Payee verification and IBAN change fraud: how to protect your company's payments

Published on November 3, 2026 · The mitza.es team

If you have made a transfer since October 2025, you have probably seen a bank warning about the recipient's name. It isn't an error or a new fee: it is payee verification. For a business it has two sides. When you pay, it is a useful barrier against IBAN change fraud. When you get paid, a wrongly written name on your invoice can trigger warnings and distrust among your customers. This guide explains how it works, what it doesn't do and which internal controls really protect the money.

What payee verification is

It is a service that payment providers are required to offer, free of charge, on euro transfers, both standard and instant, since October 9, 2025, under Regulation (EU) 2024/886. Before you confirm the transaction, the system checks whether the name you typed for the recipient matches the holder of the account for the IBAN given and shows you the result. The Bank of Spain explains this on its bank customer portal.

The four possible results

• Match: the name matches the holder of the IBAN.
• Close match: there are small differences and the bank shows you the name under which the holder is registered.
• No match: the name doesn't match the account holder's name.
• Could not be verified: the check could not be completed.

You are the one who decides whether to continue. The Bank of Spain warns that if you go ahead with a “no match” or “close match” result, the money is sent to the IBAN you typed and may not reach the person you meant to pay, and that the bank is not liable for a transfer sent to the wrong recipient because of an incorrect identifier.

What verification does NOT do

• It doesn't check that the invoice is genuine. It only compares a name with an account holder.
• A “match” is not a guarantee. A criminal can open an account in the name of a shell company and make it match.
• It doesn't replace the IBAN: that is still the unique identifier of the account, and the Bank of Spain reminds us that the name check does not replace checking the IBAN.
• It doesn't detect that your supplier's email has been hacked.

When you pay: how to use the warning in your favour

1. Don't ignore a “close match” or a “no match”. Ask the supplier, through a channel you already know, what the exact name of the account holder is.
2. Confirm any IBAN change by calling a phone number you already had on file, not the one that appears in the email announcing the change.
3. Register suppliers with the name exactly as it appears on their account and keep that record.
4. If you pay with transfer files, ask your bank about file verification: the Bank of Spain says it is available and that, for those who are not consumers, it is optional; it lets you withdraw the payments with problems and send only the ones you authorise.
5. Two people, always, for supplier registrations, account changes and payments of significant amounts.

When you get paid: put the name right on your invoices

When your customers pay you by transfer, their bank will compare the name they type with the holder of your account. If the invoice shows a trade name and the account is in the name of the registered company, or the other way round, your customer will see a warning. This is a practical recommendation of ours, not a rule: show the IBAN on the invoice together with the exact name of the holder (the registered company name or, for freelancers, your first name and surnames as they appear at the bank), and let your customers know they will see that check.

IBAN change fraud (the fake invoice)

It works like this: you receive an email, apparently from a regular supplier, saying it has changed banks and sending an invoice with a new IBAN. Sometimes the email comes from an address almost identical to the real one; other times, from the supplier's real account, which has been hacked. You pay, and the money goes to the criminal's account. If nobody reviews the change, the scam is discovered when the real supplier asks for payment.

Signs that something is wrong: an account change right before a large payment, urgency, a request not to discuss the matter with anyone else, a slightly different email address, a tone different from the usual one, and accounts at unexpected banks or in unexpected countries.

Boss or CEO fraud

It is the same pattern with another face: a message that seems to come from management or a partner asks for an urgent, confidential transfer. The attacker impersonates the email or the name and exploits the pressure. The defences are the same as against IBAN change fraud: confirm through another channel, double authorisation and no exceptions for urgency.

Internal controls that stop these frauds

• Double authorisation and separation of duties (whoever registers the supplier doesn't authorise the payment).
• Verification call to a known number for any change in bank details.
• List of validated suppliers with IBAN and holder, with the date and the person who confirmed each change.
• Protected email: two-step verification and SPF, DKIM and DMARC configuration; we explain it in our comparison of Google Workspace and Microsoft 365.
• Short, regular training with real examples; you will find cases in our article on AI phishing and deepfakes and in the one on the reverse Bizum scam.
• Alerts and limits on business online banking.

If you have already paid a scammer

1. Call the bank immediately and ask them to try to recover the transfer; speed is what matters most.
2. Keep all the evidence: emails with full headers, invoices, the payment receipt and the messages.
3. Report it to Spain's National Police or the Guardia Civil and notify INCIBE (Spain's national cybersecurity institute) on 017.
4. Warn your real supplier through a reliable channel: their email may be compromised.
5. Review and change the access to email and banking, and turn on two-step verification.
6. Consult your advisor if personal data is involved, because of the possible obligation to notify a breach.

Quick questions

Is it mandatory to do the verification?

Payment providers must offer it; the payer decides whether to continue with the transfer even if the result is not a match. That is why internal controls matter more than the warning itself.

Does it affect recurring or scheduled transfers?

The Bank of Spain information we have consulted doesn't go into detail on this. Ask your bank how it applies to recurring transfers and to those you already had scheduled.

What if my customer tells me they get a warning when paying me?

Check that the holder's name shown on your invoice is exactly the one on the account and send it to them through a channel you both know. It is better to resolve it than to ask them to ignore the warning.

How we can help at Mitza

We help you protect the email and the access from which invoices are sent and payments are authorised, and define a simple double-control process for your team. See our IT maintenance service or write to us from the contact page.