Verification of Payee (VoP) is the real-time check that matches a payee's name to their IBAN before a…
Craig M. — Chief Product Officer @ Cyberr®
Verification of Payee (VoP) is the real-time check that matches a payee's name to their IBAN before a transfer is sent. The green tick is not a verification. It is an answer from whoever programs the response.
VoP went mandatory in the euro area last October. The UK has had CoP since 2020. Both exist to stop you paying an account not held by who you think. Here's how it fails.
The attack pattern. An investment scam, initiated via paid @Meta (Facebook) ads, @WhatsApp and remote-access software, directed a close to six-figure sum to an account held within a @Financial Conduct Authority regulated payment services provider serving crypto businesses.
Within minutes of first contact operators harvested the victim's identity documents as "verification". The receiving account appears to have been opened with them. This is how a "personal" account in the victim's name came to exist at a business-only PSP. The victim was told it was their own trading wallet. Every transfer passed Confirmation of Payee: "all details match", personal, victim's name.
The institution later stated the account belonged to a company based in Lithuania. The Bitcoin wallet on the "orders" had never transacted on-chain, so the funds most likely never left the regulated system.
The test. I re-checked the account in August ‘26. Full match, personal, victim's name. Nineteen minutes later I sent it 1p. Declined: account closed, and it had been since October ‘25. If a responder cannot tell you whether an account exists, it cannot tell you whose it is.
The likely mechanism. This institution (the PSP) sells virtual IBANs. A vIBAN is a routing label on top of a master account. Ask "is this account held by [name]?" and the responder answers the label, not the legal owner. KYC passes because the documents are real. VoP passes because the label matches.
A hypothesis, but the only one that fits everything the firm has said. Account records would settle it.
Why this matters for VoP. Same design: the payee's PSP answers the question. A match is a claim by the receiving institution, not an independent verification. vIBANs, sub-accounts, stale status data and stolen-identity onboarding all produce a green tick. VoP arguably makes it worse: the label now carries regulatory-grade reassurance.
What to do:
1. Treat a match as necessary, never sufficient.
2. If you build or audit a VoP responder: does it check account status, and does it return the legal owner or a label?
3. Identity documents requested for "verification" before money moves are the raw material for the receiving account. Treat the request as the attack.
4. Investigators: run your own VoP or CoP check, then a 1p probe, and timestamp both. The gap is evidence.
5. A "personal" account at a business-only PSP is a question, not a data point. Ask who opened it, on whose instruction, and whether the documents came from the person they belong to.
3 reactions · 2 comments
Comments
Scott D.: Interesting. I have to review this further Craig but thank you for this overview.
Ben N.: Interesting!