UK payments · checked 18 October 2026
Confirmation of Payee and APP fraud refunds for UK businesses
When you set up a new payee, your bank checks the name you typed against the account holder's name and tells you the result. That check, Confirmation of Payee (CoP), is the best warning you'll get about a fake "new bank details" email. And if you're a small business that's tricked anyway, you may be able to get the money back.
The four Confirmation of Payee results
| Result | What it means | What to do |
|---|---|---|
| Match | The name matches the account | Pay, if the change was verified by call-back |
| Close match | Nearly the same; your bank shows you the real name | Compare it with the supplier's legal name before paying |
| No match | The account belongs to someone else | Don't pay. Call the supplier on a number you already had |
| Unable to check | The receiving bank couldn't answer | Treat it as unverified |
Close matches are common for businesses, because suppliers often trade under a different name from the one on their bank account. That's exactly why fraudsters like them: the warning is easy to wave through. Check the name your bank shows against the supplier's invoice and Companies House record.
Can your business get its money back?
Since 7 October 2024, UK banks and payment firms must reimburse victims of authorised push payment (APP) fraud, where you were tricked into sending the money yourself. The rules cover:
- Individuals
- Microenterprises: fewer than 10 staff, with annual turnover or balance sheet total of no more than €2 million
- Charities with annual income under £1 million
Larger businesses aren't covered, so for them the call-back check is the only real protection.
| Rule | Detail |
|---|---|
| Payments covered | UK Faster Payments and CHAPS transfers made on or after 7 October 2024 |
| Maximum | £85,000 per claim (firms can pay more) |
| Excess | Firms can deduct up to £100 |
| Time limit | Report within 13 months of the payment |
| Speed | Usually within 5 business days; at most 35 if the firm needs more information |
| Main exception | Gross negligence or being complicit in the fraud. The regulator calls gross negligence "a high bar" |
Paying after a "no match" warning without checking could be argued as gross negligence, so a written call-back record protects your claim as well as your money.
If you've just paid a fraudster
- Call your bank's fraud line straight away. Ask them to recall the payment and to log an APP fraud reimbursement claim.
- Report it to Action Fraud (England, Wales and Northern Ireland) or Police Scotland.
- Keep the emails, invoice, CoP result and your notes of any call-back. Full first-24-hours checklist.
- If the bank refuses, you can complain to the Financial Ombudsman Service.
A routine that makes CoP work
- Treat every bank-detail change by email as unverified, whatever CoP later says. How to verify a change.
- Call back on a number you already had, never one in the email.
- Have a second person approve the change and the first payment.
- Stop any payment that comes back "close match" or "no match" until it's explained.
Paying in euros? EU Verification of Payee. Paying in the US? There's no universal name check.
Sources: Payment Systems Regulator, APP fraud reimbursement protections (who's covered, £85,000, £100 excess, 13 months, 5 and 35 business days, gross negligence); Payment Services Regulations 2017 (microenterprise and charity definitions); Revolut, new protections for APP scam reimbursement. Read 18 October 2026.
Check a suspicious email free Set up call-backs and approvals