Positive Pay vs ACH Debit Blocks for Small Businesses

See what positive pay actually checks

Under a typical check positive-pay program, a business sends its bank a file of authorized check numbers, amounts and sometimes payee information. When an item is presented, the bank compares the item with the submitted records and may flag exceptions for the business to review. Some offerings include payee positive pay or separate services for ACH, while others cover only check amount and number. Ask specifically what fields are validated and how mismatched items are handled when the company misses a decision deadline.

Imagine a contractor issues check 418 for $920 to a supplier. A fraudster alters the payee and presents a $9,200 item with the same check number. A positive-pay system that compares amounts could flag the difference, while payee-matching controls may offer another layer for altered beneficiary information. Neither guarantees that every counterfeit or unauthorized item will be stopped. The business must upload accurate issue files and examine exception notices promptly; unreviewed exceptions can be paid or returned according to the service contract.

Understand ACH debit blocks and approved-originator filters

An ACH debit block can instruct the bank not to honor incoming ACH debits against a business account, subject to its contractual terms. An ACH filter may instead allow approved originator identifiers or transaction parameters while flagging other entries. These services can be valuable where the company receives customer deposits but does not want outsiders freely collecting electronic debits. Blocking all debits indiscriminately, however, can also disrupt tax payments, payroll service fees and important suppliers.

A business with an approved payroll vendor may need to authorize that vendor's specific ACH company identifiers rather than only its public brand name. If the vendor changes processing banks or originator data, legitimate debits could start failing. Maintain a tested list of approved parties, review changes securely and restrict who can edit the rules. A debit filter is not a replacement for evaluating invoices and vendor legitimacy; it is a bank-level payment restriction that must be coordinated with real business operations.

Compare which fraud scenario each control prevents

Check positive pay is most relevant to presented paper checks and certain check fraud patterns. ACH debit controls apply to attempts to pull money electronically through the ACH network. A company that never writes checks might gain little from a check-focused service, while a firm paying dozens of suppliers by printed check may need it even if ACH debit volume is small. Create a payment-method map before purchasing services; buying a full treasury package without mapping exposures can waste money and leave gaps.

For example, a small property manager writes 35 checks monthly and permits only two recurring ACH debits. A combined program could include check issue-file matching plus an ACH allowlist for the two approved originators. A digital-only agency using ACH credits to pay contractors may instead focus on access approvals and controls for outgoing files. Internal fraud remains a concern even if inbound debit filtering is excellent. Dual approval for initiating large payments and carefully limited user permissions address a different point in the risk chain.

Measure the total cost and operational workload

Banks may charge a monthly service fee, per-item transaction cost, setup fee or exception-management charge for treasury fraud controls. A hypothetical $35 monthly positive-pay fee amounts to $420 yearly before item charges; whether that is worthwhile depends on check volume, exposure and labor required to manage exceptions. A service is less valuable if the business rarely reviews alerts or if legitimate payments are routinely delayed. Ask for a demonstration of its exception dashboard and cutoff times before committing.

Someone must be responsible for daily decisions when payment items are presented. Set substitute approval arrangements for vacations and emergencies, and document escalation steps for unfamiliar items. Misclassification carries two risks: allowing fraudulent payments and rejecting valid vendor payments that then incur contractual penalties. Record the bank's default handling when a deadline passes. A control that silently pays unreviewed exceptions may require a different internal workflow than one that defaults to return.

Combine bank controls with basic vendor and account security

A legitimate bank control cannot protect a company that knowingly sends money to an impostor after accepting altered bank instructions by email. Verify changes to supplier payment details through a previously established telephone number or secure contact route. Restrict check stock, reconcile statements promptly and separate payment setup from final authorization where staffing permits. Use strong multifactor authentication for treasury access and remove former employees' permissions immediately. Fraud prevention works best as multiple independent checks rather than one subscription.

If an unauthorized debit or altered check appears, contact the bank promptly with the transaction information and review the commercial account agreement. Business payment rights and deadlines can differ from consumer Regulation E protections. Preserve authorization records and any approved-originator list changes to help determine whether the event was fraud, a system configuration error or a valid payment rejected inappropriately. A well-configured positive-pay or ACH-filter service should leave an auditable trail of who approved or declined each exception.

MyBankAnswers Editorial Verdict

We recommend matching treasury controls to the payment rail that creates your real exposure. Positive pay is valuable for businesses that issue checks and can reliably review exceptions; ACH debit blocks and filters are better suited to restricting incoming electronic withdrawals. Many firms need both, but only after documenting approved vendors, workflows, cutoffs and costs. Neither tool eliminates phishing, internal misuse or the risk of intentionally paying a fake invoice. Start with a payment-method inventory, calculate the monthly service burden and establish backup exception reviewers. The strongest fraud protection is a control that staff understand and actually operate, not an expensive feature enabled on paper and ignored in daily banking.

Official sources and research notes

1. Chase for Business: Check Protection and ACH Debit Block
2. Nacha: ACH risk and return-code controls
3. FTC: Cybersecurity for small businesses

Editorial note (reviewed October 10, 2026): Important federal rules and topic-specific source material were checked during a targeted editorial audit. Hypothetical amounts are illustrative; confirm product terms and deadlines with the provider. This manuscript has not been deployed or tested on the live website.