Check positive pay vs ACH positive pay: what each one guards
Check positive pay and ACH positive pay are two different bank controls that solve two different problems. Check positive pay protects the paper checks you write. ACH positive pay, also called ACH debit block or ACH filter, protects your account from unauthorized electronic ACH debits. They cover separate payment channels, so having one does not protect you against the other.
This page explains what each control does, how each works, and why many businesses run both. This tool handles the check side: it builds the check issue file your bank uses for check positive pay. For the ACH side, see the notes below and the ACH positive pay allowlist page.
What check positive pay protects
Check positive pay defends against forged, altered, and counterfeit paper checks. When you issue checks, you send your bank a check issue file listing the checks you wrote. Each record typically includes the check number, amount, issue date, and account number, and many banks also support the payee name for payee positive pay.
When a check is presented for payment, the bank compares it against your list. If the check number, amount, or payee does not match, the bank flags it as an exception and holds it for your pay or return decision. A counterfeit check that was never on your list, or a real check that someone altered, gets caught before it clears. That is the core of how positive pay stops check fraud.
What ACH positive pay protects
ACH positive pay protects against unauthorized electronic debits pulled from your account through the ACH network. These are not checks. They are direct withdrawals initiated by an outside party, such as a vendor draft, a subscription charge, or a fraudulent debit set up with stolen account and routing numbers.
Instead of submitting a file of items you issued, you give the bank an allowlist of the companies allowed to debit you. Entries usually identify each approved originator by its ACH company ID (also called the originator ID), and often add a maximum dollar amount and a debit type. The bank screens every incoming ACH debit against that list.
The terms vary by bank. An ACH debit block generally blocks all ACH debits except the ones you approved. An ACH filter applies more granular rules, such as a per company dollar cap. ACH positive pay often pairs these with exception handling: a debit that does not match the allowlist is routed to you to approve or reject before it settles, rather than blocked outright.
Why timing makes the ACH side urgent
Business accounts have a short window to fight an unauthorized ACH debit. Under the Nacha Operating Rules, a bank returning an unauthorized debit on a non-consumer (business) account must transmit the return by the opening of business on the second banking day following the settlement date. Consumer accounts get up to 60 calendar days, but businesses do not.
Two banking days is not much time to notice a fraudulent withdrawal, confirm it, and act. That short window is a large part of why banks recommend a proactive ACH control. Catching a bad debit before it settles is far easier than clawing it back after.
This page is general information, not legal advice. Return deadlines and rule details change over time and can vary with your situation, so confirm the current requirements with your bank or a qualified advisor.
Why a business often needs both
Most businesses pay and get paid across multiple channels at once: paper checks to some vendors, ACH for payroll, and recurring ACH drafts for utilities, software, and insurance. Each channel is a separate attack surface.
- Check positive pay covers the checks you write. It does nothing about an electronic debit, because no check was ever issued.
- ACH positive pay, debit block, or filter covers electronic debits. It does nothing about a counterfeit paper check, because that item never touches the ACH network.
Running both closes the gap. If you are deciding what to put in place, the do I need positive pay guide and the implementation checklist walk through the decision.
How this tool fits in
This tool builds the check issue file for the check positive pay side. You import or paste your issued checks, map the fields, and export the format your bank expects, whether that is fixed width or CSV. The exact layout is account specific, so if your bank gave you a custom spec, use the format builder to match its fields and the validator to confirm the output before upload.
The tool does not generate ACH allowlists or debit block rules. Those are configured directly in your bank's online banking portal, since they describe who may debit you rather than what you issued. The ACH positive pay allowlist page covers how that setup works and what details your bank will ask for. For more on the regulatory return windows, see the official Nacha rules on unauthorized return reasons.