Supplier Bank Details Changed? How to Monitor, Verify and Decide Before You Pay

Paying suppliers?

Your bank now checks that the name on a payment matches the name on the account. That check — Confirmation of Payee in the UK, Verification of Payee in the eurozone — is genuinely good at catching typos and crude redirections. But it answers only one question: does this name belong to this account? It cannot tell you who is actually behind the name. This guide shows, step by step, how to verify a supplier's bank details and the company behind them before you release a payment.

What your bank's payee check actually does

Since 2020, UK payers have seen a Confirmation of Payee prompt before most bank transfers. The Payment Systems Regulator first directed the six largest banking groups to offer it in August 2019; its Specific Direction 17 then pulled in around 400 more payment service providers in two waves, with the last group due by 31 October 2024. CoP now covers over 99% of Faster Payments.

The eurozone followed. Under the EU Instant Payments Regulation, every payment service provider in a euro-area country has had to run Verification of Payee on euro credit transfers — standard and instant, single and bulk — since 9 October 2025. Providers in non-euro EU countries must follow by 9 July 2027.

Both schemes work the same way. Your bank sends the name and account identifier you entered to the payee's bank, which compares them to its own records and replies within seconds:

That is the whole of the check. A green "match" proves the account is held in that name. It says nothing about whether the company is two weeks old, shares an address with hundreds of shell firms, has never filed accounts, imitates your real supplier by one letter, or is run by someone who has dissolved a string of companies before. Those facts sit in the company register — and your bank does not read it before the money leaves.

The numbers: name checks work, so fraud moved

UK Finance splits authorised push payment (APP) fraud into two families. In malicious redirection — invoice and mandate fraud, CEO fraud and impersonation — you mean to pay a genuine payee but are tricked into paying someone else. In malicious payee fraud, the payee is exactly who it says it is; the deal itself is the fraud. Name checks are built for the first family. Watch what happened to each.

Redirection losses fell from £220.3m in 2020 to £139.3m in 2025, while malicious-payee losses more than doubled to £437.2m. UK Finance itself points to Confirmation of Payee and in-journey warnings as tools that help catch redirection earlier. The lesson for a finance team is not that the name check is enough. It is the opposite: criminals have learned that the cheapest way past a name check is to control a payee whose name genuinely matches. For business payments, that means a registered company.

Invoice and mandate fraud: smaller in count, heavy per case

Invoice and mandate fraud hit a record low in 2025 — £41.3m across 2,305 cases — but it remains a business problem. Business (non-personal) accounts carried £28.0m, or 68% of those losses, because firms pay large genuine invoices every week, which makes one fraudulent payment hard to spot.

The UK's mandatory reimbursement rules, in force since October 2024, cover consumers, micro-enterprises and charities for payments up to £85,000. A mid-sized or large company that pays a fraudulent supplier invoice is outside that safety net. The control has to happen before the money moves.

The eurozone: scams now drive credit-transfer fraud

Verification of Payee arrived because European losses were moving the same way. The joint EBA–ECB payment fraud report puts total payment fraud in the European Economic Area at €4.2bn in 2024, up 17% on 2023. Fraudulent credit transfers alone reached €2.5bn, up 24% — and 74% of that value came from payers being manipulated into authorising the payment themselves, up from 65% a year earlier. Unlike card fraud, the payer usually carries the loss: users bore around 85% of credit-transfer fraud losses in 2024.

Those figures pre-date mandatory VoP, which only started in October 2025. VoP will stop payments to accounts whose name doesn't match. It won't stop a manipulated payer from paying a correctly named account — which is exactly where the register check comes in.

The United States: no national name check at all

US businesses do not have a CoP or VoP equivalent across ACH and wire payments, and the losses show it. Business email compromise (BEC) — the umbrella under which supplier impersonation and changed-bank-detail scams are reported — cost victims who reported to the FBI $3.05bn in 2025 across 24,768 complaints. In the Association for Financial Professionals' 2026 survey, 76% of US organisations faced attempted or actual payments fraud in 2025, and 74% were affected by BEC.

Bank check vs Know Your Payee: what each one sees

Here is where the two layers differ, field by field.

Try it: six real-world scenarios

Pick a scenario to see what the bank's name check returns, and what reading the register adds.

Scenarios three, four and five are the ones that cost businesses most: the bank says match, and the payment looks routine — often because it is the first one to a new payee, or the first since the bank details "changed".

How to verify a supplier's bank details: 8 steps

Use this sequence at supplier onboarding and on every change of bank details. Steps 1–3 are what most teams already do. Steps 4–8 are what closes the gap the name check leaves open.

1. Treat every change of bank details as a brand-new payee AP

   Fraud concentrates on the moment details change. Freeze the payment run for that supplier until the new details pass every step below — don't just edit the vendor master record.

2. Call back on a number you already hold AP

   Use the phone number from your contract or vendor file, never the one in the email, letterhead or invoice that announced the change. Email accounts get compromised; replies to them prove nothing.

3. Run the bank's name check — and read the result properly Bank

   Use CoP, VoP or a bank account verification service. "Close match" means stop and compare the returned name. "No match" or "not possible" means hold. A "match" means only that the name and account belong together — continue to step 4.

4. Resolve the account name to a legal entity in the official register KYB

   Find the exact company — registration number, not just the trading name — in the register of its home country — or run a KYB verification across 400+ registries at once. Confirm status (active, dormant, in liquidation, dissolved), incorporation date and registered address. If no entity matches, that's your answer.

5. Check the red flags in the record KYB

   Incorporated in the last 90 days? Name one character away from your real supplier? Registered office shared with hundreds of companies? No accounts filed, or accounts overdue? Missing or invalid VAT number, or no web footprint? Each of these is a fact you can see in the register.

6. Look at the people and owners behind it KYB

   List the directors, shareholders and beneficial owners at 25% or more, and map the group structure above the payee. Then follow each director to their other companies: three or more incorporations in 24 months, companies formed and closed within a year, or appointments in secrecy jurisdictions all point to a vehicle, not a trading business. Screen names against sanctions and PEP lists.

7. Decide Proceed, Review or Hold — and record why Controls

   Treat a failed payment link, an unverifiable company or a broken continuity record as a stop condition. Keep financial strength and data gaps as reviewer inputs, not automatic blocks. Write down the evidence and its source, so an auditor can follow the decision.

8. Keep watching after you've paid Monitoring

   Bank account details themselves can't be monitored, but the company can — through registry monitoring. A change of status, registered office, directors or ownership is the trigger to re-verify the bank details before the next payment.

Quick self-check: would this payee pass?

Tick what you can see in the payee's bank result and company record. This is a simplified triage based on the logic above, not the Know Your Payee rule engine.

Where this data comes from — and its limits

Everything in steps 4–6 is public in most countries. The problem is that it's spread across hundreds of registers, each with its own format and rules.

How Know Your Payee by Global Database closes the gap

One request — payee name, account number, country — runs four checks.

Every fact in a Global Database result shows which register it came from and when. If a register doesn't publish something, the result says so plainly — a gap is never shown as a red flag.

Who should add a Know Your Payee layer

Accounts payable and procurement teams — at supplier onboarding and on every bank-detail change, especially for first payments and high-value runs. Banks and payment service providers — to extend the VoP or CoP result they already return with the company behind it. Payment networks and schemes — to embed the check at network level for every corporate on the rail. Marketplaces and platforms — to verify the legal entity and owners behind a seller before releasing payouts.

Frequently asked questions