How Payment Fraud Bypasses Verification of Payee — And What to Do About It

VoP checks names. Fraudsters exploit everything it doesn't check: ownership, entity legitimacy, account status, and cross-border gaps. Here's where VoP fails — and how to close the blind spots before your next payment goes out.

VoP Is Live. Fraud Hasn't Stopped. Why?

Since October 2025, Verification of Payee has been mandatory for every Payment Service Provider in the Eurozone. The regulation requires banks to check that a payee's name matches their IBAN before executing SEPA credit transfers.

It was supposed to be the kill shot against payment fraud.

It wasn't.

Sources: ACI Worldwide & GlobalData, LSEG Risk Intelligence, Global Anti-Scam Alliance, FTC (2024–2025)

VoP has not slowed this down in any meaningful way. The reason is structural.

VoP was designed to solve one specific problem: catching typos and obvious name mismatches before payments execute. It does that well. But modern payment fraud doesn't rely on mismatched names. It relies on deception that VoP was never designed to detect.

What Verification of Payee Actually Checks (And What It Doesn't)

VoP performs a single function. It compares the name entered by the payer against the name registered on the payee's account at the receiving bank.

That's it.

The system returns one of four results: Match, Close Match, No Match, or Unable to Verify. The payer then decides whether to proceed.

Here's what VoP does not check:

VoP protects against fat-finger errors and obvious impersonation. It does not protect against sophisticated fraud — which is exactly what's increasing.

Five Ways Payment Fraud Bypasses VoP

1. Stolen Identity, Legitimate Account

If a fraudster opens a bank account using stolen identity documents, the account is legitimately registered in that name. When a VoP check runs, it returns "Match." The fraud is invisible to VoP because, from the bank's perspective, the account holder and the name align perfectly.

This is the single biggest blind spot in the system. AI-powered identity fraud now makes it cheaper and faster than ever to create convincing synthetic identities at scale.

2. Invoice Interception with Mule Accounts

In a classic Business Email Compromise attack, a fraudster intercepts a legitimate invoice and swaps in new bank details. The new account belongs to a mule — a real person whose name is on the account. VoP checks the mule's name against the IBAN. It matches. The payment goes through.

BEC has cost businesses an estimated $55 billion over the past decade. VoP doesn't touch this attack vector. The name is "correct." The account is real. The money is gone.

3. Shell Companies and Dormant Entities

Fraudsters register shell companies or acquire dormant entities. These entities have valid bank accounts with matching names. VoP sees no mismatch. But the entity has no real operations, no employees, no legitimate business activity.

VoP cannot distinguish between a legitimate operating company and a freshly registered shell. It doesn't check company status, registration details, or trading history. All it sees is: name matches IBAN. Green light.

4. Payments Outside SEPA

VoP only applies to SEPA credit transfers. Any payment routed outside the Eurozone — to the UK, US, Asia, Africa, the Middle East — operates with zero VoP coverage.

For companies with global supply chains, this is a massive gap. Fraudsters know it. They route attacks through jurisdictions where no pre-payment verification exists. Non-Euro EU countries don't even need to comply until July 2027. That's 18 months of additional exposure.

5. Social Engineering That Coaches the Victim

In APP scams, fraudsters coach victims to enter the exact registered name on the receiving account. They tell you the name. You type it in. VoP returns "Match."

The fraud succeeds precisely because VoP does what it's supposed to do — and nothing more.

The Real-World Cost of the VoP Blind Spot

These aren't theoretical risks. The numbers tell the story.

Sources: AFP, FTC, TransUnion (2024–2025)

Recovery rates are collapsing. Once instant payments clear, the money is usually gone. For companies processing thousands of payments monthly, these errors compound into six-figure annual losses.

For enterprise finance teams, the math is brutal: VoP creates a false sense of security while the actual attack surface remains wide open.

Why Name Matching Is Not Ownership Verification

This is the critical distinction most companies miss.

Name matching asks: does the name I entered match the name on this bank account?

Ownership verification asks: does the entity behind this bank account legally own and operate the business I intend to pay?

These are fundamentally different questions. Name matching is a string comparison. Ownership verification is an intelligence function that requires:

• Cross-referencing the account holder against official government business registries
• Confirming the company's legal status (active, dissolved, suspended)
• Validating registration details: incorporation date, registered address, company number
• Checking beneficial ownership and group structure
• Monitoring for changes over time — new directors, address changes, status changes

VoP answers the first question. It doesn't even attempt the second.

Providers that verify ownership against aggregated or scraped data are better than VoP alone. But they inherit the accuracy problems of their sources. Providers that connect directly to government registries — the legal source of truth for entity existence, ownership, and status — deliver fundamentally higher confidence.

What Full Payment Verification Actually Looks Like

Treating VoP as your primary fraud defense is like locking the front door and leaving every window open. Full payment verification requires multiple layers working together.

No single layer stops all fraud. The combination does.

MonitorPay's API delivers all six layers through a single integration — from IBAN validation to continuous monitoring — sourced from government registries and banking partners across 150+ countries.

How to Close the Gap: A Practical Checklist for Finance Teams

If you're relying on VoP as your primary payment security measure, here's what needs to change.

Immediate Actions

• Audit your current payment verification process. Map exactly which checks happen before money moves. Identify the gaps.
• Add account ownership verification before every first payment to a new vendor and every bank detail change for existing vendors.
• Require entity legitimacy checks sourced from government registries — not self-reported data from the vendor.

Process Changes

• Treat any change of bank details as a high-risk event. Require independent verification through a separate channel before updating payment records.
• Implement dual authorization for payments above your risk threshold.
• Build verification into vendor onboarding — not as an afterthought, but as a gate that blocks account creation until checks complete.

Technology Requirements

• Deploy an API-driven verification platform that validates IBAN structure, account ownership, entity status, and beneficial ownership in a single workflow.
• Ensure coverage beyond SEPA. If you pay vendors globally, your verification must work globally.
• Require sub-second response times. Verification that slows down payment processing won't get adopted.
• Choose providers that source data directly from government registries and banking partners — not aggregators.

VoP Is a Floor, Not a Ceiling

VoP was a necessary regulation. It catches a real category of errors and prevents a subset of impersonation attacks. No reasonable person argues against it.

But the mistake — the dangerous, expensive mistake — is treating VoP as a fraud prevention strategy.

It's not.

VoP is a compliance requirement. It checks one thing: does this name match this IBAN? Fraudsters have already mapped every way around that single check. Stolen identities. Shell companies. Mule accounts. Cross-border routing. Social engineering that hands you the "right" name on a silver platter.

The companies that will avoid the next wave of payment fraud are the ones that verify deeper: ownership, entity legitimacy, account status, and beneficial control — sourced from the legal record of truth.