Payment Fraud Controls: Positive Pay and Debit Blocks

1. Why This Topic Matters

Payment fraud is one of the most persistent operational risks a treasury professional manages. The AFP Payments Fraud and Control Survey consistently shows that the large majority of organizations are targeted by attempted or actual payment fraud every year, and that checks remain the payment type most exposed to fraud, followed by ACH debits and wires. Because treasury owns the bank accounts, the bank relationships and the disbursement process, treasury is expected to design and operate the controls that stop fraudulent items from clearing.

The topic is also important because of legal liability. Under the Uniform Commercial Code (UCC) Articles 3 and 4, a bank may only charge a customer's account for items that are properly payable. However, UCC 3-406 (comparative negligence) and UCC 4-406 (the customer's duty to examine statements and report unauthorized items promptly) allow a bank to shift all or part of the loss to the company if the company failed to exercise ordinary care. Many bank deposit agreements now state explicitly that a customer who declines fraud-prevention services such as positive pay has failed to exercise ordinary care and will bear the loss. Knowing how positive pay and debit blocks work is therefore both a control question and a liability question on the CTP exam.

2. What Positive Pay and Debit Blocks Are

Both are bank-provided detective and preventive controls that compare items presented against a company's account with information the company has authorized in advance. Anything that does not match is treated as an exception that the company must decide to pay or return before a bank deadline.

Check-side controls
• Positive Pay – The company transmits an issue file (check number, amount, issue date, and often payee) to the bank each time checks are released. When checks are presented for payment, the bank matches them to the issue file. Non-matching items (wrong amount, unknown check number, duplicate, stale-dated) are reported as exceptions for a pay/return decision.
• Payee Positive Pay (Payee Name Verification) – Adds the payee name to the match. This is the only version that catches an altered payee, one of the most common check-fraud schemes.
• Teller Positive Pay – Extends the match to checks presented over the counter at a branch, so a counterfeit or altered check cannot be cashed before it ever reaches clearing.
• Reverse Positive Pay – The bank sends the company a file of items it has paid or is about to pay; the company performs the matching and must notify the bank of items to return. The default is pay. It is cheaper and useful for companies that cannot produce timely issue files, but it is weaker because the burden and the deadline fall on the company.
• Post No Checks / Check Block – For accounts that should never have checks drawn on them (e.g., ACH-only receivables accounts, concentration accounts), the bank returns every check presented.
• Account Reconciliation Services (ARP) – Full or partial reconciliation that reports paid, outstanding and exception items; frequently bundled with positive pay.

ACH-side controls
• ACH Debit Block – The bank rejects all incoming ACH debits to the account. Appropriate for accounts that have no legitimate ACH debit activity (e.g., many disbursement or receipts accounts). Blocked items are returned to the originator, typically with return reason code R29 (corporate customer advises not authorized).
• ACH Debit Filter – The company gives the bank a list of authorized originators (by company ID/originator ID) and optionally maximum dollar amounts, frequency or date ranges. Debits from listed originators within the parameters post; everything else is returned or reported as an exception.
• ACH Positive Pay – The bank reports each incoming ACH debit (or each debit that fails the filter) and the company approves or returns it, mirroring check positive pay.
• UPIC (Universal Payment Identification Code) – A masked account identifier that can receive ACH credits but cannot be used to initiate ACH debits or draw checks, protecting the real account number when it is shared with customers.

3. How the Controls Work in Practice

Positive pay workflow
1. Accounts payable or payroll generates a check run; the system creates an issue file.
2. Treasury transmits the issue file to the bank before the checks are mailed. Voids and stop payments are also transmitted so the issue file stays current.
3. Checks are presented through clearing (or at the teller line with teller positive pay).
4. The bank matches each item on serial number, amount, and (if enrolled) payee name.
5. Exceptions are posted to the bank portal early in the morning. The company reviews images and makes a pay or return decision by the bank's cutoff, commonly late morning to early afternoon the same business day.
6. Items not decided by the cutoff receive the default decision agreed in the service agreement. The recommended default is return, since the whole purpose is to keep unverified items from clearing.
7. Returned items are sent back through the clearing system within the UCC midnight deadline so the bank of first deposit bears the loss or passes it to the depositor.

ACH debit block/filter workflow
1. Treasury inventories each account and determines whether any legitimate ACH debits should ever hit it (tax payments, loan payments, vendor-initiated debits).
2. Accounts with none are placed on a full debit block; accounts with some are placed on a filter with the originator IDs and limits of the approved debitors.
3. Incoming debits are screened by the bank at posting. Unauthorized items are returned automatically or, under ACH positive pay, presented for same-day decision.
4. Because the Nacha rules give a corporate (non-consumer) receiver only two banking days after settlement to return an unauthorized debit (versus 60 days for consumers), the automated nature of blocks and filters is critical. Without them, a company that spots a fraudulent debit a week later generally cannot return it through ACH and must pursue the originator directly.

Why both check and ACH controls are needed together
Fraud migrates to the weakest channel. A thief who obtains a company's routing and account number from a legitimate check can create counterfeit checks (stopped by positive pay) or originate ACH debits (stopped only by a block or filter). Additionally, under check conversion applications such as ARC, BOC and POP, a paper check can be converted into an ACH debit that bypasses check positive pay entirely; a debit block or filter closes that gap. Best practice is therefore to deploy payee positive pay on all check-writing accounts, ACH debit blocks on all non-ACH accounts, ACH filters or ACH positive pay on accounts with authorized debits, and post-no-checks on accounts that should never carry checks.

Complementary internal controls
Bank services do not replace internal controls. The exam expects you to know that positive pay and debit blocks sit alongside segregation of duties (check issuance separate from reconciliation), dual approvals and authority limits, secure check stock with security features, locked check printers and signature plates, daily reconciliation, timely statement review under UCC 4-406, callback verification for payment-instruction changes, and minimizing the number of accounts and the exposure of account numbers (e.g., using UPICs or lockbox addresses).

Limitations to remember
• Standard positive pay does not detect altered payees or forged endorsements; payee positive pay catches altered payees, but no positive pay product catches forged endorsements.
• Positive pay cannot stop a legitimately issued check sent to a fraudulent payee (business email compromise, vendor-master fraud). Those require vendor-change verification controls.
• Reverse positive pay shifts the operational burden and the risk of a missed deadline to the company.
• Holder-in-due-course claims may still arise if the company returns an item that was negotiated to an innocent third party.
• All services carry bank fees and require staff to clear exceptions daily; the cost is justified by the loss-avoidance and the liability protection.

4. Exam Tips: Answering Questions on Payment Fraud Controls: Positive Pay and Debit Blocks

Tip 1 – Match the fraud type to the control. CTP questions are usually scenario-based. Build a quick mental map:
• Counterfeit check or altered amount → Positive Pay.
• Altered payee name → Payee Positive Pay.
• Fraudulent check cashed at a branch → Teller Positive Pay.
• Unauthorized ACH debit on an account with no legitimate debits → ACH Debit Block.
• Unauthorized ACH debit on an account that does have some authorized debitors → ACH Debit Filter or ACH Positive Pay.
• Check converted to ACH (ARC/BOC/POP) that slipped past check positive pay → ACH Debit Block/Filter.
• Checks drawn on an account that should never have checks → Post No Checks.
• Need to publish an account number for receiving credits without exposing it → UPIC.
• Company lacks systems to send issue files → Reverse Positive Pay (recognize it as the weaker alternative).

Tip 2 – Know who matches and what the default is. In positive pay the bank matches and the recommended default is return. In reverse positive pay the company matches and the default is pay. Questions often test this reversal directly.

Tip 3 – Block versus filter. A block is absolute (all debits rejected). A filter is selective (approved originators and limits post). If the scenario mentions any legitimate ACH debits such as tax payments or loan drafts, a full block is the wrong answer.

Tip 4 – Remember the return windows. Corporate ACH receivers have only two banking days to return an unauthorized debit; consumers have 60 days. Checks must be returned by the paying bank's UCC midnight deadline. Questions about why automated ACH controls matter usually hinge on the short corporate return window.

Tip 5 – Link controls to UCC liability. Expect wording about ordinary care, comparative negligence (UCC 3-406) and the duty to examine statements promptly (UCC 4-406). The correct answer typically states that a company declining positive pay or failing to review statements may bear part or all of the loss, and that using the bank's offered fraud services helps the company demonstrate ordinary care.

Tip 6 – Know what positive pay cannot do. If a question asks which fraud is not prevented by positive pay, look for forged endorsement, legitimate checks sent to a fraudulent vendor, or ACH-converted checks. If it asks for the best control against business email compromise, the answer is verification callbacks and vendor-master controls, not positive pay.

Tip 7 – Operational sequencing. Issue files must reach the bank before checks are released; voids and stops must be updated; exceptions must be decided before the daily cutoff. Questions describing a check being paid because the issue file was transmitted late are testing this timing point.

Tip 8 – Choose the most complete answer. When options include a layered approach (payee positive pay plus ACH debit blocks/filters plus segregation of duties), the exam generally favors the comprehensive, multi-channel solution over a single product, because fraud shifts to the unprotected channel.

Tip 9 – Watch the qualifiers. Words such as most effective, least costly, best prevents, and primary purpose steer the answer. Reverse positive pay may be the least costly but never the most effective; a debit block is the most restrictive but not appropriate where authorized debits exist.

Quick Summary
Positive pay (and its payee and teller variants) protects against counterfeit and altered checks by matching presented items to the company's issue file, with the company deciding exceptions by a daily cutoff and a default of return. Reverse positive pay shifts the matching to the company with a default of pay. ACH debit blocks stop all incoming debits; ACH debit filters and ACH positive pay allow only pre-authorized originators. Together, supported by segregation of duties, timely reconciliation and UPICs, these services reduce fraud losses and demonstrate the ordinary care that keeps liability with the bank under UCC Articles 3 and 4.