13.1 Check Fraud, Positive Pay & Bank Protection
Key Takeaways
- AIPB's check-fraud lesson covers forged company checks, payroll-related check fraud, customer check fraud, and bank systems that prevent those schemes—after Chapter 12's segregation of duties, imprest cash, screening, and fidelity bonds.
- Standard positive pay matches presented checks to Maple Ridge's issue file on serial number and amount; payee positive pay also matches the payee name and is the service built to catch a washed payee when the dollar amount is unchanged.
- Reverse positive pay sends the company a list of presented checks to pay or return without requiring an advance issue file; missing the bank's exception deadline can default to paying a counterfeit item.
- Check positive pay does not see ACH debits; commercial unauthorized ACH return windows are often only two banking days, so debit blocks, ACH filters, and same-day review matter.
- Never sign blank checks; reconcile promptly using the Chapter 4 bank rec as a detection control. UCC § 4-406 generally requires prompt examination of statements, with a common one-year outer period to report an unauthorized drawer signature or alteration.
Why check fraud is a bookkeeper skill
AIPB's sixth workbook, Mastering Internal Controls and Fraud Prevention, is Part 4 of the Certified Bookkeeper path: an untimed, open-book final that passes at 70%, with no extra exam fee. After employee-theft red flags, AIPB's public skill list names check fraud, then credit-card fraud, vendor fraud, and computer and internet fraud. Chapter 12 already built segregation of duties, cash receipts and imprest petty cash, pre-employment screening, and fidelity bonds. Do not rebuild those here. This independent OpenExamPrep section is the check and ACH-debit layer: forged company items, payroll-check schemes, customer-check schemes, and the bank systems that stop them. It is not an AIPB publication.
Maple Ridge HVAC Supply still writes paper checks. Check 4412 to Arctic Parts for $3,180—Chapter 12's dual-signature example—is a real claim on the operating account. A thief who can print, wash, or ACH-debit that account does not need Kim's warehouse key. Positive pay was named in Section 12.2 only as a forward pointer. Here it is the working system.
AIPB's three check-fraud buckets
AIPB's check-fraud lesson is how to prevent—or spot—forged company checks, payroll-related check fraud, and customer check fraud, plus systems that prevent check fraud. Keep the buckets separate on an exam item.
| Bucket | Who is pretending | Maple Ridge picture |
|---|---|---|
| Forged or counterfeit company checks | Thief draws on Maple Ridge's account | Stolen stock, forged maker (drawer) signature, washed payee, entirely fake checks using the routing number |
| Payroll-related check fraud | Thief attacks paychecks or the payroll account | Stolen or forged payroll checks, altered net-pay amounts, a paycheck issued after termination |
| Customer check fraud | A customer or a thief using a customer's item | Counterfeit customer checks, altered customer checks, forged endorsement of a check payable to Maple Ridge, NSF kiting patterns |
Forged maker (forged drawer). The maker is the person whose account is charged—the drawer. A forged-maker scheme puts a false drawer signature on a check drawn on Maple Ridge. Example: blank check 4429 leaves the locked stock (a Chapter 12 custody failure). The thief writes it to "J. Kline" for $4,900 and signs Pat's name. The bank may pay it if the serial and amount look ordinary. Dual signatures and never signing blank checks shrink the window. Positive pay rejects 4429 if it was never on the issue file.
Forged endorsement. The check is payable to Maple Ridge (or to an employee). Someone else indorses it. Example: a customer's $1,200 check payable to Maple Ridge HVAC Supply is stolen from the mail table—Chapter 12's dual-custody failure—and deposited with a forged "Maple Ridge" endorsement to a look-alike account. Restrictive For Deposit Only stamps, a lockbox, and a prompt bank rec (Chapter 4) are the detection tools. Forged endorsement is not the same item as a forged maker: the drawer's signature may be genuine.
Altered checks. A genuine check is changed after issue: payee, amount, or both. Check 4412 left Maple Ridge payable to Arctic Parts for $3,180. A thief raises the amount to $13,180, or washes the payee. Alteration is a Uniform Commercial Code problem the customer must examine statements to find. Standard positive pay catches an amount mismatch. It does not catch a payee-only wash if the amount still equals the issue file.
Counterfeit checks. The paper is fake. The routing number and account number are Maple Ridge's, copied from a legitimate check or from a photo. Serial 8801 was never issued. The amount is $12,000. Positive pay's classic exception is not on issue file. Teller positive pay, where the bank offers it, warns a branch teller before cashing it.
Check washing. Chemicals remove ink from payee and sometimes amount. The check number often survives. If the thief leaves $3,180 and only changes Arctic Parts to A. Parke, standard positive pay (serial + amount) matches and pays. Payee positive pay compares the payee name and should exception it. That is why "systems that prevent check fraud" are not one checkbox labeled "we turned on positive pay."
ACH debit fraud. No paper. A thief originates an ACH debit against Maple Ridge's demand deposit account: fake "Office 365" $2,475, fake payroll tax, fake utility. Check positive pay does not see it. ACH filters, debit blocks, and ACH positive pay (the company pre-authorizes originators or reviews exceptions) are the parallel bank services. Commercial unauthorized ACH return windows are short—often two banking days for many corporate entries under Nacha operating rules, unlike longer consumer Regulation E periods. A monthly rec after that window closed is too late.
Company, payroll, and customer schemes in numbers
Forged company check, worked. On September 22, 2026, Jordan issues 4412–4414 (including the void in Chapter 12) and uploads the issue file. Overnight, stolen stock 4429 is presented for $4,900. Exception: not on issue file. Pat returns it. If Jordan had not uploaded issues the same day, 4429 might pay, and the bank rec (Chapter 4) would show a $4,900 disbursement with no book entry—if someone other than the thief looks.
Payroll check fraud, worked. Terminated installer Riley is still in the payroll check run. Check P-331 for $1,184 net is forged-endorsed by someone who intercepted shop mail. Controls: cut off payroll the day of termination (Chapter 7), positive pay on the payroll account, and direct deposit that Riley no longer controls. A second payroll scheme: alter P-330 from $1,184 to $4,184. An amount mismatch versus the issue file is a standard positive-pay exception.
Customer check fraud, worked. A walk-in "contractor" pays a $6,800 condensing-unit invoice with a counterfeit cashier's check. Goods leave. The item is uncollectible. Controls: wait for availability on large unfamiliar items, know the customer on new walk-ins, and do not treat a "cashier's check" as cash. Kiting—using uncollectible checks to cover other uncollectible checks—shows up as unexplained NSF and draws against uncollected funds. Chapter 4's rec is where NSF and chargebacks appear; this chapter is why you do not ship on a first-time $6,800 paper item.
Positive pay, reverse positive pay, payee positive pay
Positive pay is a bank match. Maple Ridge sends an issue file of checks it wrote: serial number, date, amount, and, if subscribed, payee. When a check is presented, the bank compares it to the file.
| Service | What you send | What the bank compares | What it is built to catch |
|---|---|---|---|
| Standard positive pay | Issue file: serial + amount (and date) | Presented serial and amount | Wrong amount, duplicate serial, not on file, cancelled items still presented |
| Payee positive pay | Issue file including payee name | Presented payee as well as serial and amount | Washed or altered payee when the amount still matches |
| Reverse positive pay | No issue file required | Bank sends you presented checks; you say pay or return | Shops that will not maintain an issue file; you must review every item |
| Teller positive pay | Same issue file, pushed to branches | Teller sees a mismatch before cashing | Walk-in cashing of counterfeit or stolen company checks |
| ACH positive pay / filters | Authorized originators or a review queue | Incoming ACH debits | Unauthorized electronic debits the check file never sees |
Exception handling is a control. A mismatch is not automatically safe. The bank holds it for a pay-or-return decision by a deadline. Miss the deadline and the account agreement default—often pay—can release a $12,000 counterfeit. The person who uploads the issue file should not be the only person who can pay an exception. That is Chapter 12's triangle applied to a bank portal: recording the issues versus authorizing an exception.
Reverse positive pay flips the workflow. The bank does not need your issue file in advance. It sends presented items; Maple Ridge must decide each one. Reverse is useful for a tiny firm that writes three checks a week and will actually look. It is a trap if Jordan deletes the email and the default is pay.
Do not confuse controls. Dual signatures (Chapter 12) are internal. Positive pay is bank-side. A fidelity bond (Chapter 12) may reimburse employee theft of check stock if you can name a suspect; it does not stop a stranger's counterfeit, and it does not replace the issue-file match.
Bank reconciliation as detection (Chapter 4)
Chapter 4 taught how to reconcile: outstanding checks, deposits in transit, bank charges, NSF, errors, and the journal entries. This section is why the rec is a fraud control.
Uniform Commercial Code § 4-406, as enacted in state law, generally requires a customer to examine statements with reasonable promptness and notify the bank of an unauthorized drawer signature or alteration. If the same wrongdoer repeats, a reasonable period not exceeding 30 days after the statement is made available can cut off later items. Without regard to care, an outer one-year period after the statement is made available commonly precludes asserting the unauthorized signature or alteration against the bank. Deposit-account agreements often shorten these periods. Reconcile promptly is how you keep the right to demand a recredit.
Who prepares the rec. Chapter 12: not the only person who issues checks and holds stock. Pat, Dana, or an outside bookkeeper compares the bank's paid items to the check register and positive-pay issue file. A paid item not on the books is the forged-maker or counterfeit story. A book item still outstanding for months may be a stolen check not yet presented—or a void that was not stopped.
UCC § 3-406, as enacted: a person whose failure to exercise ordinary care substantially contributes to a forgery or alteration can be precluded from asserting it. Signing blank checks, leaving stock unlocked, and ignoring known mismatch emails are the bookkeeper facts that make that rule real.
Bookkeeper dos and don'ts for checks
| Do | Don't |
|---|---|
| Upload the issue file the day checks are issued, including voids and stops | Assume last week's file still covers this week's stock |
| Subscribe to payee positive pay if you still mail paper checks | Treat serial-and-amount match as proof the payee is intact |
| Decide exceptions before the bank's deadline, with a second person on large returns or pays | Let the portal auto-pay overnight because Jordan was at a job site |
| Lock prenumbered stock; account for voids (Chapter 12) | Sign blank checks "for Pat's trip" |
| Require two signatures above the firm's threshold (Maple Ridge: $2,500) and look at the invoice | Use a signature stamp stored with the check stock |
| Reconcile promptly using Chapter 4's method, by someone who did not issue all the checks | Wait until the one-year UCC outer period and hope |
| Put ACH debit blocks or filters on the operating and payroll accounts | Assume check positive pay covers ACH |
| Use direct deposit and cut terminated employees the same day | Mail payroll checks to a shared shop inbox |
Exam traps: (1) calling a washed payee a problem standard positive pay always catches; (2) treating reverse positive pay as "the bank handles it" when you must review presented items; (3) rewriting Chapter 12's imprest petty cash or fidelity-bond rules as the check-fraud answer; (4) skipping the rec because "we have positive pay"; (5) signing blank checks; (6) ignoring ACH because it is not a check; (7) claiming this independent guide is an AIPB workbook.
Walking the issue file against presented items
Read the diagram as a race between two lists. The left-hand list is what Maple Ridge says it issued. The right-hand list is what the paying bank is being asked to honor. Positive pay is the comparison. Reverse positive pay skips the left-hand list and forces a human decision on every presented item.
- Check 4412, Arctic Parts, $3,180, is on the issue file. Presented serial and amount match. If payee positive pay is on and the image still says Arctic Parts, pay. If the image says A. Parke, exception—that is the wash standard positive pay would have missed.
- Check 4429, $4,900, is not on the file. Exception, then return, even if the signature looks like Pat's. Forged maker with stolen stock is a not-on-file story when blanks never should have been issued.
- Counterfeit 8801 for $12,000 is the same not-on-file exception. If Jordan misses the deadline, the bank's default may pay it.
- An ACH debit for $2,475 never enters this flowchart. Put it on ACH positive pay or a debit filter, and review the bank portal the same day.
The bar chart below is a study ranking for standard (serial + amount) positive pay, not a published loss table. A tall bar means that service is designed to catch the mismatch. A zero means look to payee positive pay, ACH filters, or the bank rec—not to the serial-and-amount file.
Which situation is a forged-maker (forged drawer) scheme against Maple Ridge's operating account?
Maple Ridge issued check 4412 to Arctic Parts for $3,180. A thief washed the payee to A. Parke but left the amount $3,180. Which bank service is designed to catch that mismatch?
Which bookkeeper practice both supports prompt-examination duties under UCC § 4-406 and detects check fraud that slipped past the teller line?