In an authorised push payment (APP) scam, there is no stolen card and no hacked password. The victim is manipulated into sending money themselves - to a fake supplier, a spoofed 'safe account', or an invoice with the fraudster's IBAN swapped in. Because the customer approves it, most fraud engines never fire.
Why the IBAN alone is not enough
Traditional overboekings validate the IBAN's format and routing, but never check who actually owns the account. A fraudster's IBAN is perfectly valid, so the payment sails through. The one piece of information that would expose the scam - does this name belong to this account? - is exactly what is missing.
The common weakness is the name
Whether it's invoice redirection, CEO fraud or a romance scam, they all share one trait: the account does not belong to who the victim thinks. Verifying the payee name is the single most direct countermeasure.
How Verification of Payee breaks the chain
VoP asks the payee's bank, in real time, whether the name matches the IBAN - and shows the answer to the payer before they authorise. The four standard outcomes double as fraud signals:
- Match - name and account agree; the expected, low-risk result.
- Bijna overeenkomst - a small difference; confirm before paying.
- Geen overeenkomst - the classic red flag: the account does not belong to the named payee. Stop.
- Not available - treat an unverifiable new payee with extra caution.
A warning at the only moment that counts
The power of VoP is timing. The warning appears at the point of payment, while the victim still controls the money - not in a fraud report the next day. That clear, well-timed signal is often enough to break the spell of social engineering.
RoxPay delivers this check on the SEPA VoP scheme via API and dashboard, so banks, PSPs and businesses can put a payee name check in front of every euro overboeking and cut APP-fraud losses. With VoP mandatory for euro-area PSPs since October 2025, the check is becoming a standard part of every payment flow.