Confirmation of Payee (CoP) is a hot topic that’s certainly been attracting a lot of attention with articles in the last month or so in the National Press – Express, Daily Mail, and most recently the Guardian. All these articles pretty much say the same thing: everyone needs Confirmation of Payee.

So, what is all the fuss about? Let’s take a step back and consider why there has been so much publicity about what appears to be a pretty dry topic.

First, what is it? Simple really – when you transfer money into someone else’s account you are used to giving the account number and sort code, right? With CoP you also must give the holder’s correct name. This significantly reduces something called ‘Authorised Push Payment’ (APP) fraud.

APP fraud exploits the fact that us humans know names, but we don’t pay so much attention to numbers. For example, a fraudster finds out (hacking, buying stolen information, etc.) I’m buying a house and my solicitor is ‘Grabbit and Runn’. The fraudster sends me a spoof invoice pretending to be from the solicitor and demands an urgent payment – a deposit for example.  Except of course the sort code and account numbers are not the right ones. The money is transferred to the fraudsters account, and most likely lost for ever.

To counter this, in 2019 the UK’s largest banks were ordered by the Payments Regulator to introduce a name check on transfers, in addition to the usual account number and sort code, by March 2020. This makes the fraud scenario much less feasible, because creating a ‘spoof’ account with the correct name as well is difficult – and of limited use to the fraudster. The deadline was extended due to COVID, but the six largest went live in June 2020, along with some challenger bank volunteers such as Monzo, Starling and Revolut.

What happens when you enter the account name as well as the other account details varies. Four things can happen:

1. If you gave the correct account name, it’s a full match and the payment goes ahead automatically.
2. If the name you gave is close, you may be given the name the bank has on file for you to decide whether to go ahead or check with the payee (recommended).
3. If you give the wrong name, you’ll be told it doesn’t match, and you should check before progressing any further.
4. If the payee’s bank doesn’t offer the CoP service, then you’ll be told the name cannot be matched.

Consumer group ‘Which?’ believes CoP should be mandatory for all payment providers, but so far no mandates beyond the initial one in June 2019 have been issued by the Payments Regulator.  Consequently, coverage remains patchy, and growth of this vital service is gradual. 

Attitudes amongst banks currently without CoP vary. Many are keen to put the service in place, but unsure about how to progress and are fearful of the cost. There is, however, support available from a variety of sources – Open Banking, the administering organisation Pay.UK, and of course our own Confirmation of Payee Network which is a free, independent advice service.

Some are reluctant, fearing it’s too big and expensive a job in these pandemic days. This isn’t actually true, because there are now 10 providers willing and able to build a service, some specifically designed for the smaller operator. Furthermore, they are likely to be ‘bitten’ at some point; there is anecdotal evidence of fraudsters concentrating their efforts on these more vulnerable institutions. Customers increasingly expect the service and the user experience of the ‘Cannot Check’ response is poor – to many it means ‘don’t pay’. It’s a bit ironic that these reluctant participants are typically smaller banks who like to present themselves as the ‘nimble challengers’ to the incumbents, when they now offer a poorer service. There’s only one group who benefits from that arrangement – the large banks.

Other payment providers are actually stuck. Many building societies, for example, would love to offer CoP, but are unable because they use ‘roll numbers’ rather than the differently-formatted ‘account numbers’. Ironically, roll numbers were in the original specification, but optional – which meant nobody did it (with one exception, Nationwide). They now need to wait for ‘Phase 2’, which is not fully available until mid-2021. We can reveal though that the technical changes required within the open banking architecture underpinning CoP went live in early March this year. The internal technical job is done – so why the delay?

Consequently, large sections of the public remain unprotected and APP fraud continues. Nothing will ever defeat fraud – it’s a never-ending war. However, more could be done to protect customers.  Regulators could do more to speed up the process, maybe even issue more mandates. Technically the infrastructure is in place and the wide choice of solution providers can make CoP implementation much easier.

With regular articles in the national press, it’s a hot topic – let’s get on with it!

[The author of this article, Dr Anthony Evans, is Director of Open Banking Delivery, and runs an independent CoP Network group, offering free advice to all interested parties]

Helen Child, Founder & CEO, Open Banking Excellence