When a Payment Is Successful — but Still Goes Wrong 

Asha pays a contractor after receiving the final invoice. She enters the account number, checks the amount and authenticates the payment with her fingerprint. The payment goes through successfully. Only later does she realise that she had copied the wrong account number. 

Vijay has a different experience. He receives an email that appears to come from a supplier he regularly deals with. It says the supplier has changed its bank account and asks him to use the new details for the next payment. Everything looks normal. Vijay enters the details, authenticates the transaction and sends the money. Later, he discovers that the email was fake and the account belonged to a fraudster. 

The two situations are very different. Asha made a mistake. Vijay was deceived. But there is an important similarity: both customers themselves authorised the payments. 

The second case is an example of Authorised Push Payment (APP) fraud. In an APP scam, the customer is manipulated into authorising a payment to an account controlled by the fraudster. The payment is therefore not “unauthorised” in the conventional sense—the customer really did approve it. The problem is that the customer was tricked about who they were paying or why they were paying.  

The problem is that “the right customer made the payment” is not the same as “the customer made the right payment.” That distinction is behind the growing use of Confirmation of Payee (CoP) and Verification of Payee (VoP) around the world. 

Their basic purpose is simple: before the money moves, give the payer a way to check that the account really belongs to the person or business they intend to pay. 

Traditional payment controls have been very good at answering one question: Is this really the customer? That is authentication. They can also answer another: Did the customer approve this transaction? That is authorisation. 

But consider what happened in our example. Nobody impersonated the customer. Nobody stole the customer's credentials. The customer genuinely approved the payment. The problem was the destination. That creates another question: Is the money going to the person the customer thinks they are paying? CoP and VoP address this part of the journey. 

Instead of treating the account number as the end of the story, they introduce another check before the payment is sent. The payer supplies the name and account details of the intended recipient. The receiving bank or an appropriate verification service checks those details and returns a result. 

It might be a match. It might be a close match. It might be a mismatch. Or it might not be possible to complete the check. The important thing is that the payer gets that information before sending the money. 

CoP or VoP — what is the difference? 

The two terms can make this sound more complicated than it is. 

Confirmation of Payee, or CoP, is the term commonly associated with markets such as the UK, Australia and Canada. Verification of Payee, or VoP, is the term used by the European Payments Council for its scheme in the Single Euro Payments Area. 

The terminology is different, and the precise implementation can also differ, but the underlying idea is broadly similar: check whether the payee information supplied by the payer corresponds to the account information held by the recipient's financial institution before the payment is made. 

There is therefore no need to treat CoP and VoP as two entirely different technologies. It is more useful to think of them as different market implementations of the same basic principle — verify the destination before sending the money. 

What actually happens when you make the check? 

Imagine that you are paying John Smith. You enter John Smith's name and account details into your banking app. The payer's bank or payment service provider sends a verification request to the institution that holds the receiving account. That institution checks the supplied information against its records and sends back a response. The payer then sees the result. 

In Europe's EPC VoP scheme, the payer's provider can request verification of the recipient's IBAN and name, or in some cases another identifier that uniquely identifies the payee. The receiving provider verifies the information and returns a result such as match, close match, no match or verification not possible.  

The customer experience can therefore be very simple: Enter the details → check the result → decide whether to pay. 

The interesting part is what happens behind that simple screen. Where does the information come from? There are two basic approaches. 

In a centralised model, participating banks make relevant payee information available to a common central service. When a customer enters an account number and name, the payer's bank sends the details to that service. The central service performs the match and returns the result. In simple terms, one central place does the checking. 

In a federated model, each bank keeps its own customer and account information. The central service does not need to hold all that information. Instead, it receives the request, identifies the bank that holds the account and sends the request to that bank. That bank performs the check against its own records and sends the result back.  

In simple terms, each bank does its own checking, while a central service connects them. But for the industry, it matters because financial institutions have to balance verification with privacy, data ownership, security and interoperability. 

The European model is particularly interesting because the Eurosystem has made VoP services available through solutions developed by Banco de Portugal and Latvijas Banka, designed to provide SEPA-wide reach and support payment service providers in meeting their regulatory obligations.  

Europe has turned verification into part of the payment rulebook 

Europe has moved the fastest from an industry initiative to a regulatory requirement. 

Under the EU Instant Payments Regulation, payment service providers in the euro area became required to offer VoP for both standard and instant euro credit transfers from 9 October 2025. The service must be provided free of charge to the payer. To support this requirement, the European Payments Council (EPC) brought its VoP scheme rulebook into force on 5 October 2025, four days before the regulatory deadline. 

Following the scheme's initial deployment, the EPC identified several issues and inconsistencies and EPC published version 1.1 of its rulebook in March 2026.. Version 1.1 becomes effective on 20 September 2026, with further evolution already under way.  

This is significant because VoP is no longer simply an optional fraud-control feature. It has become part of the infrastructure surrounding Europe's instant-payment environment. 

And there is an important subtlety here: VoP does not move the money. The EPC describes it as a messaging and verification service rather than a payment instrument. Its job is to provide the payer with information before the payment is initiated. That distinction makes the logic very clear. Instant payments make the money move faster. VoP helps make sure the decision to move it is better informed. 

The rest of the world is taking different routes 

Europe is not alone. The idea of checking the beneficiary before a payment is made is spreading, but countries are adopting it in different ways. 

The UK was an early mover with CoP, introduced in 2020. Its model checks information such as the account name, sort code and account number and provides the payer with a response before the payment proceeds. 

Australia has now moved from implementation to experience. Its nationwide Confirmation of Payee service launched in July 2025, allowing customers to check whether the name, BSB and account number they enter match the information held by the receiving bank. By July 2026, Australians had used the service more than 150 million times, and its use was expanding beyond consumers into business payments. Australia's experience also provides an interesting real-world indication of the value of the check. By March 2026, one participating bank reported that more than 450,000 payments had been abandoned by customers after receiving a “no match” result, including more than 10,000 payments going to accounts listed on the Australian Financial Crimes Exchange. 

Canada is building CoP into its next-generation real-time payment infrastructure rather than adding it later. The forthcoming Real-Time Rail, scheduled to launch in Q4 2026, is designed to include CoP alongside central fraud analytics, a central risk list and central fraud reporting. That combination is particularly revealing. Canada is treating payee verification not as a standalone feature, but as one part of a wider real-time fraud-control framework.

India is taking a broad approach to beneficiary verification rather than using a single CoP/VoP scheme. On UPI, NPCI strengthened its rules in 2025 so that, for P2P and P2PM transactions, the payer sees the ultimate beneficiary’s banking name, fetched through the Validate Address API, rather than a name entered by the user or taken from a QR code. UPI apps must also prevent that name from being modified for the transaction. 

The same principle has now reached NEFT and RTGS. RBI required banks to introduce a beneficiary account-name look-up facility by 1 April 2025. When a customer enters the beneficiary’s account number and IFSC, the system retrieves the name held by the receiving bank and displays it before the transfer is initiated. 

India therefore illustrates an important point: CoP/VoP does not have to look the same on every payment rail. UPI, NEFT and RTGS use different mechanisms, but the objective is the same — give the payer reliable information about who is receiving the money before the payment is sent.  

This is where AI starts to become interesting 

None of this requires artificial intelligence. At its core, CoP or VoP is a verification exercise. The system checks whether the account and payee information correspond. 

But real payments are rarely as tidy as a database. Names can be abbreviated, spelled differently, written in different forms or entered with punctuation and formatting differences. A business could appear as “ABC Technologies Ltd.” in one place and “ABC Technologies Limited” in another. 

This is an area where intelligent matching can become useful. Instead of treating every difference as a mismatch, machine-learning techniques can help determine whether two pieces of information are likely to refer to the same person or business. That can make close-match decisions more useful and reduce unnecessary warnings. 

But the more interesting role for AI comes after that. 

Suppose the account name matches perfectly. A fraudster has persuaded a customer to change the beneficiary details of a regular supplier payment. The new account is genuine. The name matches. The CoP or VoP check therefore does exactly what it is supposed to do. Yet the payment could still be fraudulent. 

An AI-based fraud system can look at the wider context. Is this a newly added beneficiary? Is the payment much larger than usual? Has the customer's behaviour suddenly changed? Is the payment being made from an unusual device or at an unusual time? Does the account or transaction resemble patterns associated with known fraud? 

This creates a useful division of responsibility: 

CoP/VoP asks: “Does this account match the payee?” 
AI-powered fraud controls can ask: “Does this payment look like something this customer should be doing?” 

The two therefore complement rather than replace each other. 

Canada's approach illustrates this direction particularly well. Its forthcoming Real-Time Rail is designed to combine CoP with a real-time transaction safety score, a central risk list and central fraud intelligence. 

AI can also help earlier in the process. For business payments, it could extract supplier names and account information from invoices or payment instructions, compare them with previously used details and identify unusual changes before the payment reaches the CoP/VoP step. 

The principle, however, should remain clear: AI may improve matching and risk assessment, but it should not become the source of truth for who owns the account. The authoritative information still needs to come from the bank or other trusted account-holding institution.

A match does not mean a payment is safe  

Suppose a fraudster sends you a convincing message saying that your supplier has changed its bank account. You enter the fraudster's account details. 

The name matches. CoP or VoP may return a positive result. The system has not failed. It has confirmed that the account corresponds to the supplied payee information. It has not confirmed that the email was genuine, that the supplier really requested the change, or that the person communicating with you is trustworthy. 

This is why payee verification should not be described as a complete fraud solution. It is a specific control for a specific question. It can help prevent a customer from sending money to the wrong account because of a mistake. It can also disrupt some scams in which the fraudster's account does not match the identity the victim believes they are paying. But it cannot, by itself, determine whether an otherwise valid-looking payment is part of a sophisticated scam. 

That is where other controls — including transaction monitoring, behavioural analysis and AI-based fraud detection — continue to matter.

What happens when the payment itself is wrong? 

Now return to the three customers we started to distinguish. 

  • One customer accidentally types the wrong account number. 
  • Another is tricked into paying a fraudster. 
  • A third never authorised the payment at all because someone else gained access to the account. 

All three may end up with money in the wrong place. But they are not the same problem.

  • The first is a payment error. 
  • The second can be authorised push payment fraud, where the customer themselves was deceived into approving the transaction. 
  • The third is an unauthorised payment. 

That distinction matters because the controls, investigation and rules around responsibility can be different.

Payee verification mainly addresses the question: “Does the destination match the person you intend to pay?” It does not replace authentication, authorisation or fraud management. Instead, it fills a gap between them. 

The timing is what makes this powerful 

There is another reason CoP and VoP matter so much as instant payments become widespread. 

Suppose you discover a mistake two days after making a payment. There may be time to intervene. Now suppose the payment settles in seconds. The same mistake may already have become much harder to correct. 

This is why the industry is increasingly moving an important control upstream. Rather than waiting for a suspicious or incorrect payment to be detected after the money has moved, the system can ask a simple question while the customer still has a chance to stop: 

Does this destination make sense? 

That is a very different proposition from trying to recover the money later. 

Canada's Real-Time Rail design makes this especially explicit: payments will be immediate and irrevocable, while CoP and other fraud controls are positioned before or around the payment decision to reduce risk. 

There is a bigger lesson here 

CoP and VoP may look like niche payment terminology. They actually illustrate a much broader change in payments. 

A payment is not a single act. There are several questions along the way. 

  • Is this really the customer? That is authentication. 
  • Did the customer approve the payment? That is authorisation. 
  • Is the money going to the intended beneficiary? That is where CoP or VoP helps. 
  • Did the payment actually go through? That is execution. 
  • Can it still be stopped or recovered? That brings us to finality and recovery. 

These questions are connected, but they are not interchangeable. 

A payment can pass one test and fail another. The customer can be genuine. The authorisation can be genuine. The payment can execute perfectly. And the payment can still be wrong. 

That is why the rise of payee verification is more important than the acronym suggests. 

The real change is that payment systems are beginning to recognise that trust is not established simply by knowing who is sending the money. They also need to help the customer establish who is receiving it. 

And in a world where money can move almost instantly, that check may be most valuable at exactly the moment when it is easiest to overlook: before the money moves.