Positive Pay for Business: Check and ACH Fraud Controls

Understand what check positive pay actually compares

Traditional check positive pay compares checks presented for payment with an issue file sent by the business. The issue file typically contains check number, date and amount. If the presented item does not match, the bank creates an exception for review. The system is most effective when the company sends complete issue information promptly after checks are created and stops relying on manual memory to identify valid items.

A simple example shows the value. The company issues check 10425 for $4,850. A fraudster alters the amount to $14,850. If the bank receives the correct issue record before presentation, the amount mismatch can create an exception instead of allowing the altered item to post automatically. The exact matching fields and default action vary by bank, so treasury should test them with real checks before assuming every type of alteration will be caught.

Use payee matching when check volume and risk justify it

Payee positive pay adds payee name comparison to the usual check number and amount controls. That can help address check washing, where a legitimate check is altered to a different payee. Payee matching depends on image quality, name formatting and the bank’s recognition rules, so businesses should understand how the system handles abbreviations, punctuation and multiple payees.

The company also needs to produce accurate payee information in the issue file. If accounting sends inconsistent names, the bank may generate too many false exceptions and staff may begin approving them without review. Monitor exception rate after implementation. A high rate is not proof the product is ineffective. It may show that the issue file needs cleaner data or that check printing formats need adjustment.

Add ACH blocks and filters for account level control

Banks may offer ACH debit blocks, filters or authorization rules that let the business reject all incoming debits or permit only approved originators and conditions. OCC authentication guidance specifically identifies positive pay, debit blocks and other transaction controls as tools available to business customers. These services can reduce exposure when an operating account should receive credits but very few third party debits.

Build the authorized list from actual recurring activity. A tax account may allow only government debits, while an operating account may permit known insurers, lenders and service providers. If a legitimate originator changes identifiers, the business needs a procedure to update the filter before the next debit. Overly broad rules weaken protection, while overly narrow rules create operational failures. Review the list at least when vendors, lenders or payroll providers change.

Treat the exception deadline as part of the security control

Positive pay does not help if the business fails to review exceptions before the bank’s decision deadline. Banks define a default action, such as pay or return, when the customer does not respond. Treasury should know that default and choose it deliberately. A pay default can allow a fraudulent item through when staff miss the queue, while a return default can bounce a legitimate payment and damage a supplier relationship.

Assign at least two trained reviewers and establish coverage for vacations and holidays. Send alerts to more than one person when the bank supports it. If the decision cutoff is noon, the internal target might be 10:30 a.m. so questions can be resolved. Reviewers should have access to invoice or check issue evidence, not merely the bank image. The control works because the decision is informed and timely, not because the product name appears on the account.

Protect the issue file and administrative settings

An attacker who can alter the check issue file or positive pay rules may be able to make fraudulent activity look authorized. Secure the upload process, restrict administrative permissions and use dual control for changes when available. If issue files are generated from accounting software, transmit them through the bank approved secure channel rather than emailing or manually editing them.

Reconcile file control totals. If the company printed 86 checks totaling $214,600, the issue file should contain the same number and amount. Investigate rejected uploads immediately. Administrative changes such as switching the default decision or disabling a filter should trigger alerts and secondary review. Positive pay is strongest when its own configuration is protected with the same seriousness as the payments it is designed to monitor.

Combine positive pay with reconciliation and fraud response

Positive pay is one layer, not a complete fraud program. Review bank activity daily, investigate unfamiliar checks and keep vendor payment controls strong. The OCC payment guidance emphasizes layered controls, segregation of duties and reconciliation. A fraudulent item may exploit a channel that is outside the specific positive pay rule, or an employee may mistakenly approve an exception.

Create an escalation path for a suspicious item. Staff should know how to return or challenge the item within the bank workflow, freeze related check stock or account access, and contact the bank fraud team when necessary. If several altered checks appear, review how the check information was exposed and whether mail handling or printer security must change. The objective is not only to reject one bad item but to close the weakness that produced it.

Editorial Verdict

Sources

• OCC authentication and access guidance
• OCC Payment Systems handbook
• OCC check fraud overview

Primary, regulatory and payment network sources were checked for this update. Bank specific terms can change after publication.