Consumers get most of the headlines, but the biggest single losses from misdirected payments hit businesses. A fraudster emails a convincing 'updated bank details' notice, your accounts-payable team updates the supplier record, and the next payment run sends real money to the wrong account.
Where the risk lives
Two moments are especially exposed:
- Supplier onboarding — when bank details are first captured, often from an email or PDF.
- Bank-detail changes — the classic vector for invoice-redirection and CEO fraud.
- Payroll changes — a redirected salary is easy to miss until the employee complains.
Approvals are not verification
A second approver checks that a payment should be made — not that the account belongs to the right payee. Verification of Payee answers the question approval can't: does this name match this IBAN?
A simple verification routine
- 1 At onboarding, verify each new supplier's name against the IBAN before the record is activated.
- 2 Re-verify whenever bank details change, and treat a 'no match' as a hard stop pending a call-back on a known number.
- 3 Before each payment run, batch-verify the file so any mismatched or unverifiable payee is flagged before release.
Doing it at scale
Checking IBANs by hand doesn't scale to hundreds of suppliers. Verification of Payee can be called per record through an API, so an entire payment file is verified automatically — match, close match, no match or not available — before anyone clicks 'release'.
RoxPay makes this available from the RoxBusiness dashboard for ad-hoc checks and via a REST API for bulk verification, so treasury teams can build a name check into their payment workflow without a heavy integration.