Positive pay, explained for busy controllers

PaymentsNow Team · June 10, 2026 · ← All articles

Positive pay is the single most effective control against cheque fraud — and the one most often switched on, half-configured, and quietly neglected until the day it matters. This explainer covers what positive pay is, how the issue file actually moves, where reverse positive pay fits, and the small daily habits that decide whether it protects you or merely exists.

The problem positive pay solves

When a cheque arrives at your bank for payment, the bank’s default posture is to pay it. Clearing systems verify that the account exists and the funds are there — not that you actually wrote the cheque for that amount to that payee. A washed cheque with an altered amount, or a counterfeit printed on commodity stock with your account number, sails through default clearing. Positive pay replaces “pay unless told otherwise” with “pay only what the issuer has confirmed.”

How positive pay works, step by step

1. You issue cheques and generate an issue file — cheque number, date, amount, and (ideally) payee name for every item.
2. The file goes to your bank the same day, usually by upload or SFTP.
3. Presented cheques are matched against the file as they clear. Number, amount, and payee must agree.
4. Mismatches become exceptions and land in your queue instead of being paid.
5. You decide — pay or return — before the daily cutoff. Miss the window and the bank applies your default disposition.

Payee positive pay: insist on it

Basic positive pay matches cheque number and amount only. Payee positive pay also matches the payee name — which is exactly what cheque washing attacks alter. Fraudsters have adapted to basic positive pay; a washed cheque often keeps the original number and amount and changes only the name. If your bank offers payee matching, the incremental cost is small and the protection gap it closes is the one being actively exploited.

Reverse positive pay: the budget variant

With reverse positive pay the bank sends you the list of presented cheques each morning and you confirm or return them. It is cheaper and needs no issue file — but it inverts the default: if you do nothing, items pay. It suits low cheque volumes with a disciplined daily reviewer. The moment volume grows or the reviewer takes a vacation, the control dissolves. Treat it as a stepping stone, not a destination.

The daily habits that make it real

• Send the issue file the day you print — a cheque that clears before its file arrives becomes a needless exception, and a batch of them trains staff to rubber-stamp the queue.
• Work exceptions before the cutoff, every banking day — assign a primary and a backup owner; the cutoff does not care about vacations.
• Set the default disposition to return — if nobody reviews an exception, the safe failure mode is non-payment, not payment.
• Include voids and stops in the file — a voided cheque that is still “open” at the bank is a free shot for whoever finds it.
• Audit the match quarterly — issue a deliberately mismatched test item and confirm it is caught and routed correctly.

Common failure modes

Where this fits in an outsourced workflow

The hardest part of positive pay is not the concept — it is producing an accurate issue file every single day. When cheque printing and mailing run through PaymentsNow, the issue data already exists in the live cheque register the moment a run is approved, and custom positive pay support is built into our Premium plans. Voids, stops, and reissues flow into the same record automatically — the homework does itself. Combined with controlled cheque stock and approval rules, you get layered protection instead of a single tripwire.

Frequently asked questions

Does positive pay cost much?

Canadian banks typically price it as a monthly fee plus cents per item — almost always less than one prevented fraud incident per decade. Payee matching costs slightly more than number-and-amount matching and is worth the difference.

We only write a handful of cheques. Do we still need it?

Low-volume accounts are attractive targets precisely because nobody is watching daily. Reverse positive pay or a block on all cheque activity (for accounts that should never write cheques) are the right-sized tools.

What happens to legitimate cheques that trigger exceptions?

You approve them before the cutoff and they pay normally. With clean, automated issue files, legitimate exceptions become rare enough that each one gets genuine attention.