Positive pay

How positive pay actually works

Your bank keeps a check-issue file: the check number, date, and amount for every check the association has written. Someone at the association, or your management company, sends the bank an updated file each time checks go out.

When a check is presented for payment, the bank's system checks it against that file before paying it. A match clears the same way it always did. A mismatch, a check number that was never issued, an amount that was altered, a signature that does not look like anything on file, gets pulled and placed on an exception report. Nobody at the bank decides whether to pay it. Someone at the association does.

"An automated system compares the checks presented to the bank for payment to a list of information provided by the business about every check they've written."

Source: Positive Pay 101: A Guide to Preventing Payment Fraud, Bill.com

What it catches, and what it does not

Positive pay is good at catching a check that was intercepted, altered, or counterfeited after it left your hands, the classic move of changing a payee name or inflating an amount. It is not a substitute for controlling who can write a check in the first place.

If the person who prepares checks is also the person authorized to sign them, positive pay will not catch anything, because that check matches exactly what was submitted to the bank. The file itself was already unauthorized. This is why positive pay works alongside, not instead of, keeping check preparation and check signing in different hands.

"The person who signs checks should not be the same person who reconciles bank statements and receipts," and "the person who prepares checks should not be the person authorized to sign them."

Source: HOA Fraud: A guide to detection and prevention, FirstService Residential

Setting it up without recreating the same risk

Positive pay only works if someone reviews the exception report, and reviews it before the checks in question would otherwise clear, usually the same business day. If that job falls to the same person who signs checks or manages the account day to day, you have rebuilt the exact single point of failure positive pay was supposed to remove.

Route exception report review to someone other than the check signer, ideally a second board member or your management company's oversight contact. This is the same logic behind dual approvals and the broader idea of segregation of duties: authorization, custody, recordkeeping, and reconciliation should not sit with one person for the same transaction.