How positive pay stops check fraud
Checks are still the payment method businesses lose the most to fraud. In the 2025 AFP Payments Fraud and Control Survey, 63% of organizations reported attempted or actual check fraud in 2024, more than any other method, and 79% faced some form of payments fraud overall. Paper checks sit in mailboxes, pass through hands, and carry your account and routing numbers in plain print. Positive pay is the control most banks point you to first, and it works by comparing every check that clears against a list you supplied in advance.
The matching mechanism
Positive pay is a daily reconciliation that happens before money leaves your account. You send your bank a file, called a check issue file or issue register, each time you cut checks. That file lists the checks you actually wrote. Each row carries a few key fields: account number, check number, amount, issue date, and on many layouts the payee name.
When a check is presented for payment, the bank looks it up in your issue file. If the check number, account, and amount all match a row you submitted, the item pays normally. If something does not line up, the bank does not pay it automatically. It flags the item as an exception and holds it. You then get an exception report, usually through your business banking portal the same morning, with an image of the check and a deadline to decide: pay or return. Miss the deadline and the bank applies your default, which most businesses set to return.
That is the whole idea. The bank is no longer guessing whether a check is legitimate. It is checking your own record against what showed up.
What it catches: altered checks and counterfeits
Two of the most common attacks fail against this matching.
- Altered checks. A real check you mailed gets intercepted and chemically washed or digitally edited. The thief changes the payee and bumps the amount from $250 to $2,500. When that altered check clears, the check number still matches your issue file, but the amount does not. The bank flags it as an exception before it pays.
- Counterfeit checks. Someone prints a check on your account using a check number you never issued, or one that does not exist in your register at all. There is no matching row in your issue file, so the item lands on your exception report instead of clearing silently.
Payee Positive Pay adds the payee name to the comparison. This is the version that catches a washed check where the criminal kept the original amount but changed who it was payable to. If your bank offers it and you can populate a clean payee field, it is worth turning on, because amount-only matching will not see a changed payee.
What positive pay does not stop
It is a check control, and it has edges. Knowing them keeps you from leaning on it for risks it was never built to cover.
- Bad data in equals bad data out. If your issue file lists the wrong amount or a duplicated check number, the bank matches against your mistake. The control is only as accurate as the register you send.
- Late or missing files. A check presented before your issue file arrives may be treated as an exception you have to clear manually, or worse, slip through under a "pay" default. Send the file the same day you cut checks.
- ACH and wire fraud. Positive pay covers checks. Electronic debits pulled against your account are a separate problem, addressed by ACH positive pay, ACH debit blocks, or debit filters. Ask your bank about those separately.
- Internal fraud and approved exceptions. If an insider has the authority to add checks to the register or to approve exceptions, the matching does not see anything wrong. Segregation of duties still matters.
- Reverse positive pay differs. Some banks offer reverse positive pay, where you review every cleared item and decide what to return, without submitting an issue file. It shifts the work to you and is weaker than standard positive pay. Confirm which one you are enrolled in.
Where the issue file comes from
The catch for most small businesses is producing the file. Your bank specifies an exact layout: which fields, in which order, as a fixed-width text file or a delimited CSV, sometimes with a header and trailer record. QuickBooks cannot export a positive pay file natively, and neither can most accounting packages, so you are left copying a check register into a format the bank will accept. Format it wrong and the upload bounces.
PositivePayMaker exists to close that gap. You drop in a CSV or Excel export of your check register, map your columns once, and it writes a file in your bank's layout. It is free and runs entirely in your browser, so your check data, account numbers, payee names, and amounts never leave your computer or hit a server. There are 11 built-in bank layouts, including formats built from published specifications for Chase and Huntington, plus a custom format builder for any layout your bank hands you and a validator to check a file before you submit it.
When a paid tool makes sense
We will be straight about this. If you generate files across many entities, need scheduled automation, or want a vendor-maintained library covering hundreds of banks, a paid desktop product may fit better. Big Red Consulting's PositivePay File Creator runs about $119 the first year and $99 to renew; it is Windows only and the QuickBooks Online edition needs Excel installed. Treasury Software's Bank Positive Pay runs roughly $29.95 to $89.95 a month as installed Windows software with a library of more than 350 verified layouts. For a single business cutting checks weekly, a free browser tool usually covers the need; for higher volume or heavy automation, the paid options earn their fee.
Verify the first file with your bank
Whatever you use, treat your first generated file as a draft. Field positions, date formats, and header requirements vary between banks and sometimes between products at the same bank. Generate one file, upload it to your bank's positive pay portal as a test, and confirm it imports cleanly with no rejected rows before you rely on it. If your bank publishes a current spec through its treasury or business banking portal, match that, then build the layout in the custom format builder if it is not already a preset.