The Bank Service That Stops Check Fraud Has a Setting Most Owners Never Check

Positive pay is the standard defense. It also, in its basic form, ignores the one line on the check that thieves change most.

A thief pulls an envelope out of a blue collection box on a Tuesday night. Inside is a check your company wrote to a supplier for $3,400. By Friday it has been soaked in solvent, the payee's name lifted off the paper, a new name written in, and deposited through a phone at a bank neither you nor your supplier has ever used.

Your bank has a product designed to stop exactly this. It is called positive pay, and depending on which version you bought, it may have waved that check straight through.

Why they still want the paper

Checks are not a nostalgic sideshow in fraud. They are the main event.

The Association for Financial Professionals surveys finance departments every year about who tried to steal from them. In the latest round, 58% of the 465 organizations that responded had faced attempted or actual check fraud during 2025. Checks came in ahead of ACH debits, ahead of wire transfers, ahead of corporate cards. Again.

A word about that number, because you'll see a bigger one quoted everywhere: 63%. That figure is real, but it's a year older, and it describes 2024. Check fraud has hovered in a tight band for half a decade. It has not gone away and it has not exploded. It has simply stayed.

And be careful with the label. AFP surveys corporate treasury departments; its smallest bracket is companies under $1 billion in revenue, where the figure was 55%. Nobody has measured the corner hardware store this way. When you see a headline saying most small businesses get hit by check fraud, someone has stretched a statistic past where it was ever meant to go.

What we do know about small businesses comes from the Treasury's financial-crimes unit, FinCEN, and it is not comforting. In its alert on mail-theft check fraud, FinCEN wrote that "business checks may be more valuable because business accounts are often well-funded and it may take longer for the victim to notice the fraud."

Then it counted. Over six months in 2023, banks filed 15,417 reports tied to mail-theft check fraud, covering more than $688 million in transactions. The average report was $44,774. Roughly 44% of the checks had been altered, 26% were counterfeits, 20% were forged signatures. And when criminals opened fake bank accounts to cash their haul, they did it most often with checks that were made out to businesses.

The thefts themselves are crude. Mailboxes, apartment cluster boxes, blue collection boxes, and in some cases the letter carriers themselves, robbed for the master keys that open every box on a route. From there it's either washing, where chemicals lift the ink, or what the FBI calls cooking, where a stolen check is scanned and doctored on a computer so counterfeits can be run off a printer by the dozen.

How positive pay is supposed to work

The idea is simple enough. Every time you print checks, you send your bank a file listing them: number, amount, date, account. When a check shows up at the bank, it gets matched against your list. Anything that doesn't match becomes an exception, and the bank shows you an image and asks a single question. Pay it, or return it?

You get a few hours to answer. At one large bank, the exceptions post at 10 in the morning and the window slams shut at 4 p.m. After that, the decision can't be entered and it can't be reversed.

Two things the brochure won't tell you

The first is the one that should make you pick up the phone.

Basic positive pay does not look at the payee name. It matches the check number and the dollar amount. That's it. So a washed check that keeps your check number and your amount, but now says a stranger's name where your supplier's used to be, matches perfectly. It clears.

Recall which line FinCEN found thieves alter most often. It's that one.

Checking the name requires a separate, more expensive service, usually sold as payee positive pay. One company described to AFP's researchers precisely how it learned the difference: someone took its real check data, printed a counterfeit with a different payee, and got paid. The company is upgrading now.

The second gap is quieter. When you set up positive pay, you pick a default — what the bank does if nobody answers by the cutoff. Pay, or return. If your default is set to pay, and it was a busy Thursday and nobody logged in, the forged check goes through on its own. The bank's own instructions say to review the items rather than lean on the default, which is easy advice for a company with a treasury department and a hard one for a contractor who is also the bookkeeper and was on a roof all afternoon.

Two numbers we went looking for and could not find: how many businesses actually use positive pay, and how well it works when they do. Neither appears to be published anywhere. We're not going to estimate them for you.

What the people who chase these cases tell you to do

The Federal Reserve, the FBI and the Postal Inspection Service have all published guidance, and it converges on the same short list. Buy check stock with security features built in — microprinting, watermarks, paper that reacts to solvent. Write with gel ink, which is far harder to wash off than a ballpoint. Leave no blank space on the line. Use an envelope you cannot read a check through.

Then the habits, which cost nothing. Don't leave outgoing checks in your own mailbox with the flag up; that flag is a signal to more people than the mail carrier. Don't drop a check in a blue box after the last pickup, because it will sit there all night, and that is exactly the window thieves work. Hand it to a clerk at the counter if you can.

For a business, the Fed adds two more that owners skip constantly: separate the person who signs checks from the person who reconciles the account, and reconcile daily instead of monthly. A washed check found in three days is a phone call. Found in five weeks, it's an argument with your bank.

The Postal Inspection Service says its inspectors pull more than $1 billion in counterfeit checks and money orders out of circulation every year. Nobody is arguing about the size of this.

Sources

• 2026 AFP Payments Fraud and Control Survey — 58% check fraud in 2025, n=465 (Association for Financial Professionals)
• 2025 AFP Payments Fraud and Control Survey, Key Highlights — 63% in 2024, n=521
• FinCEN Alert FIN-2023-Alert003, "Mail Theft-Related Check Fraud," Feb. 27, 2023
• FinCEN Financial Trend Analysis, "Mail Theft-Related Check Fraud," Sept. 2024 (Feb–Aug 2023 data)
• FBI/IC3 Public Service Announcement I-012725-PSA, Jan. 27, 2025
• U.S. Postal Inspection Service, "Check Washing," updated July 29, 2025
• Federal Reserve, "Preventing Check Fraud: A Resource for Businesses," 2025 Check Fraud Mitigation Toolkit; FedPayments Improvement, "Check Fraud Explained" (385% Treasury figure)
• Truist, "Positive Pay / Payee Positive Pay: Daily Responsibilities and Critical Deadlines"

Disclaimer: This article is news and general information only. It is not financial, legal, or tax advice, and it is not a recommendation to buy any product or service. Fraud-prevention tools reduce risk; none eliminate it. Talk to your bank about which controls fit your accounts.

Found an error? Tell us — we correct in public.