Why VoP Won’t Stop Supplier Fraud: The Hidden Limits of EU Payee Verification

The EU's Verification of Payee mandate went live on 9 October 2025. Around 2,700 banks and payment service providers across the Eurozone now check the payee's name against the IBAN before every SEPA credit transfer settles.

Compliance teams are exhausted. Press releases are loud. The implication, from regulators and vendors alike, is that the supplier-payment fraud problem has finally been solved.

It hasn't.

VoP catches some fraud. It misses the patterns growing fastest. This article walks through the three hidden limits of the EU's payee verification mandate — what VoP actually checks, what it misses, the implementation issues already documented six months in, and what corporates need to add on top to stop the fraud still draining billions from B2B payments globally.

If you are paying suppliers in the Eurozone, your money is safer than it was in September 2025. If you are paying suppliers outside the Eurozone, almost nothing has changed.

1. What Verification of Payee Actually Does

Verification of Payee is a regulatory requirement under the EU Instant Payments Regulation (Regulation (EU) 2024/886). Before a SEPA credit transfer — standard or instant — is authorised, the payer's PSP must check whether the beneficiary name on the payment matches the IBAN registered at the payee's bank.

The system returns one of four standardised responses:

The core architecture is decentralised. The European Payments Council (EPC) publishes a rulebook and a security framework, but the actual verification happens directly between PSPs through Routing and Verification Mechanisms (RVMs). As of the October 2025 go-live, the EPC's register of participants included 2,673 PSPs and 55 RVMs.

The non-Eurozone EEA states (Iceland, Liechtenstein, Norway, plus EU member states outside the euro) have until 9 July 2027 to implement VoP for SEPA credit transfers in euros. Non-SEPA countries are not in scope.

2. The First Limitation: Name vs. IBAN, Not Identity

Read the EPC's own description of the scheme carefully and the limitation is explicit. VoP "facilitates the verification of data about a payee, but it cannot be used to reliably identify a private or legal person."

This is the single most important sentence in the regulatory record. VoP confirms that the IBAN you are about to pay belongs to an account in the name you provided. It does not confirm that the named entity is the entity you intend to do business with.

A registered shell company with a real bank account in a real legal name will pass VoP every time. A compromised account where a fraudster has gained control of a legitimate supplier's banking will pass VoP every time. An account opened with stolen identity documents that match the name on the invoice will pass VoP every time.

Trustpair's analysis puts it directly: VoP "only checks whether the beneficiary name matches the account holder's name. Today, most fraudsters rely on identity theft, something VoP cannot detect. For instance, a bank may confirm that the account name matches, without realising the account itself has been compromised by criminals."

This is the gap that vendor imposter fraud exploits. The Association for Financial Professionals' 2025 survey found that vendor imposter fraud — where attackers pose as a real supplier and request a change of bank details — rose to 45 per cent of business email compromise incidents in 2024, up 11 percentage points year-on-year. It was the largest single-year increase of any BEC subcategory.

3. The Second Limitation: SEPA-Only Coverage

VoP applies to credit transfers within the Single Euro Payments Area. Payments outside SEPA — to suppliers in the United States, the United Kingdom, Brazil, India, Vietnam, Nigeria, the UAE, or any of the 49+ markets where most multinational corporates source goods and services — are entirely outside the scheme's reach.

The data already shows fraudsters have noticed.

UK Finance reported that international payments accounted for 11 per cent of authorised push payment fraud losses in 2024, up from 6 per cent in 2023 — almost doubling in a single year. Their analysis is direct: criminals are "likely trying to get people to send money outside of the UK" because mandatory reimbursement rules do not cover international payments.

The same logic applies to corporate payments. If fraudsters can route an attack through a country where neither VoP, Confirmation of Payee, nor Nacha applies, they will. Cross-border B2B payments now sit in a regulatory blind spot.

For a UK corporate paying a German supplier, VoP applies on the receiving end (post-July 2027 for the UK side; CoP works on the UK side now). For a German corporate paying a US supplier, VoP applies on the German side — but the US side has no equivalent mandate, and the verification stops at the SEPA boundary. For a Spanish corporate paying a Brazilian supplier, neither end is covered.

4. The Third Limitation: Implementation Issues Already Documented

Within a month of the October 2025 go-live, SurePay — one of the largest VoP RVMs in Europe — published a CTO-level review of operational issues. The list is sobering for any corporate that assumed the scheme would work cleanly out of the box.

Diacritics break matching

SurePay reports two distinct issues: some PSPs return a Close Match suggesting a name with diacritics (e.g. requested name "Rene Muller" returns suggested "René Müller") — but if the requesting bank's UI does not allow diacritic input, the user can never achieve a full Match. Other PSPs return outright errors when names contain diacritics, with no separate reason code, leaving the end user with a generic "could not match" message.

Match rates are inconsistent across Europe

SurePay reports that match rates in the mature Netherlands market reach approximately 80 per cent, "whereas the results across Europe are way lower." Anything below 80 per cent means routine warnings on legitimate payments — and a routine warning that fires on legitimate payments is a warning that gets ignored.

Name-matching limits vary by country and bank

SurePay's CTO documents the operational variation:

• Some banks restrict name fields to 70 or even 40 characters, even though the VoP scheme allows 140
• Some countries use full names; others use initials by default
• Joint accounts, double-barreled names, and business trading names all create matching ambiguity
• Some markets use Greek or Cyrillic alphabets, requiring transliteration

The NOAP code is structurally vague

SurePay describes NOAP as "somewhat vaguely described as a valid reason code in case a match could not be performed for whatever reason." When a corporate submits a payment and the response is NOAP, there is no standard mechanism to learn whether the failure was technical, regulatory, or a genuine name mismatch.

Bulk corporate payments are partially outside the scheme

While banks must offer VoP for bulk files, the VoP scheme itself "does not provide any standard or guideline for VoP bulk checks." SurePay reports many corporates are simply opting out of VoP for their bulk payment files because of the operational complexity. The scheme's biggest theoretical beneficiaries — corporates running thousands of vendor payments per file — are using it least.

5. What VoP Tells You vs. What You Actually Need to Know

Below is the gap as it sits today, written from the perspective of a finance team about to send a six-figure payment to a new supplier. The first column is what VoP returns. The second is what verification needs to answer to actually make a confident payment decision.

A finance team with only VoP can answer the first three questions. The next eight are the ones that actually distinguish a legitimate supplier from a sophisticated fraudster — and they are the ones VoP was never designed to address.

6. Why "Just Add More Manual Checks" Doesn't Work

The default response to limitations of VoP, in many corporates, has been to add manual processes on top. A callback to the supplier on a known phone number. A second-pair-of-eyes review by treasury. A finance director sign-off above a certain threshold.

Manual controls fail on three fronts.

They fail under speed

Trustpair's January 2026 survey of 250 senior US finance executives found that 48 per cent still rely on manual checks like callbacks or email confirmations to validate vendor bank details. In the same study, 71 per cent reported an increase in AI-powered fraud attempts over the prior 12 months. Manual controls were designed for an era when a fraudulent invoice took a fraudster days to produce. AI tools now produce convincing fake supplier emails, voice calls, and supporting documents in minutes.

They fail under volume

Lee-Ann Perkins, Head of Global Treasury at Ankura Consulting, summarised the failure mode in a Trustpair-published interview: "End-of-month pressure, urgent payments, year-end activity, and high vendor turnover — these are exactly the conditions fraudsters exploit. Humans are most vulnerable when we're rushed or overloaded."

They fail under continuity

A supplier verified manually at onboarding is not verified six months later when their bank details "change." Only 32 per cent of US finance leaders continuously validate vendor bank account details, according to Trustpair's 2026 data. The remaining 68 per cent verify periodically or only at onboarding — which is exactly the gap vendor imposter fraud exploits.

The manual-control posture made sense when fraud was slow, low-volume, and human. It does not make sense in a world where attackers automate, AI-generate, and target dozens of suppliers in parallel.

7. What the Layer Above VoP Looks Like

If VoP is the floor, the question for finance and compliance leaders is what sits on top of it. Three controls do the heavy lifting on the questions VoP cannot answer.

Legal entity verification

Confirms the supplier is a real, registered company with a current registration status, an active tax ID, and a valid address. Sourced from official government registries — Companies House in the UK, Receita Federal in Brazil, the IRS for EINs in the US, and equivalents in 200+ countries. This catches shell companies and dissolved entities VoP would happily verify.

Account ownership confirmation

Confirms that the bank account is owned by the named legal entity, not by a third party using the entity's name. This is the layer that catches compromised accounts where a fraudster has gained banking control of a legitimate supplier — VoP's biggest blind spot.

Continuous monitoring

Tracks the supplier's bank details, registration status, and corporate structure over time. Alerts when something changes. This is what catches the change-of-bank-details attack between two point-in-time verifications, and it is the control most corporates do not have.

8. How MonitorPay Closes the Gap

MonitorPay was built around the assumption that VoP, CoP, and Nacha account validation cover what they cover, and nothing else. Our role is everything VoP does not check.

In a single API call, MonitorPay returns:

Coverage extends across 49+ countries with direct bank verification and 200+ government registries for entity intelligence. Sub-second response. Single endpoint. The same API call that handles a SEPA payment to Munich also handles a wire to Mumbai, Brasília, or Lagos.

9. What This Means in Practice

Three changes to make in your supplier verification posture in 2026:

Stop treating VoP as the answer

It is one layer. It catches one class of error. Plan and budget for the layers above it as separate controls, not bolt-ons.

Verify continuously, not at onboarding

A point-in-time check at onboarding tells you what was true on that day. Vendor imposter fraud is built on the premise that something changes between onboarding and the next payment. Continuous monitoring is the only control that catches the change.

Extend coverage past the SEPA border

UK Finance's data showing international APP fraud nearly doubled in a year is the leading indicator. If your supplier base is global, your verification posture has to be global. VoP, CoP, and Nacha will not get you there.

The rule of thumb that works: every payment, every supplier, every country, every time. Anything less is a hole the fraud is already moving into.

Frequently Asked Questions