Positive Pay for Small Business: Cutoffs, Fees and Liability

Positive pay for small business accounts is sold as a fraud filter, yet the agreements behind it read like a calendar of deadlines. Miss one, and a forged check can become the company's loss.

The pressure on banks and their business customers comes from paper checks. FinCEN, the Treasury bureau that collects suspicious activity reports, said in its mail theft alert that in 2022 “the number of SARs related to check fraud reached over 680,000, nearly double the previous year’s amount of filings”.

Small firms sit near the center of that surge. The same alert says thieves take every type of check from the mail, but “business checks may be more valuable because business accounts are often well-funded and it may take longer for the victim to notice the fraud”.

That delay is the point where positive pay and the law meet. We read the FinCEN alert, the agency's later trend analysis, service terms, guides and fee pages from eight banks, and the Uniform Commercial Code sections that decide who carries a forged check.

What does positive pay for small business actually stop?

It stops checks that do not match a list of issued checks the company sends its bank in advance. City National Bank says the comparison runs daily.

The basic tier reads fewer fields than that list can hold.

City National names four details a company may send, namely the check number, the issue date, the payee and the amount, and Capital One's standard service compares only two of them.

Capital One's commercial terms say the bank “may pay and charge to the Account(s) each presented Check that matches both the Check serial number and dollar amount” in the file. Payee positive pay adds the payee name to that test.

That gap matters because of how stolen checks get altered. FinCEN's trend analysis of reports filed after the alert found that “the payee line was the most frequently altered section, followed by the amount”.

By Capital One's own definition, a washed check that keeps its original number and amount but carries a new payee name matches on both fields the standard service reads, and it can clear.

Standard matching does catch counterfeit serial numbers and inflated amounts. Payee matching reads the line that washers favor.

Why do check washing rings go after business accounts?

Rings go after business checks because the accounts behind them hold more money and losses surface later, FinCEN says.

Washing itself is crude: chemicals lift the ink, and a new payee and often a larger amount go on the clean paper, according to the Postal Inspection Service.

The scale is measurable for one six-month window. In the half year after the alert, FinCEN received more than fifteen thousand reports tied to mail theft check fraud, covering about $688 million in transactions.

The typical report was far smaller than the average. FinCEN put the median at $14,215 and the mean at $44,774.

Washing is only one of several routes to the money. Altered checks made up about 44 percent of the reports FinCEN reviewed by hand, counterfeits built from stolen checks about a quarter, and checks with forged signatures about a fifth.

Speed is the other half of the scheme. FinCEN's alert describes thieves pulling the money out through ATMs or wiring it onward soon after a washed check is deposited, often through accounts opened for the purpose.

Corporate treasurers describe the same pressure in survey data.

Survey work from 2025 by the Association for Financial Professionals, cited by City National, found that checks remained the payment method most exposed to fraud, with 58 percent of organizations reporting check fraud activity.

The Postal Inspection Service's advice starts before the check leaves the office. It tells mailers to drop outgoing mail in blue collection boxes before the last pickup or at a post office, and never to leave mail in a mailbox overnight.

How much does positive pay cost a small business?

The price runs from zero to more than six hundred dollars a year for a single account, depending on the bank and the tier.

BancFirst's published schedule is the only list we found that prices each part of the service. It charges eighty dollars to set up the service, fifty dollars a month per account for check positive pay and thirty-five dollars a month for the version that screens only ACH debits.

Per-item charges sit on top of the monthly fee. The same schedule lists three cents per item, fifty cents for each exception and $25 for manual exception processing by the bank.

Put a firm that writes two hundred checks a month through that schedule, and the base bill lands near $56 a month before a single exception is priced. Ten exceptions would add five dollars more.

Other banks fold the service into the account at no charge. Primis Bank tells business customers that it offers check and ACH positive pay at no cost and urges them not to opt out.

Large banks can price it the same way. Chase's business fee schedule, effective June 2026, lists its positive pay and reverse positive pay services with no monthly fee and no charge per exception or return, and its ACH debit block at no cost.

Set-up also takes longer than a signature on a form.

At Capital One, set-up requires test files and voided sample checks from each account at least two weeks before launch, so a firm signing up after a fraud scare waits that long for the filter.

Free or not, the service comes with a daily duty attached. The bank posts a list of exceptions each business morning, and the company must decide on every item before a cutoff that some banks set within hours.

What happens if nobody decides an exception by the cutoff?

The bank applies a default decision, and the company lives with the result.

Customers usually face a daily deadline, City National notes: “If the customer does not respond by the deadline, then the default decision (pay or return) will be applied”.

Needham Bank's business guide shows how tight the window gets. Exceptions arrive by eight in the morning Eastern time, and the guide states that “Any items not decided by 11:00 AM EST will be automatically returned”. That leaves three hours on a normal day.

A return default protects the account at the expense of the payee. Needham sends undecided checks back marked “Refer to Maker,” so a genuine supplier or payroll check missing from the issue file bounces back to whoever deposited it.

Capital One lets a company pick a “Return Default” or a “Pay Default” for all of its enrolled accounts. Its terms then put the timing risk squarely on the customer: “Customer shall be solely liable for all Losses relating to any untimely or inaccurate Pay Requests or Return Requests”.

Reverse positive pay flips the default the other way. Under the same terms the bank sends a report of paid checks, and anything the customer fails to reject before the cutoff is paid automatically, even an item the company never wrote.

The issue file carries its own deadline and liability.

Each check must be in the file before it enters circulation under Capital One's terms, and the customer alone is liable for losses from late or wrong file data.

Teller windows are a weak spot in the same terms. A check presented over the counter before the file is processed may be refused, and one voided too late may look like a match and get paid.

Handwritten checks are a trap of their own. Capital One flags them as exceptions even when they match the file, and it asks customers not to write them on enrolled accounts at all.

Upgrading to payee matching later also leaves a gap. Checks already listed before the switch “will be processed without payee verification, even if they are presented for payment after Payee Positive Pay has been activated”.

How does ACH positive pay differ from check positive pay?

ACH positive pay screens electronic debits instead of paper checks.

Primis describes a service that compares each incoming debit with payments the customer has already authorized, suspends anything unmatched and sends an alert so the owner can approve or reject it from a dashboard.

The deadline for electronic debits is shorter than any statement cycle. East West Bank's ACH guide summarizes the Nacha rule: “a recipient has two business days from the settlement date to return a corporate ACH transaction,” against 60 days for an unauthorized consumer debit.

The bank's own internal cutoff comes earlier still. East West asks business clients to flag an unauthorized debit by three in the afternoon Pacific time on the business day after the bank posts it. That is roughly one working day.

A filter turns that race into a morning review queue. Needham returns undecided ACH exceptions automatically under code R29, the return reason for a corporate customer that says it did not authorize a debit.

Consumer protections for electronic transfers do not fill the gap.

The business agreement at Happen Bank carves out only consumer transfers covered by Regulation E from its fraud-service clause, so a company's own ACH debits fall under the bank's rules for rejected services.

Check fraud, business account losses: who pays without positive pay?

Often the company pays, if the bank offered positive pay and the owner turned it down.

Happen Bank's business deposit agreement says that a customer who rejects the fraud services it offers “will be responsible for any fraudulent or unauthorized transactions which could have been prevented by the services we offered”.

Primis puts the same point more bluntly on its opt-out page: “when you decline coverage you become liable for fraudulent transactions”.

The default law is gentler, but its deadlines are still strict. Under Article 4 of the Uniform Commercial Code, a customer must review statements with reasonable promptness and report any forged signature or alteration the statement should have revealed.

Two separate clocks run inside that statement rule. A customer who lets the review period lapse, capped at 30 days, loses claims on later checks forged by the same wrongdoer, and a report filed after one year is barred outright, regardless of how careful the bank was.

Bank agreements for business accounts can shorten both clocks. Happen Bank's agreement says the review period “will not, in any circumstance, exceed a total of 30 days from when the statement is first sent or made available to you”. It also bars any claim on a statement reported after 60 days.

Sixty days replaces the model code's full year.

Fault can still be shared between the bank and the customer. The code splits a loss when the bank failed to use ordinary care, and Happen's positive pay clause spares the customer where the bank acted in bad faith or its own negligence contributed.

Stop-payment orders run on a separate timetable of their own. A written order lasts six months under the code, but it “lapses after 14 calendar days if the original order was oral and was not confirmed in a record within that period”.

What do the published numbers leave out?

They leave out the figure owners want most: how much positive pay saves a firm of ten or forty people. No document we read measures losses prevented by the service at small companies.

FinCEN's counts measure reports filed, not money lost. Its trend analysis notes that the dollar amounts may include attempted and unpaid transactions, and the alert's headline count covers all check fraud, not only cases tied to mail theft.

Prices for the service are thin on the public record. We found one schedule that prices each part of the service and two banks offering it free, and Capital One's long service terms describe the product without a price.

Regulators see the problem growing even as check use fades.

The June 2025 request for information from the Federal Reserve, the FDIC and the OCC states that “Numerous sources report increasing levels of check fraud in recent years, despite overall decreases in check usage”.

Every treasury agreement sets its own cutoff, default and review window. The bank's account officer can confirm which ones apply to a given account, an accountant can price the exposure, and a lawyer is the right call once a forged check has cleared.

Is positive pay worth the daily deadline?

Our view at the desk is yes: positive pay for small business is worth it for any firm that still mails checks, on one condition. Someone must own the exception queue every morning. The default decision runs at the cutoff whether anyone has looked or not, so a named backup matters as much as the service.

The arithmetic of the published prices favors the filter. A full year of BancFirst's base check service on one account costs about $600, a small slice of the $14,215 median FinCEN recorded per mail theft report.

The cheaper tier carries a hidden cost for check writers. Standard matching on number and amount leaves the payee line unread, and FinCEN's data marks that line as the one washers change most.

Owners setting up the service can ask the bank to put in writing the cutoff hour, the default decision, whether payee matching is on, the ACH return deadline and the statement review window.

Regulators took a small step in September 2026. The banking agencies and FinCEN issued a joint statement on what banks may tell customers about suspected fraud without revealing a suspicious activity report, a step the Federal Reserve tied to comments on the 2025 payments fraud inquiry.

Until the rules on checks themselves change, the protection a small business gets is the one it signs up for and reviews every morning before the cutoff.