Nine months after the October 9, 2025 deadline that made Verification of Payee (VoP) mandatory for every payment service provider in the euro area, the check has become routine for payers. Every SEPA credit transfer, instant or not, now triggers a comparison between the IBAN entered and the payee’s name. The rollout is not over. Almost exactly a year from now, on July 9, 2027, PSPs in EU countries outside the euro area must apply the full Instant Payments Regulation (IPR) as well.
How the check works
- Legal basis: Regulation (EU) 2024/886 of March 13, 2024 (the Instant Payments Regulation), which amends the SEPA Regulation.
- Before authorizing the transfer, the payer gets one of four results: match, close match (with the actual account name shown), no match or verification not possible.
- The service is free for the payer. It runs on the European Payments Council’s VoP scheme, backed by a reachability directory (EDS) that routes requests between PSPs within seconds.
- Businesses that submit payments in bulk files can opt out. Consumers cannot.
- The same regulation has a second pillar: an instant transfer cannot cost more than a standard one.
French data show card fraud falling and manipulation rising
The figures from the OSMP, France’s payment security observatory hosted by the Banque de France (the French central bank), cut both ways. Technical defenses are working: card fraud fell by almost 10%, and the fraud rate on mobile payments is down to 0.013%, a tenth of its 2020 level. But fraud is moving to the human link. Social engineering, from fake bank advisers to fake suppliers and investment scams, now accounts for 40% of fraud losses. It hits credit transfers hardest, where ticket sizes are highest.
VoP stops invoice fraud, not scams where victims pay willingly
| Fraud type | How it works | VoP impact |
|---|---|---|
| Fake supplier bank details | Altered invoice or bank details; the IBAN does not belong to the creditor | High: the no match flags it before approval |
| CEO fraud | An urgent order from a fake executive to pay a third-party account | Partial: the real payee’s name can give the scheme away |
| Bank adviser spoofing | Victims approve transactions themselves under a fraudster’s influence | Low: manipulation gets around the check |
| Investment or romance scam | The victim knowingly pays the right, but fraudulent, payee | None: a perfect match on a mule or foreign account |
PSPs still have operational work to do
- First IPR report filed with regulators on April 9, 2026, covering fee levels and the share of instant transfers. It gives supervisors unprecedented visibility into adoption.
- Handling close matches: tuning name-matching algorithms for company names, accents and names in everyday use, to limit friction without burying real alerts.
- Corporate journeys: false positives on company names remain the top complaint from treasurers.
- Daily sanctions screening: for instant transfers, the IPR replaced transaction-by-transaction screening with checks of the customer base at least once a day.
The UK, which rolled out Confirmation of Payee in 2020, shows where this leads. Misdirected payments fell sharply, then fraud moved to pure manipulation, which the UK eventually tackled in 2024 by making reimbursement of authorized push payment (APP) fraud victims mandatory. Europe is following the same two-step path: VoP first, then the spoofing refund in the upcoming Payment Services Regulation (PSR). Technology can close doors, but it cannot stop customers from opening them.