{
  "question": "How do I stop someone stealing, washing, altering or forging my small business's checks, whether it's an employee or a mail thief? What does Positive Pay actually check, and what else do I need?",
  "slug": "how-to-stop-check-tampering-with-positive-pay-at-a-small-business",
  "url": "https://www.rightshold.com/answers/how-to-stop-check-tampering-with-positive-pay-at-a-small-business",
  "short_answer": "Tell your bank in advance exactly which checks you wrote, and have it flag anything that doesn't match. With Positive Pay, you send the bank an issued-check file (account, check number, amount and issue date) whenever you write checks. The bank compares every check presented for payment with that file and shows you the ones that don't match, and you decide whether to pay or return each one before the bank's cutoff. Payee Positive Pay also compares the payee name, which matters because an altered or washed check often keeps its number and amount and gets a new payee. Checks are still the main target. In the AFP's 2026 Payments Fraud and Control Survey, 58% of organizations said checks were subject to fraud in 2025, more than any other payment method. The ACFE's Occupational Fraud 2026 report found employee check and payment tampering in 18% of cases at organizations with fewer than 100 employees, against 8% at larger ones, with a $114,000 median loss. Positive Pay has one big gap: it's only as honest as the file. An employee who writes themself a check and adds it to the issue file gets it paid. So the person who writes checks shouldn't build or upload the file or decide exceptions, the owner should approve each check run, and someone who doesn't write checks should review the statement and check images every month. Under UCC 4-406 you must examine statements promptly, and you lose any claim over an alteration or unauthorized signature you don't report within one year at most. Your account agreement may set a shorter deadline.",
  "checklist": [
    "Ask your bank whether it offers Positive Pay and Payee Positive Pay on your business account, what they cost, the daily cutoff for uploading the issue file, the deadline for deciding exceptions, and what happens if you miss it (does the item pay or return by default?).",
    "Upload the issued-check file every day you write checks, including manual and handwritten checks and voids. A check missing from the file shows up as an exception, and a voided check left in the file can still be paid.",
    "Choose Payee Positive Pay where it's offered, and keep each payee name in the file exactly as it's printed on the check. Some banks don't support payee matching on handwritten checks, so ask.",
    "Ask about ACH debit blocks or filters on the same account. Every check carries your routing and account number, which is all someone needs to try an ACH debit against you.",
    "Split the jobs: whoever prepares or signs checks doesn't build or upload the issue file and doesn't decide exceptions. In a small business, the owner approves each check run and decides exceptions.",
    "Lock up blank check stock, keep a log of check numbers used and voided, and look into any gap in the sequence. The ACFE's own example of the scheme is an employee stealing blank company checks.",
    "Hand outgoing checks over inside the post office rather than leaving them in a mailbox. The Postal Inspection Service advises not leaving letters in your mailbox for any length of time. Ask regular vendors to tell you if a payment doesn't arrive.",
    "Every month, have someone who doesn't write checks look through the statement and the cleared check images, checking the payee, amount, signature and endorsement. Report anything wrong to the bank in writing straight away.",
    "Pay regular vendors by ACH or card where you can. Fewer checks means less to steal. Report stolen mail to the Postal Inspection Service at 1-877-876-2455 or uspis.gov/report."
  ],
  "sections": [
    {
      "heading": "How check tampering happens",
      "points": [
        "Inside the business, the ACFE defines a check or payment tampering scheme as stealing an employer's funds by intercepting, forging or altering a check or electronic payment drawn on one of its bank accounts. Its examples: an employee steals blank company checks and makes them out to themself or an accomplice, or re-routes an outgoing electronic payment to a vendor into their own account. The fraud tree lists four kinds: forged maker, forged endorsement, altered payee and authorized maker (someone allowed to sign writes checks for their own benefit).",
        "In Occupational Fraud 2026, check and payment tampering made up 243 cases (10%), with a $114,000 median loss and a median duration of 13 months. At a median $8,800 a month, it ran up losses faster than any other asset misappropriation scheme in the report; only financial statement fraud and corruption were faster. It's much more common in small organizations: 18% of cases with fewer than 100 employees, against 8% at larger ones.",
        "Outside the business, the threat is mail theft. FinCEN's February 27, 2023 alert reported more than 680,000 check fraud suspicious activity reports filed in 2022, nearly double the more than 350,000 filed in 2021. It said thieves steal business checks from the mail because business accounts are often well funded and the victim may take longer to notice, and it described organized groups that include check washers and money mules."
      ]
    },
    {
      "heading": "What Positive Pay checks and what it misses",
      "points": [
        "U.S. Bank's description is typical. Each day you send a file listing each issued item, with the account number, check number and amount. The bank compares it with the checks presented for payment and reports the ones that don't match, so you can reject them. Payee Positive Pay adds payee information to the file, to catch fraudsters who alter payee names or put unauthorized payees on counterfeit checks. Banks also set deadlines: one bank's guide, for example, requires the issue file by 5:00 p.m. Pacific for next-day exception processing and exception decisions by 2:00 p.m. Pacific.",
        "Positive Pay compares what's presented with what you said you issued. It won't catch a check that's in the file because an insider put it there, which is the authorized-maker case. Matching the payee line also doesn't tell you who endorsed a genuine check, so a stolen check deposited by someone else can still match. And it doesn't cover ACH or wire payments sent from the account, which need their own controls.",
        "Exceptions only help if someone decides them in time. Find out your bank's default for undecided exceptions, and make sure the person deciding them isn't the person who wrote the checks."
      ]
    },
    {
      "heading": "Your deadline to report an altered check",
      "points": [
        "Under UCC 4-406, when the bank sends or makes available a statement, you must examine it with reasonable promptness and promptly tell the bank about any payment that wasn't authorized because a check was altered or a signature wasn't yours. If you don't, you can be barred from claiming against the bank. That includes later checks altered by the same person and paid after you've had a reasonable period, up to 30 days, to examine the statement and notify the bank.",
        "Whether or not either side was careful, a customer who doesn't discover and report an unauthorized signature or alteration within one year after the statement or items were made available loses that claim against the bank. States adopt the UCC with their own changes, and your account agreement may shorten these periods, so read it and review statements every month."
      ]
    },
    {
      "heading": "Keeping the issue file honest",
      "points": [
        "The issue file usually comes from the check register in your accounting software. If the person who writes checks can also edit that register, they can add a check to the file or delete one afterwards, and Positive Pay will match whatever the file says.",
        "So approve the check run before the file goes to the bank: the number of checks, the check-number range, the total and a hash of the file itself. Just before uploading, hash the file again and compare it with what you approved. A file with an extra or changed check gives a different hash. Then keep each issued check in a record the bookkeeper can't edit, so you can compare it with the statement and the cleared images at month-end."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "Before I upload today's Positive Pay issue file, check it against the check run I approved this morning: the same file hash, number of checks, total and check-number range.",
    "mcp_call": {
      "tool": "verify_human_approval",
      "arguments": {
        "receipt": "<decision receipt exactly as returned by decide_human_approval>",
        "signature": "<its signature>",
        "action": {
          "type": "check_run",
          "account_ref": "OPERATING-1",
          "issue_file_sha256": "<sha256 of the issue file you're about to upload>",
          "check_count": 14,
          "total_cents": 2318450,
          "first_check_number": 10431,
          "last_check_number": 10444
        }
      }
    },
    "also": [
      "Free, no key. Send the decision receipt and signature, plus the check run as it stands in the file you're about to upload. If the file hash, count, total or number range differs from what was approved, the action doesn't match and the result isn't valid. Sending only an approval id returns its status, without comparing the action.",
      "Create the approval first with request_human_approval (API key), using the same action object and a summary without personal data. Only the owner's account key can decide it (decide_human_approval); delegated agent keys are refused.",
      "To keep the issued-check register out of the bookkeeper's reach, seal each check as a mirror-ledger payment entry (REST with your API key: POST /v1/mirror-ledgers/{id}/entries with type payment, invoice_ref for the bill it pays and amount_cents, plus your own fields such as check_number and payee_ref). Entries can't be edited or deleted, and anyone can check one free at GET /v1/mirror-entries/{id}.",
      "Don't send payee names, account numbers or addresses. Use your own references, and hash anything sensitive."
    ],
    "scope": "Rightshold doesn't connect to your bank or accounting software, doesn't run Positive Pay, doesn't see checks or check images, and can't stop or return a payment. It records the approvals and entries you send and lets anyone check them later, and it only protects you if your process refuses to upload a file that doesn't match an approved check run. Positive Pay features, fees and deadlines vary by bank. Not legal, banking or accounting advice."
  },
  "sources": [
    {
      "title": "ACFE: Occupational Fraud 2026: A Report to the Nations (check and payment tampering 243 cases, 10%, $114,000 median, 13 months, $8,800 per month; 18% vs 8% by organization size; scheme definition)",
      "url": "https://www.acfe.com/en-us/-/media/files/acfe/pdfs/rttn/2026/2026-report-to-the-nations.pdf"
    },
    {
      "title": "ACFE: The Fraud Tree 2026 (forged maker, forged endorsement, altered payee, authorized maker)",
      "url": "https://cms.acfe.com/-/media/files/acfe/pdfs/rttn/2026/infographics/the-fraud-tree-2026-fem.pdf"
    },
    {
      "title": "AFP: 2026 Payments Fraud and Control Survey press release (checks 58%, April 14, 2026)",
      "url": "https://www.financialprofessionals.org/about/learn-more/press-releases/Details/over-75-percent-of-us-firms-experienced-payments-fraud-in-2025-while-ai-adoption-for-fraud-mitigation-lags"
    },
    {
      "title": "FinCEN: Alert on nationwide surge in mail theft-related check fraud schemes (FIN-2023-Alert003, February 27, 2023)",
      "url": "https://www.fincen.gov/news/news-releases/fincen-alert-nationwide-surge-mail-theft-related-check-fraud-schemes-targeting"
    },
    {
      "title": "U.S. Bank: A guide to payments fraud solutions (Positive Pay and Payee Positive Pay)",
      "url": "https://www.usbank.com/dam/documents/pdf/corporate-and-commercial-banking/payment-fraud-solutions-guide-FINAL.pdf"
    },
    {
      "title": "F&M Bank: Positive Pay client user guide (upload and exception deadlines, handwritten items and payee match)",
      "url": "https://www.fmb.com/-/media/user-guides/fmb-userguides-2024-positivepay-payeewithmatch.pdf"
    },
    {
      "title": "Cornell LII: UCC § 4-406, Customer's duty to discover and report unauthorized signature or alteration",
      "url": "https://www.law.cornell.edu/ucc/4/4-406"
    },
    {
      "title": "U.S. Postal Inspection Service: Mail and package theft",
      "url": "https://www.uspis.gov/tips-prevention/mail-theft"
    }
  ],
  "related": [
    {
      "title": "How to spot signs someone is hiding theft in your bank reconciliation",
      "url": "https://www.rightshold.com/answers/how-to-spot-signs-someone-is-hiding-theft-in-your-bank-reconciliation"
    },
    {
      "title": "How to verify a vendor's bank account change request before you pay",
      "url": "https://www.rightshold.com/answers/how-to-verify-a-vendors-bank-account-change-request-before-you-pay"
    },
    {
      "title": "How to keep a copy of your business books that your bookkeeper can't edit",
      "url": "https://www.rightshold.com/answers/how-to-keep-a-copy-of-your-business-books-that-your-bookkeeper-cant-edit"
    },
    {
      "title": "How to spot a fake vendor in your accounts payable",
      "url": "https://www.rightshold.com/answers/how-to-spot-a-fake-vendor-in-your-accounts-payable"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-11-10"
}