Check positive pay compares the check number and amount of every presented check, and usually its date, with the issue file the business sent; payee positive pay also compares the payee name. The difference decides whether a washed check is paid. A thief who changes only the payee leaves the number and amount exactly as the business issued them, so check positive pay finds nothing wrong, while payee positive pay stops it, provided the payee is in the file and the bank can read the line. Botminds' Positive Pay Exceptions reads that line off the image with a confidence, allows the client's registered short names, and looks for signs of washing, so the gap between the two services can be measured rather than argued. The way to measure it is to plant known checks and count.
The ten planted checks below are an illustrative test design worked through by logic, not a measured result: each outcome follows from what each service compares. The sample screens come from a fictional bank, Tessaly Community Bank, and its fictional clients.
Why the payee line is the one to compare
44%
of FinCEN’s mail theft-related check fraud reports involved altered checks, the largest share
15,417
reports in six months of 2023, tied to more than $688 million in actual and attempted transactions
1st
the payee line: the part of a stolen check most often altered, ahead of the amount
What is the difference between check positive pay and payee positive pay?
One field. Check positive pay, the original service, compares the numbers a bank's machines already read: the check number and the amount on the encoded line, and the issue date where the file carries it. The interagency booklet that described the service in 1999 has the bank reject checks not on the company's list, checks over a set amount and stale checks (Check Fraud: A Guide to Avoiding Losses); the payee does not appear. Payee positive pay adds the payee name, which the bank has to read off the image because no machine-readable line carries it.
Check positive pay and payee positive pay, row by row
Check positive pay: Account, check number, amount, issue date for every check issued
Payee positive pay: The same, plus the payee name exactly as printed on the check
Check positive pay: Against the encoded number and amount, and the date if the file has one
Payee positive pay: Also against the payee line, read from the check image
Check positive pay: Matches the file and is paid
Payee positive pay: Stopped as an exception for the client to decide
Check positive pay: Few: wrong amounts keyed by the client or a depositary bank
Payee positive pay: More: abbreviations, trade names and misread handwriting, unless the bank keeps the client's registered names
Check positive pay: A file match
Payee positive pay: Image reading, a name-matching rule and a way to show the client what was read
Does positive pay check the payee? Only when the file carries it and the bank can read it
Not by default. The Federal Reserve's check fraud mitigation toolkit describes the issued-check list as carrying the serial number, the amount “and often, the payee”, and is careful about what follows: matching against the list helps prevent a check alteration where the amount or payee is changed only “if the payee can be validated” (FedPaymentsImprovement.org). Both conditions are real: a business can send a payee only if its accounting system exports one, and a bank can compare it only if it reads the payee line off the image.
The toolkit's own example shows what success looks like. A commercial customer issued a check for $14,750 to a trusted vendor; the check was stolen, altered and deposited under a different payee name, and the paying bank's payee validation flagged the mismatch against the customer's issued-check file. Its fraud analysts confirmed the alteration and returned the check as altered/fictitious. Without the payee in the file, the same check would have matched on number and amount and been paid.
Where thieves alter a stolen check: the payee first, then the amount
FinCEN's review of six months of reports tied to its 2023 mail-theft alert found that stolen checks are most often altered and then deposited or cashed, that the payee line was the section altered most often and the amount second, and that a changed amount is usually a higher one (FinCEN Financial Trend Analysis). That ordering is the case for payee positive pay in one sentence: the most common alteration is the one check positive pay cannot see.
The Federal Reserve's 2026 survey of financial institution risk officers points the same way. Of the institutions surveyed, 21% said check washing was increasing and another 46% called it persistent; for payee forgery the figures were 18% and 53% (FRFS Risk Officer Survey, 2026). The survey describes itself as not independent academic research, and its margin of error is six points either way; the direction, not the decimal, is the point.
Plant ten checks and count what each service stops
A seeded test settles the argument on your own terms. Take one client's issue file, plant ten checks whose truth you know, and run them through each configuration of the service. Eight below are bad, built from the patterns FinCEN describes; two are genuine, because a service that stops good checks costs the client its morning and, if one is returned by mistake, costs the bank a wrongful dishonor claim. Count four columns: check positive pay; payee positive pay with an exact name match; payee positive pay with a loose match tuned to pass abbreviations; and payee positive pay with the client's registered names plus a reading of the image and the client's history.
Ten planted checks, and what each service does with them
1
Payee washed and rewritten; amount, number and date untouchedaltered
A · checkPays it
B · payee, exactStops it
C · payee, looseStops it
D · payee, names, imageStops it
2
Amount raised from $1,284.00 to $9,284.00; payee untouchedaltered
A · checkStops it
B · payee, exactStops it
C · payee, looseStops it
D · payee, names, imageStops it
3
Payee and amount both changed, number and date untouchedaltered
A · checkStops it
B · payee, exactStops it
C · payee, looseStops it
D · payee, names, imageStops it
4
Payee changed to a near-identical name: “Lakeshore Medical Supplies”altered
A · checkPays it
B · payee, exactStops it
C · payee, loosePays it
D · payee, names, imageStops it
5
Stolen and deposited unaltered, in an account opened in the payee’s own namestolen
A · checkPays it
B · payee, exactPays it
C · payee, loosePays it
D · payee, names, imagePays it
6
Counterfeit with a check number the client never issuedcounterfeit
A · checkStops it
B · payee, exactStops it
C · payee, looseStops it
D · payee, names, imageStops it
7
Counterfeit copying a check already paid: same number and amountcounterfeit
A · checkStops it
B · payee, exactStops it
C · payee, looseStops it
D · payee, names, imageStops it
8
A stale check re-dated to look currentaltered
A · checkStops it
B · payee, exactStops it
C · payee, looseStops it
D · payee, names, imageStops it
9
Genuine check to the client’s registered short name, “LMS”genuine
A · checkPays it
B · payee, exactStops a good check
C · payee, loosePays it
D · payee, names, imagePays it
10
Genuine check the depositary bank encoded fifty cents highgenuine
A · checkStops a good check
B · payee, exactStops a good check
C · payee, looseStops a good check
D · payee, names, imageRaises it, explains it
The score: caught, missed and wrongly stopped
Check positive pay stops five of the eight bad checks and pays three: the washed payee, the near-identical payee and the unaltered stolen check. Payee positive pay with an exact match stops seven, but it also stops both genuine checks, because ‘LMS’ is not ‘Lakeshore Medical Supply’ and a fifty-cent encoding difference is still a difference. Loosen the name match to let the short name through and it pays the near-identical name too. That is the trade every payee service makes: a name rule loose enough to stop pestering clients about abbreviations is loose enough to pass ‘Supplies’ for ‘Supply’.
Bad checks stopped, out of eight planted, by service
Column D resolves the trade without loosening anything. Exact matching stays on; the client's registered short names and trade names count as matches because the client registered them, not because a fuzzy score was high. The fifty-cent check is still raised, because the bank's tolerance is zero, but the reading of the amount box shows the check says what the client issued, and the item arrives explained, with a recommendation to pay, rather than as a mystery. On the sample day exactly that happened: a check fifty cents above its issue file, traced to the depositary bank's encoding, recommended for payment at a confidence of 0.89, which sent it to a person because the bank's threshold is 0.90.
What is a payee mismatch in positive pay, and when is it not fraud?
A payee mismatch is an exception raised because the name read from the presented check's payee line differs from the name in the client's issue file. Most are innocent, and the innocent ones have a small number of causes: an abbreviation or trade name, a payee written by hand that the reader misread, a corrected name the client never updated in its file. The dangerous ones look the same in a portal row, which is why the row is not enough.
Two of the four compared fields differ, and the screen says which in one sentence
The sample bank's rule book says it plainly: the payee must match the issue file, and a registered abbreviation or d/b/a name on the client's own name list counts as a match; nothing else does. On the sample Thursday a property manager paid its own exception for a check made out to a registered abbreviation of its supplier at 10:48 AM, citing that clause, and the item went into the history with the reason it was paid.
Can positive pay catch an altered payee that still reads cleanly?
A field match cannot; the image sometimes can. Washing removes ink, but rarely all of it, and a new payee written over a washed line is often in a different pen or a different hand from the rest of the check. FinCEN's 2023 alert lists that very trace among its red flags. The payee agent reads the line with a confidence and the fraud signs agent looks for the residue, so an alteration can be raised even where the new name happens to resemble the old one.
Six zones read off the image, each with the characters and the confidence
The signature zone is the quiet one, and it settles the type. The signature matches the card the bank holds, the number and date match the client's file, and only the payee and amount moved: a genuine check, altered. That classification is not academic. Who bears the loss on an altered check differs from who bears it on a counterfeit, and counterfeit check vs altered check sets out where the evidence for each sits on the image.
The check no positive pay can stop
Check 5 passes every configuration, and it should be in any honest test because it is common. FinCEN found that some criminals “opened accounts either in the name of the payee or a name that is nearly identical” (FinCEN Financial Trend Analysis), most often when the stolen checks were made out to businesses. A stolen check deposited unaltered in an account bearing the payee's real name matches number, amount, date and payee. Positive pay has nothing to object to, and nor does the image.
That check is stopped, if at all, at the bank of deposit, and the loss is argued over the indorsement rather than the face of the check. The business still has a duty to examine its statements with reasonable promptness and report what it finds, and after one year an unreported alteration is barred whatever anyone's care (UCC 4-406(c) and (f)). Who is liable for altered checks follows the loss from there.
How to test positive pay before you rely on it
The seeded test is cheap to run and hard to argue with, and it works for a bank choosing a provider and for a business choosing a bank's service. The steps below are the minimum; positive pay software: pilot it on last month's exceptions extends it to a full month of real exceptions with known outcomes.
A seeded test of positive pay, in eight steps
- Use one real client's issue file, with payees
A test on the provider's demonstration data measures the demonstration.
- Plant at least one of each pattern above
Washed payee, raised amount, both, near-identical name, unaltered theft, two counterfeits, a re-dated check.
- Plant genuine checks that look wrong
Short names, trade names, handwritten payees, an encoding difference. False stops cost clients.
- Hide the answers from whoever runs the test
Score against a key kept by someone else.
- Count three outcomes, not one
Bad checks stopped, bad checks paid, good checks stopped.
- Note what the decider was shown
A stop that arrives as a bare row is a stop the client may still pay.
- Note the confidence on every reading
And what happens below the threshold: a person, or a guess.
- Keep the unaltered theft in the set
It shows what no positive pay does, so nobody promises it.
Questions people ask
Is payee positive pay worth it over standard positive pay?
For a business that mails checks, usually yes, because the payee line is the part of a stolen check most often altered, according to FinCEN's review of mail theft-related check fraud reports. The cost is in the file and the false stops: the business has to send payee names exactly as printed, and the bank has to handle abbreviations without loosening the match.
What is teller positive pay?
The same check against the same issue file, applied when a check is cashed over the counter rather than when it arrives through clearing. A teller who can see the issue row before paying cash can stop a changed amount or payee before the money leaves, which a clearing match the next morning cannot.
Can payee positive pay read handwritten payees?
It reads them with less confidence than printed ones, which is why a confidence on every reading matters. In the solution, any zone read below the bank's 0.90 threshold goes to a person rather than into the comparison, so a hard-to-read hand produces a question for the analyst instead of a silent guess.
Does payee positive pay stop counterfeit checks?
A counterfeit with a number the client never issued is stopped by any positive pay, because it is not in the file. A counterfeit that copies a genuine check's number and amount is stopped as a duplicate once the original has been paid, or by the payee comparison if the counterfeiter changed the name. A perfect copy presented before the original is the hard case.
Why do genuine checks fail payee positive pay?
Because the name on the check is not character for character the name in the file: a trade name, an abbreviation, an extra word, or a handwritten payee read imperfectly. Registering the client's own short names and trade names fixes most of these without loosening the rule for everyone else.