The short answer: verifying your payment method and verifying the payee are two separate checks. Verifying your payment method asks whether the card, account or wallet you are paying from is valid and can be used. Verifying the payee asks whether the account you are paying into belongs to the person or business you named. You need both, and they are not interchangeable.
The confusion is understandable. Both appear as a step in the same checkout or banking flow, both are described as 'verification', and both feel like safety. But they sit on opposite sides of the payment: one guards the money leaving, the other guards the money arriving.
What verifying your payment method actually checks
When a shop, a subscription service or a payment page verifies your payment method, it is checking the instrument you are paying with. Typically that means some combination of the following:
- That the card number is well formed and the expiry date is in the future.
- That the card or account exists and is open, via a small authorisation or a zero-value check.
- That you control the instrument - a one-time code, an app approval, or a biometric confirmation.
- That the instrument is allowed for this payment: the right currency, the right country, enough available balance or credit.
All of that is useful, and none of it tells you who you are paying. A card can be perfectly valid, in your name, with plenty of credit, and still be used to send money to an account that has nothing to do with the invoice in front of you.
Two sides of the same payment
Your payment method is the door the money leaves through. The payee's account is the door it arrives at. Verifying one door says nothing about the other - and fraud usually walks in through the second.
What verifying the payee actually checks
Verifying the payee is a different question, asked at a different moment. In the EU the check is called Verification of Payee (VoP). It runs on the SEPA scheme, and it works like this: your payment service provider (PSP) - your bank or payment institution - sends the payee name and the IBAN to the PSP that holds the destination account. That bank compares the name you supplied with the name registered on the account and returns a standardised answer, usually in well under a second.
Nothing about your balance, your card or the amount is shared. Only the name comparison travels. The result is one of four outcomes:
- Match - the name agrees with the account holder. Proceed with normal confidence.
- Close match - the names are similar but not identical, for example a missing middle name or a trading name against a registered name. The verified name comes back so you can confirm or correct it.
- No match - the name does not belong to that account. Stop and re-check the details through a channel you trust.
- Not available - the payee's bank could not answer at that moment. Neither good nor bad news; treat a new, unverifiable payee with extra care.
The check is advisory. It warns you; it does not block the payment. That is deliberate, because the decision to send stays with you - and it is exactly why the check works against scams that rely on you being convinced.
Why the two get confused
Three things push people towards the wrong check. First, the words: 'verify', 'validation' and 'confirmation' are used for both. Second, the moment: both happen just before you press pay, so they feel like one step. Third, the reassurance: a green tick on your card feels like a green tick on the payment, and it is not.
There is a third check that gets mixed in too: IBAN validation. That only confirms the account number is well formed - the right country prefix, length and check digit. It tells you the IBAN could exist. It does not tell you who owns it. A fraudster's IBAN passes validation every time.
The order to run them in
- 1 Confirm who you are paying, not just how. Read the payee name on the invoice or contract and check it against the name you have on file.
- 2 Run the payee name check and read the result before you confirm - not after.
- 3 On a close match, accept the verified name the check returns rather than overriding it.
- 4 On a no match, stop. Call the payee on a number you already had, never one from the message that gave you the new bank details.
- 5 Then complete your own payment method verification - the code, the app approval, the biometric - knowing the destination is right.
- 6 Keep the result with the payment record, so you can show what you checked and when.
The order matters. If you authenticate first and check the payee second, you have already done the part that proves it is you - and a scam victim passes that part perfectly. Checking the destination first means the authentication confirms a payment you actually want to make.
If you are paying as a business
Finance teams meet the same two questions at scale. Payment method verification is usually handled by the bank or the payment platform: the account is open, the mandate is in place, the file is authorised. Payee verification is the part that needs a process, because supplier, payroll and payout IBANs change, and a change is exactly what invoice redirection fraud exploits.
The practical pattern is to verify the whole payment file before release rather than checking payees by hand, and to re-verify when a supplier's bank details change. That catches the email that says 'our account has changed' before the next payment follows it.
Where the obligation comes from
Verification of Payee is mandated by the EU Instant Payments Regulation. Euro-area PSPs have had to offer it on euro credit transfers since 9 October 2025, and PSPs in non-euro EEA states follow by 9 July 2027. It must be free to the payer, and it covers euro credit transfers initiated electronically - standard SEPA transfers as well as instant payments.
RoxPay delivers Verification of Payee on the SEPA scheme through one REST API and a dashboard, returning the standardised outcomes - match, close match, no match and not available - in well under a second, with the verified name on a close match, for a single payment or a whole payment file.