A positive pay service, whether a bank offers it to its business clients or a technology firm supplies it to the bank, always does the same first thing: match every presented check and ACH debit against what the client said it issued or authorized. The differences that decide losses come after the match. Ask what the person deciding an exception is shown, whether the image is read for washing, how the cutoff, the midnight deadline and the default are protected, how ACH debits are judged, who can decide and who checks, how a fraud referral is kept off the client's screen, and what evidence is kept and for how long. Twelve questions cover it, and they work for a bank choosing a technology provider and for a business choosing a bank. Botminds' Positive Pay Exceptions is agent software for the decision layer, and this guide says plainly where it answers each question and where it does not.
Screens come from a fictional sample bank, Tessaly Community Bank; its clients and people are fictional. Rules and sources are real and linked.
Why the choice of provider matters now
63%
of surveyed financial institutions reported check fraud attempts in the past year
31%
reported losses from check fraud
21%
said check washing was increasing; another 46% called it persistent
Twelve questions for any positive pay provider
- What does the person deciding see?
Both images and the client's issue row side by side, or a row with a field name?
- Does it say, in words, which fields moved?
And by how much, with the check number and date that did not.
- Does it compare the payee, and how does it treat short names?
Exact match with registered names, or a loose score?
- What does it read off the image, with what confidence?
And what happens below the threshold: a person, or a guess?
- Can it raise signs of washing, with the evidence?
One ink over another, check stock, the client's own payee history.
- How does it protect the midnight deadline and the return test?
Including the notice for checks of $5,000 or more.
- What happens to an undecided exception?
Is the default quoted, applied by a named person and checked?
- How does it judge ACH debits?
Company ID, entry class and cap per originator, and the right return reason.
- Who can decide, and who checks a bank-made decision?
The client in its window; maker-checker on everything the bank does.
- How is a fraud referral kept from the client?
By the screen and the export, not by people remembering.
- What evidence is kept, for how long, and how is it exported?
One action for an examiner, five years at least.
- Can we pilot it on our own closed month?
With pass lines set before the replay.
What do positive pay services actually differ on?
Not on the match. Every provider compares presented items with the issue file, and the comparison is simple enough that two competent systems will raise the same exceptions from the same file. They differ on everything around it: what the person deciding is given, how much of the image is read, how the deadlines and the default are enforced, how decisions are controlled and how the evidence survives. Those are the parts that decide whether a washed check is returned and whether the bank can explain, a year later, why it was not.
The Federal Reserve's 2026 survey of risk officers shows where institutions themselves look. Asked what mitigates check fraud losses, respondents named image analysis, positive pay, manual review with training and monitoring of new accounts; for ACH fraud, they named ACH positive pay “with name verification controls” among their answers (FRFS Risk Officer Survey, 2026). Name verification, image reading and a person reviewing are, in other words, what the buyers already expect from the decision layer.
Questions 1 to 4: what the person deciding gets to see
The person deciding an exception, usually the client's controller, should see the presented check and the client's own issue row in one view, a sentence naming which fields differ and by how much, and a reading of each zone with its confidence. A provider whose answer is a portal row with a field name and an image link is asking the client to do the comparison itself, in the hours before the cutoff.
Two of the four compared fields differ, and the screen says which
Question 3 is where providers diverge most quietly. A payee match that is exact will stop genuine checks to a client's trade names; a match loosened to stop that will pass near-identical names, which FinCEN found thieves use when they open accounts in a name close to the payee's. The better answer keeps the match exact and lets the client register its own short names. Check positive pay vs payee positive pay tests the trade on ten planted checks.
Can positive pay detect check washing?
A field match cannot detect washing as such; it can only notice that a field differs. Detecting washing means reading the image for its traces, and the signs are published. FinCEN's 2023 alert on mail theft-related check fraud lists checks on stock “noticeably different” from the stock used for the customer's known transactions, and handwriting overwritten by darker handwriting, among its red flags (FinCEN Alert FIN-2023-Alert003). A provider should say which of these it looks for, on what part of the check, and with what evidence it reports a sign.
The answer to watch for is a single fraud score with no evidence behind it. A score cannot be explained to a client, cannot be checked by a supervisor and cannot be defended to an examiner. In the solution each sign names what the agent looked at and the published red flag it matches, and no agent ever calls an item fraudulent; it raises a question for a person.
Questions on the clock: the cutoff, the midnight deadline and the default
A provider should show how its workflow fits every return inside two legal limits, and how it handles the clients who never answer. The paying bank must return the item or send notice of dishonor before its midnight deadline or be accountable for it (UCC 4-302(a)(1)); Regulation CC expects the returned check to reach the depositary bank by 2 p.m. on the second business day after presentment, with a notice of nonpayment for checks of $5,000 or more (12 CFR 229.31(b) and (c)).
The default is the harder half of the question. Ask what happens to an exception nobody decides: who applies the default, whether the clause is quoted, whether a second person checks it, and whether the client was reminded before it fired. An agreement may set the standards by which a bank's care is measured but cannot disclaim ordinary care (UCC 4-103(a)), and a default nobody applied is hard to call care. Positive pay decision: when the default decides for the client works through each default.
Does positive pay work for ACH payments?
Yes, as ACH positive pay: the client lists the companies allowed to debit its account, by company ID, usually with a cap each, and any debit outside the list or over the cap becomes an exception. Nacha's own risk advisory group, warning about a scheme in which fraudsters impersonate both bank and client, put it practically: “Setting up Positive Pay is significantly less work than changing all account information with vendors and customers after a fraud has occurred” (Nacha RMAG fraud alert).
An ACH debit checked against the client's own authorizations, not just a list
Ask a provider how it handles three ACH cases: a known company under a new company ID, a debit just over a cap, and a near-identical company name. The return reason matters as well. For a corporate debit the client says it did not authorize, Nacha's rule is that R29 remains the return reason for CCD and CTX debits to business accounts (Nacha; how to check the code on every return is in ACH return codes checked), and a provider should put the right reason on the return without the client having to know the code.
Questions on control: who decides, who checks, who sees a referral
Inside the client's window, the client decides its own items and sees only its own; outside it, every bank action should carry maker-checker, with a second person above a review amount the bank sets. Ask a provider whether those rules are enforced by the system or left to habit, and whether a person can check their own work. The sample bank's rule is that nobody can, and the system refuses it.
Question 10 is the one providers least often think about. A bank that files a suspicious activity report may not disclose it, or any information that would reveal it exists (31 CFR 1020.320(e)), and a positive pay service is a place where that can go wrong: a client message, a portal status or an export can mention a referral. Ask how the provider keeps it from happening by design.
The referral carries the evidence, and the client's view never shows it exists
Questions on evidence and proof
Two numbers frame the evidence question. A bank that keeps paid items must keep them, or the ability to produce legible copies, for seven years (UCC 4-406(b)); records required under the Bank Secrecy Act are kept for five (31 CFR 1010.430(d)). Within those, ask what is kept for each decision: both images, the issue row, every zone read with its confidence, the clause applied, the reason, the decider and the checker. And ask how long it takes to produce one decision's whole trail for an examiner.
The last question is about the provider's claims rather than its features. The 2026 interagency model risk guidance leaves generative and agentic AI models outside its scope and promises a request for information on them (OCC Bulletin 2026-13), so a bank cannot lean on that guidance to validate an AI-based provider. A replay of its own closed month, scored against known outcomes, is the evidence; positive pay software: pilot it on last month's exceptions sets out the scorecard.
Answers that should reassure you, and answers that should worry you
A reassuring answer: The check with the client's issue row drawn over it, and a sentence naming what moved
A warning sign: ‘The client gets a list of exceptions with an image link’
A reassuring answer: Named signs, each with the zone, the evidence and the red flag it matches
A warning sign: ‘Our model returns a risk score’
A reassuring answer: Exact, with the client's registered short names
A warning sign: ‘Fuzzy matching tuned to reduce false positives’, with no word on what it now passes
A reassuring answer: The default quoted, applied by a named person, checked by another
A warning sign: ‘The default applies automatically at the cutoff’
A reassuring answer: Company ID, class and cap per originator; near matches named, not assumed
A warning sign: ‘Clients can block all debits’
A reassuring answer: Restricted by role, redacted from client exports by design
A warning sign: ‘Staff are trained not to mention them’
A reassuring answer: A replay of your own closed month, with pass lines set first
A warning sign: ‘Our customers see a large reduction in fraud’, with no data you can test
Positive pay for business accounts: what a client should ask its bank
A business choosing its bank's positive pay should ask most of the same questions, translated. Will I see the check and my own issue row together, or a list? Will you compare payees, and can I register my short names? What is my default, and will you remind me before it fires? Is ACH positive pay included, and how do I add a new vendor? What does my agreement say if I decline the service? The last one matters most: some deposit agreements shift to a client that declines an offered fraud service the losses it would have caught, and the Sixth Circuit has held such a clause open to challenge where the products, their price and the test were not explained.
A provider that shows the person deciding the check, the issue row and the reason, protects the deadline, and keeps the evidence has answered eleven of the twelve questions. The twelfth is whether it will prove that on your own month.
Where Positive Pay Exceptions answers the twelve, and where it does not
The solution was built around these questions, and the table below says where its answer comes from. It is a decision layer: it works with the bank's item processing, image archive, digital banking platform, payments hub, core banking system and fraud case management, rather than replacing them. It does not set a bank's fees or choose which clients get the service, and it cannot stop a check that matches the file in every field, such as a stolen check deposited unaltered in an account in the payee's own name.
The twelve questions, and how Positive Pay Exceptions answers each
| Question | The solution's answer |
|---|---|
| 1 · What the decider sees | The check with the client's issue row drawn over it as a translucent layer |
| 2 · Fields that moved | One sentence naming each, and by how much, with the fields that matched |
| 3 · Payee and short names | Exact match; the client's registered abbreviations and d/b/a names count |
| 4 · Reading and confidence | Six zones with characters and confidence; under 0.90 goes to a person |
| 5 · Washing | Named signs with evidence and the published red flag; never a verdict |
| 6 · Deadlines | Cutoff, reminder, escalation and the midnight deadline on one clock |
| 7 · Undecided items | The default quoted, applied by an analyst with a reason, checked by a second person |
| 8 · ACH | Company ID, class and cap per authorization; near names named; R29 prepared |
| 9 · Control | The client decides in its window; maker-checker; supervisor above the review amount |
| 10 · Referrals | Two or more signs open one; restricted by role; redacted from client exports |
| 11 · Evidence | One trail of people and agents that cannot be edited, exported as an examiner pack |
| 12 · Proof | A replay of the bank's closed month and a shadow week before any client sees it |
Questions people ask
What is a positive pay service, and who provides it?
It is the bank's daily check of presented items against the client's own list, with exceptions sent to the client to pay or return. The provider is either the bank that offers it to its business clients, or the technology company whose system the bank uses to run it. A business deals with the first; a bank chooses the second. The twelve questions above apply to both, with the bank answering for its provider.
Is there a positive pay API for businesses?
Some banks let a business send issue data through an API rather than a file upload, which can add each check to the bank's list the moment it is written. Ask the bank whether it offers one, how it authenticates the sender, and whether uploads need a second approver.
Can positive pay prevent all check fraud?
No. It stops checks that do not match the client's file, and with payee matching and image reading it can catch alterations to the number, amount, date or payee, but a stolen check deposited unaltered in an account opened in the payee's own name matches every field. That check is caught, if at all, at the bank of deposit.
Should a small business use positive pay?
If it mails checks to outside payees, it is worth pricing, because business checks are attractive to thieves: FinCEN's 2023 alert says business accounts are often well funded and a business may take longer to notice fraud. A business that writes very few checks may prefer reverse positive pay and review every item itself.
What should a bank ask before switching positive pay providers?
Whether the new provider can take the existing issue files and authorization lists without the clients changing anything, how history and evidence move across, and whether it can be shadowed on live items before any client sees it. The replay of a closed month answers most of the rest.