Positive pay: how it works for checks and ACH

• Check fraud is common. In the 2026 AFP Payments Fraud and Control Survey, 58% of organizations reported check fraud in 2025, and checks remained the payment method most often affected.
• Business checks are a target. FinCEN reported that check fraud suspicious activity reports rose from more than 350,000 in 2021 to over 680,000 in 2022, and noted that business checks can be more valuable to criminals because the accounts are often well funded and fraud may take longer to notice (FinCEN alert, February 2023).
• Your bank may expect it. Bank of America's positive pay fact sheet warns that not using available fraud services, including positive pay, may leave you with fraud losses the bank will not reimburse. Read your own account agreement for the terms that apply to you.

1. 1

   1. Send the issue file

   Each time you write checks, you send the bank an issue file listing them: check number, amount, date and, if you use payee positive pay, the payee name.
2. 2

   2. The bank compares

   When a check is presented for payment, the bank compares its check number and amount (and payee name, where that option is on) with your issue file.
3. 3

   3. Mismatches become exceptions

   A check that is not on the file, has a different amount, repeats a serial number or was voided is listed as an exception, usually with an image of the check.
4. 4

   4. You decide by the cutoff

   Your team reviews each exception and tells the bank to pay or return it before the daily deadline. Anything left undecided gets the account’s default decision.

The exceptions you see depend on the bank. Bank of America, for example, lists checks paid that are not on the issue file, duplicate serial numbers, amounts that differ from the file, zero serial numbers and cancelled checks, with optional exceptions for stale-dated checks, checks over a maximum amount and payee mismatches (Bank of America fact sheet).

In the reverse positive pay service shown in Chase's fraud protection demo, the customer sets an amount and reviews checks at or above it. Reverse positive pay needs no issue file, but it is only as strong as the person reviewing, so most teams that write checks regularly are better served by bank-side matching with payee match.

ACH debits are pulled from your account by the company you owe, so a fraudster with your account number can try to pull money the same way. Banks offer two tools, which Nacha describes as protection against unauthorized debits, not a way to stop legitimate ones (Nacha FAQ):

• Debit block. Rejects ACH debits on the account. Use it on accounts that only ever receive money or pay by check.
• Debit filter or ACH positive pay. Lets through debits from companies you approve and flags the rest for you to accept or return. Use it on operating accounts that pay taxes, utilities or card bills by direct debit.

Neither tool looks at ACH credits you send. Paying a vendor by ACH or wire is a payment you authorized, so it is outside what positive pay covers.

For example, Alerus Bank accepts CSV, Excel or fixed-width text files with check number, amount and check date, with or without a payee name column, and lets files include voids (Alerus file guide). A two-check issue file might look like this:

Build the file from your check register and map it to the bank's layout. Keep the register itself accurate; the issue file is only as good as the record it comes from. A check register template helps if you write checks by hand.

Timing is set by the bank. Regions, for example, loads next-day exceptions by 9:30 a.m. CST and needs decisions by 2:00 p.m. CST, and asks whether a return is for fraud or another reason (Regions help card). Defaults differ too: in Chase's demo, positive pay exceptions left undecided at the cutoff are returned, while reverse positive pay items not reviewed are paid. Confirm the default on each of your accounts.

1. 1

   Step 1

   Ask your bank which services it offers on each account: check positive pay (with payee match if available), ACH positive pay or debit filters, and debit blocks.
2. 2

   Step 2

   Choose a default decision for exceptions nobody reviews by the cutoff (pay or return), and name at least two people who can make decisions.
3. 3

   Step 3

   Get the bank’s issue-file layout and map it from your check register or accounting system, then send a test file.
4. 4

   Step 4

   Send an issue file every time you print checks, before the checks are mailed, and include any voided checks.
5. 5

   Step 5

   Each business day, open the exception list as soon as the bank loads it and compare each item with the check register and the check image.
6. 6

   Step 6

   Decide pay or return for every exception before the bank’s cutoff, and mark returns as fraud where they are.
7. 7

   Step 7

   Investigate every fraud return and every file error: report fraud to the bank, and fix whatever caused a genuine check to be flagged.

Positive pay catches payments you did not make. It does not catch a payment you made by mistake or because you were tricked:

• Vendor bank-detail change scams. If a fraudster posing as a vendor gets you to update their bank details, your next ACH or wire goes to the fraudster as an authorized payment. Verify every change by calling the vendor on a number you already hold. See bank-change checks.
• Fake or taken-over vendors. A check written to a fictitious vendor is on your issue file, so it clears. See vendor fraud red flags.
• Duplicate payments. Paying the same invoice twice produces two valid checks. See preventing duplicate payments.
• Unapproved bills. Positive pay starts after the check is written. Approval of the bill itself happens earlier, in AP.

• Approved bills only. Invoices are routed by amount, vendor, GL code or department to one or more approvers before they sync to QuickBooks Online, Xero, FreshBooks, Zoho Books or Business Central, where your team pays them.
• Duplicate checks. Each invoice is compared with earlier invoices from the same vendor and given a duplicate risk level before approval, so you are less likely to write two valid checks for one bill.
• Bank-change holds. When Aequo AP detects new bank details for a vendor, it holds that vendor's invoices until someone calls the vendor back on a known contact and a second person approves the change. It does not confirm account ownership with a bank.
• Audit trail. Every invoice keeps a history of who captured, coded and approved it, which is the evidence you need when a positive pay exception is questioned.

Vendor payments from Aequo AP are coming soon; today, keep positive pay and debit filters on your bank accounts. See how bank-change checks work.