Confirmation of Payee for businesses: what a match does and does not prove

Confirmation of Payee checks whether the account name and account type entered by the payer match the details held by the receiving payment provider. It is a useful fraud and error control, but a successful match does not prove that an invoice, supplier or payment request is genuine.

Understand exactly what Confirmation of Payee checks

Pay.UK describes Confirmation of Payee as a name-checking service used when a payer sets up or changes a payee. The payer provides the account name, sort code, account number and whether the account is personal or business. The receiving provider then compares those details with its account records.

The service is designed to reduce misdirected payments and some authorised push payment fraud. It does not inspect the invoice, contract, email chain or commercial relationship. CoP answers whether the account details appear consistent with the name supplied, not whether the person asking for payment is honest.

Use the registered business name or trading name held on the account

Pay.UK says that when paying a business account, the payer should use the registered business name or a trading name registered to the account. This is important where the invoice brand differs from the legal company name. A legitimate supplier can produce a close or no-match result if the payer uses a name the bank does not recognise.

Businesses should therefore tell customers which name to enter when setting them up as a beneficiary. If a company trades as Bright Office but the bank only holds Bright Office Solutions Ltd, put the correct payment name on the invoice alongside the sort code and account number.

Interpret match, close match, no match and unavailable as different signals

Pay.UK describes four broad outcomes: a match, a close match, a no match and an unavailable result. A close match indicates the entered name is similar but not exact and can allow the payer to correct the details. A no match is a stronger warning that the name supplied does not match the account information.

An unavailable result can arise where the check cannot be completed, such as a timeout or unsupported account. It should not be treated as a match. Pause and verify the beneficiary through another trusted route if the payment is material or the account details are new.

Do not treat a successful CoP match as proof that the payment request is genuine

Pay.UK explicitly states that Confirmation of Payee does not automatically guarantee that a fraudulent payment will be detected or reimbursed. A fraudster can control an account whose name matches the details provided, or can compromise a genuine supplier's email and redirect payment to another legitimate-looking account.

Suppose a criminal creates a company with a plausible name and sends a false invoice. CoP can confirm that the account belongs to that company while the invoice itself remains fraudulent. Keep invoice approval, supplier verification and dual authorisation in place.

Build CoP into the new-beneficiary process rather than using it casually

When staff add a new supplier, record the CoP result alongside the beneficiary verification. A match can support the process; a close or no match should trigger review before the payment proceeds. Where the bank shows the corrected or expected name, compare it with independently verified supplier information.

Do not let staff click through warnings simply because a deadline is close. For a £50,000 first payment, stopping for ten minutes to verify a mismatch is cheap. Document the reason if a payment proceeds despite a warning so the decision is visible later.

Use independent verification when an existing supplier changes bank details

CoP is particularly useful when a beneficiary changes, but it should sit behind an out-of-band check. Call a trusted supplier contact using a telephone number already held in the supplier master, not the number in the change request. Then run the CoP check on the new account.

This layered approach addresses two risks: whether the new account name is plausible and whether the bank-detail change itself is genuine. The PSR says more than 320 organisations now offer CoP and millions of checks are made each day, making it a broad UK control, but the service is still one part of a business payment process rather than a substitute for judgement.

Train staff on the exact response to each warning. A close match should trigger correction or confirmation, a no match should normally stop the payment until independently resolved, and an unavailable result should not be interpreted as approval. Written rules prevent staff from improvising under pressure when a supplier says a shipment depends on immediate payment.