Positive Pay

Positive pay is a fraud-prevention service that banks offer to business customers who write checks. The company tells the bank which checks it has issued, and the bank pays only those presented checks that match the list. Anything that does not match is held and referred to the company for a decision. The service is aimed at counterfeit, altered and forged checks.

It is a standard part of treasury management services in the United States, where businesses still make large numbers of payments by check and where check fraud has grown even as check use has declined. The same matching principle has been extended to electronic debits under the name ACH positive pay.

Each time the company prints or writes checks, it sends the bank an issue file listing, for every item, the account number, the check serial number, the amount and the date, and in fuller versions the payee name. Files are uploaded through the bank's portal or sent automatically from the accounting system.

When checks arrive at the bank through check clearing, the bank's system reads the account and serial number from the MICR line and compares each item with the issue file. Items that match are paid. Items that do not, because the serial number is unknown, the amount differs, the check was already paid or it has been voided, become exceptions. The bank shows the company an image of each exception early in the day, and the company must answer pay or return before a deadline, usually late morning or early afternoon. If no answer is given, the bank applies a default agreed in advance, most often to return the item.

• Payee positive pay. The bank also reads the payee name on the check image and compares it with the issue file. This closes the gap left by basic matching, which cannot see that a payee has been changed.
• Reverse positive pay. The company sends no file. Instead the bank sends the company a daily list of all checks presented, and the company itself checks them against its records and tells the bank which to return. Responsibility for matching stays with the company.
• Teller positive pay. Issue information is made available to branch staff so that a check presented for cash over the counter is verified before payment.
• ACH positive pay. For electronic debits, the company gives the bank a list of approved originators and limits. An ACH filter lets matching debits through and flags others for review, while an ACH debit block rejects all debits on an account.

Positive pay is often combined with controlled disbursement accounts, which tell the company early each day the total of checks that will clear, and with account reconciliation services that use the same issue file.

Basic positive pay stops counterfeits, which are checks manufactured with the company's account details but with serial numbers or amounts the company never issued, and it stops alterations of the amount. It also catches duplicate presentment, where the same check is deposited twice, for example once by phone through remote deposit capture and again at a branch.

It does not, without the payee option, stop the commonest modern scheme: a genuine check stolen from the post and altered by check washing so that it names a new payee while the serial number and amount stay the same. Nor can any version detect a forged check endorsement on the back, or a check properly issued to a fraudulent supplier. Companies therefore pair the service with secure check stock, separation of duties, prompt bank reconciliation and a move toward electronic payments.

In the United States, the Uniform Commercial Code generally places the loss from a forged or counterfeit check on the paying bank, since such a check is not properly payable from the customer's account, while allowing the loss to shift to a customer whose own carelessness contributed. Banks must also decide quickly: an item not returned by the statutory midnight deadline is treated as paid. Positive pay gives both sides the means to make that decision in time.

Because the service is effective and widely available, banks' account agreements commonly state that a business which declines positive pay, or fails to review its exceptions before the deadline, accepts responsibility for losses the service would have prevented. Courts have upheld such terms in a number of cases. For a company with any significant check volume, the practical result is that refusing the service transfers check fraud risk onto itself. Fees are charged per account and per item, and are small relative to that exposure.

The control depends on discipline. Every check must be in the issue file before it can be presented, including manual and emergency checks written outside the normal run; otherwise legitimate payments are returned and payees inconvenienced. Voids and each stop payment must be communicated. Someone with authority must review exceptions every banking day within the bank's window, with a deputy for absences. Old outstanding items should be cleared from the file so that a stale-dated check is not paid by default.

Data quality problems account for most false exceptions: amounts keyed incorrectly, serial numbers misread from damaged checks, and payee names that the bank's image-reading software cannot interpret. Companies that issue checks from several systems need all of them to feed the bank.