5 minute read

Protecting your Business from Fraud: How Positive Pay Protects What You've Built

By Elliott Hale, Business Development Officer, St. Mary's Bank 

Business fraud isn't just a problem for large corporations; it can happen to organizations of any size. As payment technology has become faster and more convenient. Fraudsters have become equally sophisticated targeting businesses through check fraud, ACH fraud, wire transfer scams, and business email compromise. 

The good news is that there are proven ways to reduce your risk. Strong internal controls, employee education, daily account monitoring, and fraud prevention tools like Positive Pay work together to help protect your business before money leaves your account. While no solution can eliminate fraud entirely, combining sound business practices with the right cash management technology can put your business one step ahead of fraudsters. 

At St. Mary's Bank, our Cash Management Suite is designed to help businesses detect suspicious payment activity early, giving you greater control over your accounts and added peace of mind. Learn more about our Cash Management Services and Positive Pay solutions.

According to a recent Business Wire survey, 57% of small business owners report they have experienced fraud. That statistic is a reminder that every business — regardless of size or industry — should make fraud prevention a priority. 

Why Speed Matters 

When fraud occurs, every minute counts. 

Whether it's an unauthorized ACH withdrawal, a fraudulent wire transfer, or a compromised email account, the sooner suspicious activity is identified, the greater the likelihood of minimizing financial loss. That's why businesses should review account activity every day and take advantage of fraud detection services that identify unusual transactions before they are processed. 

Common ACH Fraud Scams 

ACH payments have become essential for payroll, vendor payments, direct deposits, and recurring collections. Unfortunately, they have also become a favorite target of cybercriminals. 

Unauthorized ACH Debits 

Fraudsters obtain business account information and initiate unauthorized withdrawals directly from a business account. These transactions may go unnoticed if accounts are not monitored daily. 

How Positive Pay Helps 

ACH Positive Pay allows businesses to establish approved ACH originators, block unauthorized transactions, establish dollar limits, and review exception items before processing. This additional layer of protection can help stop unauthorized electronic withdrawals before they impact your business. 

Vendor Payment Fraud 

Criminals impersonate trusted vendors and request that future ACH payments be sent to a "new" bank account. If employees make the change without verifying the request, future payments are redirected to the fraudster instead of the legitimate vendor. 

How Positive Pay Helps 

While Positive Pay cannot prevent someone from requesting fraudulent payment changes, it adds another layer of oversight for electronic transactions. Combined with strong internal approval procedures, it helps businesses identify suspicious payment activity before funds are released. 

Business Email Compromise (BEC) 

Business Email Compromise continues to be one of the fastest-growing financial crimes affecting businesses. 

Criminals gain access to — or convincingly spoof — a company executive's email account and send urgent requests directing employees to wire funds or pay invoices immediately. Because these emails appear legitimate, employees often feel pressured to act quickly without verifying the request. 

The Financial Crimes Enforcement Network (FinCEN) continues to warn businesses that email compromise remains one of the leading causes of business payment fraud. 

Fake Invoice Scams 

Fraudsters create invoices that appear to come from legitimate vendors. The invoices often look authentic and include updated payment instructions that direct funds to accounts controlled by criminals. 

One phone call using a trusted phone number, not the number listed in the email, can often prevent thousands of dollars in losses. 

How Fraud Happens in the Real World 

Imagine your accounting department receives an email from a long-time vendor explaining they recently changed banks. The email includes updated ACH instructions and requests that all future payments be sent to the new account immediately. 

Everything looks legitimate. The email uses the vendor's logo, references recent invoices, and even appears to come from the correct email address. 

The next payment is processed. 

A week later, your actual vendor calls asking why payment was never received. 

Unknown to your business, the vendor's email account had been compromised, and the payment instructions were altered by a criminal. The funds were sent to a fraudulent account and, in many cases, cannot be recovered. 

Situations like this happen every day. Verifying payment instruction changes by phone, requiring dual approval for payment changes, and using fraud prevention tools like ACH Positive Pay can dramatically reduce the likelihood of becoming the next victim. 

Email Account Takeover: The Gateway to Fraud 

Many payment fraud schemes begin with a compromised email account. 

Cybercriminals use phishing emails, fake login pages, malicious links, and stolen credentials to gain access to business email accounts. Once inside, they quietly monitor conversations, learn payment procedures, identify key decisionmakers, and wait for the right opportunity to redirect funds. 

Common warning signs include: 

• Unexpected password reset requests 
• Login notifications from unfamiliar devices 
• Emails disappearing from Sent or Deleted folders 
• Vendors requesting new payment instructions unexpectedly 
• Urgent payment requests that bypass normal approval procedures 

Check Fraud is Still a Serious Threat 

Although electronic payments continue to grow, check fraud remains one of the most common forms of financial fraud affecting businesses. 

Criminals steal checks from the mail, alter payee information, chemically "wash" checks to change the dollar amount, or create counterfeit checks using stolen account information. 

How Positive Pay Helps 

Check Positive Pay compares every check presented for payment against the check issue file submitted by your business. If the check number, amount, or issue date doesn't match your records, the item is flagged as an exception for your review before payment is made. 

This proactive review helps protect your business from: 

• Counterfeit checks 
• Altered checks 
• Duplicate presentments 
• Unauthorized check payments 

Best Practices for Protecting Your Business 

Fraud prevention works best when multiple layers of protection are in place. 

Businesses should: 

• Verify all payment instruction changes using a known, trusted phone number. 
• Enable multi-factor authentication for email and online banking. 
• Review account activity every business day. 
• Promptly review Positive Pay exception items. 
• Separate payment initiation from payment approval responsibilities. 
• Require dual approval for ACH and wire transactions whenever possible. 
• Train employees to recognize phishing emails and social engineering attempts. 
• Work closely with your financial institution to implement fraud prevention services that fit your business. 

Positive Pay: An Essential Layer of Protection 

Positive Pay isn't designed to replace good internal controls, it strengthens them. 

When combined with employee training, daily account monitoring, and sound payment approval procedures, Positive Pay provides businesses with an additional layer of defense against check and ACH fraud. 

Rather than discovering fraud after funds have left your account, Positive Pay helps identify suspicious payment activity before transactions are completed, giving your business an opportunity to review and make informed payment decisions. 

For businesses that issue checks, originate ACH payments, or process recurring electronic transactions, Positive Pay has become an essential component of a comprehensive fraud prevention strategy. 

Stay One Step Ahead 

Fraudsters are constantly adapting their tactics, making vigilance more important than ever. 

The most effective defense combines knowledgeable employees, strong internal controls, and technology designed to identify suspicious activity before losses occur. 

At St. Mary's Bank, our Cash Management professionals work with businesses to implement fraud prevention solutions that fit their unique needs. Whether you're looking to strengthen your payment controls, add Positive Pay, or learn more about treasury management services, we're here to help. 

Visit our Business Banking, Cash Management, and Positive Pay pages on the St. Mary's Bank website, or contact our Business Development Team to learn how we can help protect your business from today's evolving fraud threats.

Business Wire. (May 14, 2025). Small Businesses Challenged by Fraud on Top of a Difficult Macroeconomic Environment. Business Wire. https://www.businesswire.com/news/home/20250514071080/en/Small-Businesses-Challenged-by-Fraud-on-Top-of-a-Difficult-Macroeconomic-Environment