The Name on the File: What Confirmation of Payee Can and Cannot Prevent

Confirmation of Payee is often summarised as a name-check on a bank transfer. That description is accurate but incomplete. The service compares the name a payer has entered with the name held on the account at the receiving bank. It returns a result before the payment is sent. What it does not do is certify that the person or company behind the account is honest, that the invoice is genuine, or that the payment is commercially sensible. For small businesses, that distinction is the difference between a useful control and a false sense of security.

What the check actually compares

When a payer enters a name, sort code and account number, the sending bank asks the receiving bank whether the name matches the account holder. The receiving bank does not see the payer's full details. It returns one of a small set of answers: a match, a close or partial match, no match, or an indication that the check could not be completed. The payer's bank then decides how to present that answer. Some apps show a green confirmation for a match and a warning for anything else. Others require the payer to confirm again before proceeding.

A partial match is common and often benign. It can arise from initials, middle names, punctuation, a trading name, or a company name that appears differently in different records. 'J Smith' may be a close match to 'John Smith'. 'ABC Ltd' may be a close match to 'ABC Limited'. A sole trader may trade under a name that is not the name on the bank account. A partial match is therefore a prompt to look more closely, not proof of fraud.

Why invoice scams still succeed

Invoice fraud usually attacks the space between verification and payment. A fraudster may compromise a supplier's email account, send an amended invoice with new bank details, and ask for the payment to be made urgently. If the payer runs Confirmation of Payee and sees no match or a partial match, the warning is visible. The fraud succeeds when someone overrides it: because the supplier is trusted, because the invoice looks familiar, or because a colleague is pressing for the payment to be released.

Small businesses are exposed for structural reasons. One person may approve and pay. Supplier bank details may sit in an inbox rather than a controlled master record. A change of bank details may be accepted by email without a call-back to a known number. Confirmation of Payee cannot repair those weaknesses. It can only report what the receiving bank holds. A fraudster who opens an account in a similar name may even generate a partial match, which is exactly the kind of ambiguous answer that a busy finance team may wave through.

The reimbursement rules in practice

Authorised push payment fraud occurs when a victim is deceived into authorising a transfer. Since October 2024, the Payment Systems Regulator's reimbursement requirement has applied to many UK bank transfers, particularly Faster Payments. In broad terms, sending and receiving payment firms share the cost of reimbursing eligible victims, subject to a maximum claim limit of £85,000 per claim. The rules are not a universal insurance policy. Eligibility depends on the type of payment, the size and status of the victim, and the circumstances of the claim. International transfers, card payments and ordinary commercial disputes sit outside the core regime.

For a business, the practical questions are therefore narrow. Was the payment made through an in-scope route? Is the business within the protected category? Did the firm ignore a clear warning or act with gross negligence? Did the recipient receive the money and fail to return it? Banks assess claims on evidence, and a record of Confirmation of Payee results, call-back attempts and approval decisions matters. A 'no match' warning that was overridden without explanation is unlikely to help a claim. A documented call to a known supplier number, followed by a corrected payment, is a stronger position.

A verification routine that does more than tick a box

The control should sit inside a process.

• Keep supplier bank details in a master record, not in individual email threads.
• Require a call-back to a previously known number for any change of bank details.
• Separate invoice approval from payment release where staffing allows.
• Record the Confirmation of Payee result for new payees and for any change of details.
• Treat urgency and secrecy as risk indicators, not as reasons to skip checks.

The limit of a name check

Confirmation of Payee is valuable because it catches mismatches that would once have gone unnoticed. It is not a guarantee of legitimacy. A match confirms only that the name and account align at the receiving bank. The invoice may still be false, the supplier may still be impersonated, and the account may still be controlled by a fraudster. The check belongs in a wider payment discipline: verified master data, independent call-backs, dual authorisation and a willingness to stop a payment when the answer is ambiguous.