Accounting
Financial Management
Positive Pay: How It Stops Check Fraud and How to Set It Up With Your Accounting System
Last updated: October 7, 2026 · Independent guide · We do not sell rankings or coverage.
Positive pay is a bank fraud control in which your company sends the bank a file of every check it has issued, and the bank pays a presented check only if its check number, amount and (with payee positive pay) payee name match that file. Anything that does not match becomes an exception that you must approve or return, by the bank’s daily decision cutoff. ACH positive pay applies the same idea to electronic debits by comparing them against rules you set. It only works if your accounting system sends a complete issue file every day you cut checks.
What positive pay means, precisely
Positive pay is a bank treasury service. Your ERP or accounting system creates the issue file, and the bank does the matching and holds the exceptions. The main variants:
| Variant | What the bank compares | What it misses |
|---|---|---|
| Check positive pay | Account, check number, amount, issue date | A stolen check with only the payee name changed |
| Payee positive pay | The above plus the payee name | Fraud that happened before the check was issued, such as a fake vendor |
| Reverse positive pay | Nothing; the bank sends you the presented checks and you review them | Any item you do not review before the deadline |
| ACH positive pay | Incoming ACH debits against your filters (originator ID, SEC code, amount range) | Debits from an originator you have already authorized |
The control matters because checks remain the most attacked payment type. In the Association for Financial Professionals’ 2025 survey, 63% of organizations reported attempted or actual check fraud in 2024, and only 22% recovered 75% or more of lost funds (AFP, April 15, 2025). FinCEN reported that banks filed over 680,000 check fraud suspicious activity reports in 2022, up from more than 350,000 in 2021 (FinCEN FIN-2023-Alert003, February 27, 2023).
Example: one altered check
Illustration only. On Monday your AP team prints check 10452 for $1,840.00 to Midwest Packaging. Your ERP exports the day’s issue file, and you upload it before the bank’s evening cutoff. The check is stolen from the mail, and the thief changes the payee to a personal name and the amount to $18,400.00. When it is presented on Wednesday, the amount does not match the file, so the bank lists it as an exception. Your analyst compares it with the ERP payment record and selects “return.” Had the thief changed only the payee name, plain check positive pay would have paid it; payee positive pay would have flagged it.
How positive pay works in practice and in software
Issue files from your ERP. Many ERPs export the file natively. Microsoft Dynamics 365 Business Central has a Positive Pay Export action on the bank account, lists payments since the last upload, and is preconfigured for Bank of America and what Microsoft calls “City Bank” (Microsoft Learn, August 21, 2025). Oracle NetSuite generates the file through its Electronic Bank Payments SuiteApp, with templates for Bank of America Merrill Lynch, RBC and SVB controlled disbursement accounts (Oracle NetSuite Help, no date shown). Sage 100 Contractor supports delimited or fixed-length layouts with a void indicator (Sage, May 17, 2023). Smaller systems often rely on a report export: HBT Bank has QuickBooks Desktop users export a check report and map its columns in the bank portal (HBT Bank, no date shown).
Bank requirements. Read your bank’s service agreement, because deadlines and defaults differ. Community West Bank requires issue files by 9:00 PM Pacific, exception decisions by 11:00 AM Pacific, and defaults checks to “return” and ACH items to “pay” (Community West Bank, July 1, 2026). Banc of California defaults both check and ACH exceptions to return, says payee names must match the issue file exactly, and limits its liability for a wrongly paid item to the lesser of the item amount or your actual damages (Banc of California, May 6, 2025).
Exception decisions. Assign a primary and a backup decision-maker who check each exception against the ERP record. Send voids and manual checks to the bank the same day, because a missing record produces false exceptions and a void left off the file leaves a check payable.
How we researched this
We read the top-ranking explainers, then checked Microsoft, Oracle NetSuite and Sage documentation, two published bank service documents, and AFP and FinCEN data. The banks we reviewed do not publish fees, so none are listed.
Frequently asked questions
What is the difference between positive pay and payee positive pay?
Standard positive pay matches the check number and amount against your issue file. Payee positive pay also compares the payee name, which catches stolen checks where only the name was changed. Banc of California, for example, requires the payee name in your issue file to match the printed check exactly.
What happens if I miss the exception decision deadline?
The bank applies the default in your agreement. Community West Bank returns unmatched checks but pays ACH exceptions by default, while Banc of California returns both. Confirm your default in writing before you go live.
Does positive pay stop ACH fraud?
Only if you also enroll in ACH positive pay or an ACH debit block, which screen incoming debits against your filters. Neither stops a payment your own team was tricked into sending.
Related terms
- Internal controls in accounting software
- AP fraud and false invoice detection
- AP and AR KPIs for cash health
Sources
- Association for Financial Professionals, “Survey: 79% of Organizations Were Victims of Attempted or Actual Payments Fraud Activity in 2024,” April 15, 2025. financialprofessionals.org
- FinCEN, Alert FIN-2023-Alert003 on Mail Theft-Related Check Fraud, February 27, 2023. fincen.gov
- Microsoft, “Export positive pay files,” Dynamics 365 Business Central, August 21, 2025. learn.microsoft.com
- Oracle NetSuite, “Positive Pay Payment Format,” no date shown. docs.oracle.com
- Sage, “About positive pay,” Sage 100 Contractor help, May 17, 2023. help-sage100contractor.na.sage.com
- HBT Bank, “QuickBooks Guidelines for Positive Pay Issued File Export,” no date shown. hbtbank.com
- Community West Bank, Positive Pay User Guide, revised July 1, 2026. communitywestbank.com
- Banc of California, Check and ACH Positive Pay Service Description, revised May 6, 2025. bancofcal.com
Sherman Hsieh
Independent analysis of enterprise software — ERP, CRM and more
