---
title: "What is positive pay? Check, ACH and payee positive pay"
description: "What positive pay is, how check, payee and ACH positive pay work, what they cost in effort, and the payment fraud they do not stop. A guide for AP teams."
url: https://realpayee.com/blog/what-is-positive-pay
canonical: https://realpayee.com/blog/what-is-positive-pay
date_published: 2026-10-05
date_modified: 2026-10-05
updated: 2026-10-05
author: "RealPayee"
site: RealPayee
---

# What is positive pay? How check, payee and ACH positive pay work

> Positive pay is a bank fraud service that compares every check or ACH debit presented against your account with the items you actually issued or authorized. Anything that does not match becomes an exception you approve or return before it posts. It stops forged checks and unauthorized debits, not payments your own team is tricked into sending.

_Guides · Published 2026-10-05 · 6 min read · By the RealPayee team_

## Key takeaways

- **Check positive pay** matches check number, amount and account; **payee positive pay** adds the payee name, which catches altered payees.
- **ACH positive pay** (also called ACH debit filter or block) only lets pre-approved company IDs debit your account.
- Exceptions need a named owner and a decision before the bank's daily cutoff, or the default rule decides for you.
- Positive pay protects money **leaving by debit or check**. It does nothing about a wire or ACH credit your team sends to a fraudster's account.

## Positive pay, defined

Positive pay is a treasury management service offered by most US business banks. You tell the bank, in advance, which payments are allowed to come out of your account. The bank then compares every check presented for payment (and, with the ACH version, every incoming ACH debit) against that list. Items that match post normally. Items that do not match are held as **exceptions**, and someone on your team decides whether to pay or return each one.

The idea is simple: a fraudster can print a convincing check on your account number, or wash and rewrite one of yours, but they cannot add it to the issued-items file your company sent the bank this morning. The mismatch is the alarm.

It is worth being precise about the term because it covers several different services. When a banker says "positive pay", ask which of the four below they mean, because each one closes a different gap.

## How check positive pay works, step by step

1. **You issue checks** from your ERP or AP system as usual.
2. **You send an issued-items file** to the bank the same day: account number, check number, amount and issue date for every check (plus payee name if you use payee positive pay). Most ERPs can export the file in the bank's format, or your bank portal accepts an upload.
3. **The bank compares** each check presented over the counter, through remote deposit or in clearing against that file.
4. **Mismatches become exceptions** in the bank portal: unknown check number, wrong amount, duplicate number, stale date, payee mismatch, or a check you voided.
5. **You decide each exception** (pay or return) before the bank's daily cutoff, often late morning local time.
6. **No decision means the default applies.** Most banks let you choose a default of pay or return. Choose return unless you have a strong reason not to.

> [!TIP]
> **Send voids too**
> Include voided and cancelled checks in the issued-items file. A voided check that is later presented is one of the most common exceptions, and without the void flag it will post.

## The four types of positive pay

| Type | What the bank checks | Stops | Effort for AP |
| --- | --- | --- | --- |
| Check positive pay | Check number, amount, account, sometimes issue date | Counterfeit checks, altered amounts, duplicate presentment | Daily issued-items file plus exception review |
| Payee positive pay | Everything above plus the payee name | Checks stolen from the mail and re-made out to a new payee | Same file with payee names; slightly more exceptions from name variations |
| Reverse positive pay | The bank sends you the list of presented checks and you do the matching | The same as check positive pay if you actually do the review | Higher: your team does the comparison every day |
| ACH positive pay (debit filter or block) | The originator's company ID and, optionally, a maximum amount | Unauthorized ACH debits pulled with your account and routing number | Maintain an allow list of company IDs; review new debit exceptions |

Some banks also offer **teller positive pay**, which pushes the same issued-items check to the branch counter so a teller can see in real time whether a check being cashed is on your list. If your checks are frequently cashed in person, ask for it.

### Positive pay vs reverse positive pay

With reverse positive pay, the bank does not hold a file from you. It sends you a daily list of checks presented, and you compare that list with your own records. It is usually cheaper, but the protection depends entirely on someone doing the comparison every single day, including the day the AP lead is out. If you choose reverse positive pay, write the daily review into a checklist with a named backup.

## What ACH positive pay adds

Anyone who has seen one of your checks knows your routing and account number, and those two numbers are enough to originate an ACH debit against you. ACH positive pay (sold as ACH debit filter, debit block or ACH fraud control depending on the bank) blocks debits from any originator whose company ID is not on your approved list. Typical set-up:

- Pull 6 to 12 months of statements and list every legitimate ACH debit originator: tax agencies, payroll provider, card processors, insurers, utilities and loan servicers.
- Add each company ID to the allow list, with a maximum amount where the bank supports it.
- Set the default for new originators to **return**, and route exceptions to the same reviewer who handles check exceptions.
- Block all debits on accounts that should never be debited, such as a dedicated disbursement account.

For more on how debit fraud and credit-push fraud differ, see our guide to [ACH fraud and how to prevent it](https://realpayee.com/blog/ach-fraud-prevention).

## Running the daily exception review

Positive pay fails quietly when exception review becomes a rubber stamp. A simple, written routine prevents that:

1. **Name an owner and a backup** for every business day, including holidays when your office is closed but the bank is open.
2. **Set a calendar block** at least an hour before the bank cutoff.
3. **Never approve an exception from memory.** Pull the check image and compare it with the AP record: payee, amount, check number, signature.
4. **Call the payee on a number from your vendor file** if a legitimate-looking check has an unexpected payee or amount. Do not use a number printed on the check.
5. **Log each decision** with reviewer name, time and reason. Your auditors will ask for it.
6. **Escalate patterns**: several exceptions on one account usually mean check stock or a mailed batch has been compromised. Talk to the bank about closing the account.

## What positive pay does not stop

Positive pay protects you from payments that someone **else** pulls from your account. It cannot help with payments your own team pushes out after being deceived, and that is where most business losses now sit. The FBI's Internet Crime Complaint Center recorded about **$3.0 billion** in reported business email compromise losses in 2025 across 24,768 complaints. In those schemes, the company itself sends a wire or ACH credit to an account the criminal controls, so every positive pay check passes.

| Scenario | Does positive pay help? | What does |
| --- | --- | --- |
| Counterfeit check drawn on your account | Yes | Check positive pay |
| Stolen check re-made out to a new payee | Yes, with payee positive pay | Payee positive pay |
| Unknown company debits your account by ACH | Yes | ACH positive pay |
| Fake vendor email changes bank details, you pay the new account | No | [Vendor verification](https://realpayee.com/vendor-verification) of the change with the real contact |
| Spoofed CEO email or deepfake call asks for an urgent wire | No | Out-of-band [CEO fraud](https://realpayee.com/ceo-fraud) verification |
| Fraudster logs into your bank portal and sends wires | No | Dual approval, hardware tokens, [wire fraud controls](https://realpayee.com/wire-fraud-prevention) |

> [!WARNING]
> **The gap auditors keep finding**
> Many teams treat positive pay as their payment fraud control. It covers checks and debits. Vendor bank-detail changes and executive payment requests need a separate control that confirms the real person behind the request before money moves.

## Setting up positive pay: a checklist

- Ask your bank for check, payee and ACH positive pay pricing and the file specification for each account.
- Confirm your ERP or AP tool can export the issued-items file in that format, and test it with a small batch.
- Decide the default decision (pay or return) per account, in writing, and get it approved by the controller.
- Load the ACH allow list from a review of historical debits.
- Write the daily exception procedure with owner, backup, cutoff time and logging requirements.
- Read your treasury services agreement. Many agreements shift responsibility for check fraud losses toward the customer if a fraud-prevention service was offered and declined.
- Add positive pay exceptions to your monthly close review so patterns are noticed.

Once positive pay is running, close the remaining gap: payments your team initiates. Our free [vendor bank-change policy template](https://realpayee.com/templates/vendor-bank-change-policy) covers the callback rules, and the [comparison of verification approaches](https://realpayee.com/compare) explains when manual callbacks stop scaling.

## Frequently asked questions

### What is positive pay in banking?

Positive pay is a bank service that matches checks and, with the ACH version, debits presented against your account to a list of items you issued or authorized. Mismatches are held as exceptions for you to pay or return before they post.

### Is positive pay worth it for a small business?

If you write checks or have your account number printed anywhere, usually yes. The fee is typically small compared with one counterfeit check, and many bank agreements shift check fraud losses to customers who declined the service.

### What is the difference between positive pay and payee positive pay?

Standard check positive pay matches check number, amount and account. Payee positive pay also matches the payee name, so a stolen check that is washed and re-made out to a different name is caught.

### Does positive pay protect against wire fraud?

No. Positive pay screens checks and incoming ACH debits. Wires and ACH credits your team sends are authorized by you, so they pass. Those need [out-of-band verification](https://realpayee.com/vendor-verification) of the request itself.

### What happens if no one reviews a positive pay exception?

The bank applies your default decision at the cutoff. If the default is pay, a fraudulent check posts. Set the default to return and name a backup reviewer for every business day.

## Sources

- [FBI IC3 2025 report: business email compromise losses (McDonald Hopkins summary)](https://www.mcdonaldhopkins.com/insights/news/the-sobering-truth-of-the-fbis-2025-internet-crime-complaint-center-report)

## Related

- [ACH fraud: how it works and how to prevent it](https://realpayee.com/blog/ach-fraud-prevention) - The four kinds of ACH fraud that hit businesses, why ACH credits are hard to recover, and a practical prevention checklist for AP and treasury teams. (markdown: https://realpayee.com/blog/ach-fraud-prevention.md)
- [Vendor onboarding checklist: a fraud-safe process for AP](https://realpayee.com/blog/vendor-onboarding-checklist) - A step-by-step vendor onboarding process and checklist for AP teams: what to collect, how to verify bank details, who approves, and what to log for audit. (markdown: https://realpayee.com/blog/vendor-onboarding-checklist.md)
- [Vendor verification: how to verify vendor bank details before you pay](https://realpayee.com/vendor-verification) - A practical guide to vendor verification for finance teams: how to confirm vendor bank-detail changes, run callbacks, and prevent vendor impersonation fraud. (markdown: https://realpayee.com/vendor-verification.md)
- [Wire fraud prevention: how to stop bank wire fraud](https://realpayee.com/wire-fraud-prevention) - Controls that prevent business wire fraud: out-of-band verification, payment thresholds, dual approval and audit trails. (markdown: https://realpayee.com/wire-fraud-prevention.md)
- [Payment fraud glossary](https://realpayee.com/glossary) - Plain-English definitions of payment fraud and verification terms: BEC, vendor impersonation, callback verification, positive pay and more. (markdown: https://realpayee.com/glossary.md)

---

**Further reading**
- [Vendor verification guide](https://realpayee.com/vendor-verification.md)
- [Free vendor bank-change policy template](https://realpayee.com/templates/vendor-bank-change-policy.md)
- [Compare: callbacks vs bank-account validation vs RealPayee](https://realpayee.com/compare.md)
- [Pricing](https://realpayee.com/pricing.md)

Canonical HTML: https://realpayee.com/blog/what-is-positive-pay · Site index for AI agents: https://realpayee.com/llms.txt?src=md-footer · Pricing: https://realpayee.com/pricing.md · Book a demo: https://realpayee.com/demo