Confirmation of Payee

Confirmation of Payee (CoP) is a name-checking service used in the United Kingdom that compares the name a payer types in for a new recipient with the name held on the account identified by the sort code and account number. Before the payment is sent, the payer's bank shows whether the name matches, nearly matches or does not match. The service exists to reduce misdirected payments and fraud in which victims are tricked into paying an account controlled by a criminal. It is a type of name check.

CoP is operated under rules and standards set by Pay.UK, the operator of the UK's retail payment systems, and was made mandatory for the largest banking groups by the Payment Systems Regulator. It applies to payments sent through Faster Payments and CHAPS. The euro-area counterpart is Verification of Payee (VoP), and the general idea is covered under payee verification.

Before CoP, UK banks routed payments using only the sort code and account number. The name a customer entered was not checked, so a payment to the wrong account, whether through a typing error or a scam, went through without warning. The growth of authorised push payment fraud, where victims are persuaded to send money themselves, made this gap a policy concern. In 2019 the Payment Systems Regulator directed the six largest banking groups to introduce CoP, and the service went live across those groups during 2020. A later direction extended the requirement to several hundred more payment service providers, making name checks close to universal for UK account payments.

When a customer sets up a new payee or amends an existing one, the sending bank sends a request containing the entered name, sort code, account number and account type (personal or business) to the receiving bank. The receiving bank compares the details with its records and returns one of several outcomes:

• Match. The name and account type agree with the account, and the payment can proceed normally.
• Close match. The name is similar but not exact, or the account type differs. The payer is usually shown the actual account name and asked to check.
• No match. The name does not correspond to the account, and the payer is warned that the money may go to someone else.
• Unable to check. The receiving institution does not take part or the check cannot be completed, so the payer must decide without a result.

CoP does not block payments. The payer can still choose to proceed after a warning, but the result is recorded and can affect how responsibility is shared if the payment turns out to be fraudulent.

Participating firms include banks, building societies, electronic money institutions and payment institutions that provide accounts. Because the service reveals whether a name is attached to an account, it raises data protection questions. Responses are designed to disclose as little as possible, and firms are expected to watch for misuse such as automated checks used to harvest account details, a form of enumeration attack.

CoP has reduced payments made to the wrong account because of simple mistakes, and it has made some forms of impersonation fraud harder, especially those where a criminal claims to be a known company but gives an account in a different name. It is also used in business payment processes, where payment diversion fraud often involves a supplier's bank details being changed by a criminal.

Firms also use CoP results in their own fraud controls. A no-match response on a high-value payment to a new payee may prompt extra questions, a delay or a call from the bank, and repeated no-match checks from one customer can indicate that the customer is being coached by a fraudster.

CoP checks only the name. If a criminal opens an account in the name the victim expects, or uses a mule account held by a person whose name is given to the victim, the check returns a match and offers no protection. Many scams persuade victims to ignore warnings, for example by claiming that a no-match result is a technical fault. Some legitimate payments return a close match or no match because of trading names, joint accounts or abbreviations, which can cause warning fatigue. For these reasons CoP is treated as one layer of defence alongside fraud monitoring, customer education and reimbursement rules.

• Pay.UK
• Payment Systems Regulator