Positive pay is a bank fraud-control service that compares each check or ACH debit presented against your account with a list of payments your company actually authorized, then holds anything that does not match for you to pay or return. It exists because checks remain the most attacked payment type: in the 2026 AFP Payments Fraud and Control Survey, 58% of organizations said checks were targeted by fraud in 2025, ahead of ACH debits at 30% and wires at 25%.
​

Most bank pages describe positive pay in a paragraph and a sign-up button. This guide lays out the four common variants side by side, walks through the daily issued-items and exception workflow step by step, explains why decision deadlines and default settings matter more than most treasury teams expect, and covers when the service is worth its fee.
​

Positive pay is a matching service offered by commercial banks. The business sends a record of every check it issues, or a list of companies allowed to debit its account, and the bank compares incoming items against that record. Items that match post normally. Items that do not match become exceptions that the business must review and decide.
​

The name reflects the logic. Instead of the bank paying everything and the business hunting for fraud on its monthly statement, the business positively confirms what should be paid in advance. A counterfeit check with a valid account number, or an altered check with a raised amount, fails the match and lands in an exception queue before the money leaves.
​

The threat it targets is large. FinCEN reported on February 27, 2023 that financial institutions filed more than 350,000 suspicious activity reports tied to check fraud in 2021 and more than 680,000 in 2022, nearly double the prior year, driven largely by mail theft. The AFP survey, based on 465 treasury practitioners polled in January 2026, found that 76% of U.S. organizations experienced attempted or actual payments fraud in 2025, and that 72% of organizations still using checks plan to keep using them. Checks are not going away, so the controls around them still matter.
​

Positive pay does one narrow job. According to Atlantic Union Bank's positive pay user guide, standard check positive pay matches serial number, date, and amount, and it does not verify whether the account has funds to cover the item. It is a fraud filter, not a cash management tool, and it works alongside the broader payment rails a company uses rather than replacing any of them.
​

Positive pay works as a daily loop. The business uploads an issued-items file after each check run, the bank compares presented checks against it overnight or at the teller line, the bank publishes an exception report each morning, and an authorized user decides pay or return on every flagged item before a fixed cutoff that same banking day.
​

Here is how the cycle runs at a typical bank. Times and field names vary, so the bank's service agreement always controls.

The exception reason tells the reviewer where to look. Atlantic Union's guide lists these standard reasons: duplicate item (two checks paid with the same serial number), amount mismatch, future dated, posted against a void, posted against a stop, no issue found, serial error (the serial number could not be read), and payee mismatch for customers with the payee add-on. A "no issue found" on a check your team never wrote is the classic counterfeit signature. An amount mismatch on a check you did write often means someone washed and raised it.
​

Not every exception is fraud. Atlantic Union's guide warns that handwritten business checks match poorly and that most will generate exceptions, and it recommends MICR bond stock, black ink, and plain fonts to keep read rates high. Teams that write many manual checks should expect a noisier queue.
​

Banks sell four main variants. Check positive pay matches serial number, date, and amount. Payee positive pay adds the payee name. Reverse positive pay sends every presented check to the business for its own matching. ACH positive pay, often paired with a debit block or filter, controls which companies can pull money electronically.
​

This is the baseline product. It stops counterfeit checks drawn on your account number and checks whose amount was changed. Its gap is the payee line. If a thief steals a legitimate check from the mail, washes out the payee, and writes in a new name while leaving the amount alone, serial number, date, and amount all still match, and the check pays.
​

Payee positive pay closes that gap by reading the payee name from the check image and comparing it to the file. At Atlantic Union it is available only to customers who also use standard positive pay, the payee field allows up to 80 characters, and mismatches always show the reason "Payee Mismatch." The guide advises that if a payee prints on two lines, the file should carry the full two-line name in one field. Given that mail theft drove the check-fraud surge FinCEN flagged, the payee layer is where most of the added protection sits.
​

With reverse positive pay, the bank does not match anything. It sends the business a list of every check presented, and the business compares it to its own records. At Atlantic Union, every presented check posts as an exception to be decided by 1:00 p.m. Eastern, and an account on reverse positive pay cannot also carry standard or payee positive pay. It suits businesses that want to avoid uploading files, but it shifts all the matching labor, and all the risk of a missed review, onto the business.
​

ACH positive pay applies the same idea to electronic debits. The business registers which originators may debit the account. Forbright requires the originating company ID for each authorization and lets customers add dollar ranges, expiration dates, frequency, and occurrence limits. Any debit outside those rules becomes an exception. At Atlantic Union, paying an ACH exception automatically adds that originator to the rule list, with no maximum amount by default, so reviewers should tighten the rule after approving a new vendor.
​

A debit block is the blunt version: it rejects all ACH debits to the account. A filter, as First National Bank describes it, lets approved transactions post while blocking and returning unauthorized ones. A block fits pure disbursement accounts where nothing should ever pull funds. A filter fits operating accounts with recurring tax, payroll, or vendor debits.
​

Deadlines and defaults matter because positive pay only protects items someone actually reviews. Exception windows usually close around midday on the banking day the report appears, and anything left undecided follows the default set at enrollment. A pay default quietly lets fraud through on a busy day, while a return default can bounce legitimate checks.
​

Cutoffs are short and they differ by product within a single bank. Forbright gives customers until 12:00 p.m. Eastern for checks and 3:00 p.m. Eastern for ACH debits on the day the exception report is available. Florence Bank's check deadline is 12:00 p.m. Eastern. Atlantic Union uses 1:00 p.m. Eastern for check products and 3:00 p.m. for ACH. A team based on the West Coast may have only a few working hours to clear the queue.
​

The default decision is where policy shows up. Forbright lets customers choose Pay or Return on the implementation form. Florence Bank defaults unworked exceptions to return. Atlantic Union fixes the ACH default at return and states it cannot be altered, while letting customers pick the check default. A pay default makes the service optional in practice: if the reviewer is out sick, every exception clears.
​

Missing the ACH window is costly because the normal fallback is slow. Under Nacha rules, a business account holder that finds an unauthorized debit after the fact relies on return reason R29, which carries a return timeframe of two banking days. Positive pay moves that decision to the morning the debit arrives, before the window closes. For a fuller comparison of how debits and wires settle, see this ACH vs wire transfer breakdown.
​

Practical safeguards follow from this. Name at least two decision-makers with authority on every account, set mobile alerts where the bank supports them (Atlantic Union allows decisions through its mobile app for most products), and pick a return default unless there is a documented reason not to.
​

Positive pay affects who bears a fraud loss, not just whether one occurs. Under the Uniform Commercial Code, customers have duties to review statements promptly, and losses can be split between bank and customer based on each side's care. Many deposit agreements also address losses on items a customer could have caught with an offered fraud service.
​

UCC section 4-406 requires a customer to exercise reasonable promptness in examining statements for unauthorized payments. If the same wrongdoer strikes repeatedly, the customer gets a window of no more than 30 days before losing claims on later items, and a customer who fails to report an unauthorized signature or alteration within one year of the statement is barred from asserting it against the bank. Where both parties fell short, section 4-406(e) allocates the loss by how much each party's failure contributed.
​

Positive pay turns that after-the-fact statement review into a same-day decision. Review the actual deposit agreement with counsel. Liability terms are contract-specific and this guide does not interpret any particular bank's terms.
​

Positive pay is usually worth it for any business that writes checks or keeps an account exposed to ACH debits. The cost is a monthly bank fee plus daily staff time on exceptions and file uploads. The value is stopping counterfeit, altered, and unauthorized items before they post, rather than disputing them later.
​

Fees are set by each bank's fee schedule and are often negotiable within a treasury relationship. Florence Bank, for example, lists positive pay in its business fee schedule and notes that earnings credits on cash management checking can offset the fee. Ask for pricing by product, since check, payee, and ACH services are often priced separately, and ask whether per-item or per-exception charges apply.
​

The less obvious cost is operational. Someone must upload the issued file after every check run, including manual and emergency checks, and someone must clear the queue before noon every banking day. Teams that print checks from several systems should consolidate the export first, because a missing file entry creates a false exception that still demands attention. Integrating the export with cash application automation and remittance data tends to reduce manual effort on both sides of the ledger.
​

A reasonable decision rule:

Setting up positive pay means enrolling each account with the bank, mapping the accounting system's check export to the bank's file format, choosing default decisions and approvers, loading an initial list of outstanding checks and authorized ACH originators, and testing with a live check run before relying on the service.
​

Start with an inventory. List every account, which ones issue checks, and which receive ACH debits, including tax authorities, payroll providers, insurers, and card processors. The ACH list becomes the authorization file, and each entry needs the originator's company ID as it appears on past debits.
​

Next, map the file. Most bank platforms accept delimited or fixed-width custom layouts. Atlantic Union's supports more than a dozen date formats and a void flag, so voiding a check in the file causes any later presentment to raise a "posted against void" exception. Load all outstanding checks at go-live, or older checks will surface as "no issue found" once positive pay turns on.
​

Then set governance: approvers, dual control on file uploads and decisions, the default for each product, and a backup reviewer. Run a first cycle with a known check batch, confirm the file loaded, and watch the first exception report before trusting the automation.
​

For companies modernizing payables beyond checks, Eco offers stablecoin payment infrastructure as one more option alongside existing rails, though positive pay remains the right control for any account that still issues checks or accepts ACH debits.
​

Methodology: statistics in this article come from the AFP 2026 Payments Fraud and Control Survey press release and FinCEN's February 2023 alert. Deadlines, file fields, and defaults are quoted from the published service documents of Forbright Bank, Atlantic Union Bank, and Florence Bank as examples; terms differ by bank.
​