Positive pay is a fraud-prevention service offered by banks that verifies each check presented for payment against a list of checks the business says it issued. If the details do not match, the bank flags the item instead of paying it. It shifts check verification from something a business discovers after the fact to something the bank checks before funds leave.
The control only works if the file reaches the bank before the check does. A business that issues checks on Monday and transmits the file on Wednesday has a two-day window where legitimate checks get flagged and fraudulent ones may not.
Format is set by the bank, not by a standard. Most accept a fixed-width or delimited text file, and each bank publishes its own layout specification. This is why a business changing banks usually has to rebuild the export from its accounting system.
Standard check positive pay matches the check number, account, date, and amount. It catches counterfeit checks and altered amounts, but not a changed payee name, because the payee is not in the comparison.
Payee positive pay adds payee name verification, usually by reading the name off the check image. It closes the gap where a fraudster intercepts a legitimate check and alters only the payee, leaving the amount and check number untouched.
EXAMPLE
A check for $4,200 to ABC Supply is intercepted and the payee is changed to a different name while the amount stays the same. Standard positive pay passes it: number, date, and amount all match. Payee positive pay flags it.
ACH positive pay applies the same principle to electronic debits rather than checks. Instead of a list of issued items, the business maintains rules governing which originators are allowed to debit the account, and often at what maximum value or frequency.
Any ACH debit from a company not on the approved list, or exceeding its authorized parameters, is flagged for review before it posts. This matters because ACH debit fraud does not require a physical document: an originator only needs the account and routing numbers, both of which appear on the bottom of every check the business writes.
Related services include ACH debit blocks, which reject all incoming debits outright, and ACH debit filters, which permit only a specified list. Positive pay differs by routing unrecognized items to a person for a decision rather than rejecting them automatically.
Reverse positive pay inverts the responsibility. Rather than the business sending an issued-check file for the bank to match against, the bank sends the business a daily list of checks presented, and the business reviews it and identifies anything it does not recognize.
Reverse positive pay is usually cheaper and requires no file export from the accounting system, which makes it attractive to smaller businesses. The tradeoff is that the burden of detection sits entirely with the business, and any item not reviewed before the cutoff defaults to being paid.
An exception is any item the bank could not match. The business receives a notification, typically each morning, and must respond by a same-day deadline that is often early afternoon.
Most exceptions are not fraud. The common causes are a check issued but never included in the file, an amount keyed differently from what was printed, a manual check written outside the accounting system, and a check reissued after a void that was not communicated.
A default decision applies if nobody responds by the cutoff, and which default applies varies by bank. Some pay by default, some return by default. A business that assumes the wrong one can either release a fraudulent check or bounce a legitimate supplier payment.
