this pattern:

1. You issue checks. Your accounting software or check-writing tool records the check number, date, amount and payee.
2. You send an issue file. The same day, you upload a file of those checks to the bank portal, or key them in manually. Many accounting systems can export a file in the bank's format.
3. Checks are presented. When a check arrives for payment, through clearing or at a teller, the bank compares it with your issue file.
4. Mismatches become exceptions. Anything not on the list, or with a different amount, is flagged. Duplicates of an already paid check number are flagged too.
5. You decide. Each business day you review exceptions online, usually with the check image, and choose pay or return before the bank's cutoff time.
6. The default applies. If you do not decide in time, the bank applies the default you chose at setup, usually return.

Teller matching extends the same check to over-the-counter cashing, so a branch can refuse a fake check at the window instead of after it clears.

Types of check matching services compared

Banks offer several flavors. The right one depends on how many checks you write and how much time you have to review exceptions.

Service	What it matches	Stops	Gaps
Standard matching	Check number, amount, date	Counterfeits, amount changes, unknown check numbers	Altered payee names
Payee name matching	The above plus payee name	Most altered and washed checks too	Errors in your own issue file
Reverse matching	You match the bank's daily list	Same as standard, if you review diligently	Relies entirely on your team
Teller matching	Checks cashed at a branch	Cashing of counterfeit checks	Only covers the branch channel
ACH debit filter or block	Approved ACH originators and limits	Unauthorized electronic debits	Does not cover checks or wires

Payee matching matters because the most common check fraud pattern in FinCEN's analysis was alteration of a genuine stolen check. Basic matching can miss that if the thief keeps the original number and amount.

ACH positive pay and debit blocks

Check fraud gets the headlines, but criminals also use stolen account numbers to pull money out by ACH debit. Once a supplier has your routing and account number, printed on every check you send, anyone holding a copy could try to originate a debit.

The ACH version lets you pre-approve which companies may debit your account, identified by their originator ID, and set maximum amounts. A debit from anyone else becomes an exception for you to review. ACH debit block is the blunt version: it rejects all ACH debits unless you list the originator as allowed.

Under Nacha rules, businesses generally have far less time than consumers to dispute an unauthorized debit, so catching it before it posts matters. Our comparison of ACH vs wire transfers explains how each rail settles and when payments become final.

What positive pay costs

Banks do not publish a standard industry price, and fees vary a lot. In general you can expect some combination of:

• A monthly service fee per account enrolled.
• A per-item fee for checks in the issue file, or per exception reviewed.
• Extra charges for payee matching, teller matching or ACH debit filters.
• Possible setup fees for file formats or treasury management onboarding.

Some banks include basic check matching in business account bundles. Ask your relationship manager for the current fee schedule and whether fees fall at higher balances.

Worked example: is it worth paying for?

Imagine a construction subcontractor that writes about 60 checks a month to suppliers and crews. Suppose its bank charges $50 a month for the service with payee matching plus $0.10 per issued check. That is $56 a month, or $672 a year. These are illustrative figures, not quotes.

Now compare one fraud incident. FinCEN's 2024 analysis reported a median suspicious amount of a little over $14,000 in its sample of mail theft check fraud reports. A single altered check of that size would cost more than 20 years of fees at the example price, before counting the staff time spent on affidavits, bank claims and supplier calls. For a business that writes checks every week, the math usually favors positive pay.

Liability: why declining positive pay can cost you

Under the Uniform Commercial Code, losses from altered or forged checks are often shared between the bank and the customer depending on who failed to take ordinary care. Many business account agreements add a clause saying that if you decline fraud prevention services the bank offers, you accept responsibility for losses those services would have caught.

The exact effect depends on your agreement, the facts and state law, and courts have treated these clauses differently. Read the fraud prevention section of your account agreement and, if a large sum is at risk, talk to your bank or a qualified legal adviser. This article is general information, not legal advice.

Setting up positive pay: a practical checklist

1. Ask your bank which check matching services it offers and request the fee schedule.
2. Choose payee matching if you mail checks, since mail theft and payee alteration are common patterns.
3. Set the default decision to return, so missed exceptions are rejected rather than paid.
4. Connect your accounting software's check register export to the bank's file format, or plan to enter checks manually.
5. Upload the issue file the same day you print checks, before they go in the mail.
6. Assign a primary and a backup reviewer for daily exceptions, and note the bank's cutoff time.
7. Add an ACH debit filter or block on accounts that should never be debited by outsiders.
8. Review exception reports monthly to spot patterns, such as repeated attempts on a specific check range.

Other habits that reduce check fraud

Check matching works best as one layer among several. Practical steps include:

• Pay electronically where you can. ACH or same-day bank transfers remove the paper that thieves wash and copy. Instant rails are covered in our guide to FedNow and RTP instant payments.
• Mail checks securely. Drop them inside the post office rather than in a collection box, and avoid leaving outgoing mail in an unattended mailbox.
• Use a dedicated disbursement account with a low balance for checks, kept separate from your main operating account.
• Verify bank detail changes. Fraudsters also impersonate suppliers to redirect payments. Call a known number before changing any payee details, as explained in our guide to invoice scams.
• Reconcile promptly. A fast bank reconciliation catches anything that got past other controls while you can still dispute it.
• Use security features such as high-security check stock and tamper-resistant ink.

Some banks now also use machine learning to score checks for signs of alteration. Our overview of AI fraud detection in payments explains where those tools help and where they still need human review.

What to do if a fraudulent check gets through

Even with good controls, a bad check can occasionally clear, for example during a period when an account was not enrolled. Speed matters, because deadlines for reporting unauthorized items to your bank are often short for business accounts.

1. Call your bank as soon as you spot the item and follow up in writing. Ask what affidavit or claim form it needs.
2. Get a copy of the cleared check image, front and back, and note who deposited it and where.
3. Stop or void any related checks that are still outstanding, and consider closing the account and opening a new one if the account number has been widely exposed.
4. Contact the intended payee, because a stolen check usually means your supplier still has not been paid. Agree how and when you will reissue payment, preferably electronically.
5. If the check was stolen from the mail, report it to the US Postal Inspection Service, and keep records of every report you make.
6. Review what failed. Was the account enrolled, was payee matching on, was an exception approved without checking the image?

Keep a simple incident log with dates, amounts and reference numbers. It speeds up the bank claim and is useful if your insurer or accountant needs the details later.

What this means for the invoices you send

If you are on the receiving side, you can nudge customers away from checks. Put ACH or bank transfer instructions prominently on your invoice, and list checks last if you accept them at all. Our guide on how to show bank details on an invoice covers the safe way to do this, and our tips to get paid faster explain why electronic payments usually shorten your collection cycle.

The US invoice generator lets you add payment instructions in the notes and terms, set a due date and download a PDF. It does not process payments or track checks, so use it alongside your bank's fraud controls.

Conclusion

Positive pay costs a modest monthly fee and a few minutes of review each day, and it blocks the counterfeit and altered checks that make up much of business payments fraud. Choose payee matching, set the default to return, add ACH positive pay on sensitive accounts, and keep moving suppliers to electronic payments. Then send clear invoices with safe payment instructions using the free invoice generator.