by: Jake Dickman & Sam Adams | September 9th, 2026

Last October, Fresno Unified disclosed that someone impersonating its largest construction contractor had submitted a simple change-of-address request. Nobody called to verify it. Two payments went out - about $1.2 million and about $1 million. Nobody was hacked. Someone filled out a form.

Payment fraud is now the most common way a public agency loses money. The Association for Financial Professionals found that 76% of U.S. organizations faced attempted or actual payments fraud in 2025. And unlike a personal bank account, when it happens to your district, the loss usually stays with your district.

What Positive Pay Is

Positive Pay is a service your bank already offers. You tell the bank in advance what you intend to pay, and the bank holds anything that doesn't match for your review before the money leaves.

There are two versions, and most districts should have both: 

• Check Positive Pay matches each check presented against your issue file - check number, amount, and payee name.
• ACH Positive Pay limits which companies are allowed to pull an ACH debit from your account. On accounts that have no legitimate reason to be debited at all, ask your bank for an ACH debit block.

The One Thing Positive Pay Does Not Do

Positive Pay stops payments you didn't authorize. It doesn't stop payments you did authorize going to the wrong place. The Fresno checks were real - the district meant to pay that contractor, that amount, that month. Only the destination had been changed, so nothing would have been flagged.

That gap closes with a written rule: any change to a vendor's address or banking information gets verified by calling a number you already have on file - never a number in the request, never a reply to the email - and a second person signs off. That one page of policy is what would have stopped a $2.2 million address change.

Four Things To Do  This Month

1. Ask your bank, in writing, what Positive Pay and ACH blocking is available on your accounts and what it costs.
2. Put your vendor-change verification rule in writing, with a required callback.
3. Require two people to release any ACH or wire above a dollar amount your board sets.
4. Reconcile the accounts money leaves from daily. An unauthorized ACH debit on a district account can only be returned for two banking days - monthly reconciliation is often too late.

If it Already Happened

Call your bank immediately and ask for a recall, then loop in GSRMA right away.

How GSRMA Can Help

Use Vector Solutions to make cyber-awareness training a regular part of your staff training rotation - the people handling your payments are the ones being targeted.

Beyond that, if you have questions about Positive Pay, cyber security, cyber coverage, crime coverage, or anything related, reach out to Risk Control.

Call us at (530) 934-5633 or email riskcontrol@gsrma.org. We're glad to walk through your payment controls with you.