How do I stop someone stealing, washing, altering or forging my small business's checks, whether it's an employee or a mail thief? What does Positive Pay actually check, and what else do I need?

What should I check, step by step?

1. Ask your bank whether it offers Positive Pay and Payee Positive Pay on your business account, what they cost, the daily cutoff for uploading the issue file, the deadline for deciding exceptions, and what happens if you miss it (does the item pay or return by default?).

2. Upload the issued-check file every day you write checks, including manual and handwritten checks and voids. A check missing from the file shows up as an exception, and a voided check left in the file can still be paid.
3. Choose Payee Positive Pay where it's offered, and keep each payee name in the file exactly as it's printed on the check. Some banks don't support payee matching on handwritten checks, so ask.
4. Ask about ACH debit blocks or filters on the same account. Every check carries your routing and account number, which is all someone needs to try an ACH debit against you.
5. Split the jobs: whoever prepares or signs checks doesn't build or upload the issue file and doesn't decide exceptions. In a small business, the owner approves each check run and decides exceptions.
6. Lock up blank check stock, keep a log of check numbers used and voided, and look into any gap in the sequence. The ACFE's own example of the scheme is an employee stealing blank company checks.
7. Hand outgoing checks over inside the post office rather than leaving them in a mailbox. The Postal Inspection Service advises not leaving letters in your mailbox for any length of time. Ask regular vendors to tell you if a payment doesn't arrive.
8. Every month, have someone who doesn't write checks look through the statement and the cleared check images, checking the payee, amount, signature and endorsement. Report anything wrong to the bank in writing straight away.
9. Pay regular vendors by ACH or card where you can. Fewer checks means less to steal. Report stolen mail to the Postal Inspection Service at 1-877-876-2455 or uspis.gov/report.

How do employees and mail thieves tamper with business checks?

Inside the business, the ACFE defines a check or payment tampering scheme as stealing an employer's funds by intercepting, forging or altering a check or electronic payment drawn on one of its bank accounts. Its examples: an employee steals blank company checks and makes them out to themself or an accomplice, or re-routes an outgoing electronic payment to a vendor into their own account. The fraud tree lists four kinds: forged maker, forged endorsement, altered payee and authorized maker (someone allowed to sign writes checks for their own benefit).

• In Occupational Fraud 2026, check and payment tampering made up 243 cases (10%), with a $114,000 median loss and a median duration of 13 months. At a median $8,800 a month, it ran up losses faster than any other asset misappropriation scheme in the report; only financial statement fraud and corruption were faster. It's much more common in small organizations: 18% of cases with fewer than 100 employees, against 8% at larger ones.
• Outside the business, the threat is mail theft. FinCEN's February 27, 2023 alert reported more than 680,000 check fraud suspicious activity reports filed in 2022, nearly double the more than 350,000 filed in 2021. It said thieves steal business checks from the mail because business accounts are often well funded and the victim may take longer to notice, and it described organized groups that include check washers and money mules.

What does Positive Pay check, and what fraud does it miss?

U.S. Bank's description is typical. Each day you send a file listing each issued item, with the account number, check number and amount. The bank compares it with the checks presented for payment and reports the ones that don't match, so you can reject them. Payee Positive Pay adds payee information to the file, to catch fraudsters who alter payee names or put unauthorized payees on counterfeit checks. Banks also set deadlines: one bank's guide, for example, requires the issue file by 5:00 p.m. Pacific for next-day exception processing and exception decisions by 2:00 p.m. Pacific.

• Positive Pay compares what's presented with what you said you issued. It won't catch a check that's in the file because an insider put it there, which is the authorized-maker case. Matching the payee line also doesn't tell you who endorsed a genuine check, so a stolen check deposited by someone else can still match. And it doesn't cover ACH or wire payments sent from the account, which need their own controls.
• Exceptions only help if someone decides them in time. Find out your bank's default for undecided exceptions, and make sure the person deciding them isn't the person who wrote the checks.

How long does a business have to report an altered or forged check to its bank?

Under UCC 4-406, when the bank sends or makes available a statement, you must examine it with reasonable promptness and promptly tell the bank about any payment that wasn't authorized because a check was altered or a signature wasn't yours. If you don't, you can be barred from claiming against the bank. That includes later checks altered by the same person and paid after you've had a reasonable period, up to 30 days, to examine the statement and notify the bank.

• Whether or not either side was careful, a customer who doesn't discover and report an unauthorized signature or alteration within one year after the statement or items were made available loses that claim against the bank. States adopt the UCC with their own changes, and your account agreement may shorten these periods, so read it and review statements every month.

How do you stop an employee adding a check to the Positive Pay issue file?

The issue file usually comes from the check register in your accounting software. If the person who writes checks can also edit that register, they can add a check to the file or delete one afterwards, and Positive Pay will match whatever the file says.

• So approve the check run before the file goes to the bank: the number of checks, the check-number range, the total and a hash of the file itself. Just before uploading, hash the file again and compare it with what you approved. A file with an extra or changed check gives a different hash. Then keep each issued check in a record the bookkeeper can't edit, so you can compare it with the statement and the cleared images at month-end.