Craig M.

Sep 30, 2026

Verification of Payee (VoP) is the real-time check that matches a payee's name to their IBAN before a transfer is sent. The green tick is not a verification. It is an answer from whoever programs the response.

VoP went mandatory in the euro area last October. The UK has had CoP since 2020. Both exist to stop you paying an account not held by who you think. **Here's how it fails**.

The attack pattern. An investment scam, initiated via paid @Meta (Facebook) ads, @WhatsApp and remote-access software, directed a close to six-figure sum to an account held within a @Financial Conduct Authority regulated payment services provider serving crypto businesses.

Within minutes of first contact operators harvested the victim's identity documents as "verification". The receiving account appears to have been opened with them. This is how a "personal" account in the victim's name came to exist at a business-only PSP. The victim was told it was their own trading wallet. Every transfer passed Confirmation of Payee: "all details match", personal, victim's name.

The institution later stated the account belonged to a company based in Lithuania. The Bitcoin wallet on the "orders" had never transacted on-chain, so the funds most likely never left the regulated system.

**The test.** I re-checked the account in August ‘26. Full match, personal, victim's name. Nineteen minutes later I sent it 1p. Declined: account closed, and it had been since October ‘25. If a responder cannot tell you whether an account exists, it cannot tell you whose it is.

**The likely mechanism.** This institution (the PSP) sells virtual IBANs. A vIBAN is a routing label on top of a master account. Ask "is this account held by [name]?" and the responder answers the label, not the legal owner. KYC passes because the documents are real. VoP passes because the label matches.

A hypothesis, but the only one that fits everything the firm has said. Account records would settle it.

Why this matters for VoP. Same design: the payee's PSP answers the question. A match is a claim by the receiving institution, not an independent verification. vIBANs, sub-accounts, stale status data and stolen-identity onboarding all produce a green tick. VoP arguably makes it worse: the label now carries regulatory-grade reassurance.

**What to do:**

1. Treat a match as necessary, **never** sufficient.

2. If you build or audit a VoP responder: does it check account status, and does it return the **legal owner** or a label?

3. Identity documents requested for "verification" before money moves are the raw material for the receiving account. Treat the request as the attack.

4. **Investigators:** run your own VoP or CoP check, then a 1p probe, and timestamp both. The gap is evidence.

5. A "personal" account at a business-only PSP is a question, not a data point. Ask who opened it, on whose instruction, and whether the documents came from the person they belong to.

View post

Aug 5, 2026 · Reshared

Level Up: Certification Training Is Coming to Cyberr

The cybersecurity landscape doesn't wait and neither should your career.

We're excited to announce that certification training is coming soon to the Cyberr platform.

Registration is live, go to cyberr academy in the menu

Choose the certification that matches your goals.

Built for professionals who want to stay ahead, not catch up.

This is just the beginning of what we're building for our community. Stay tuned, more details drop shortly.

View post

Aug 4, 2026 · Reshared

If you want to offer services through Heelr, it's four things:

1. Verify your profile on Cyberr

2. Go Premium

3. Upload your certs

4. Build your expertise card on Heelr

Takes about 10 minutes if you have your certs handy, longer if you have to dig through email to find them (most people do).

Then you're in. Companies searching for cybersecurity services see your card, they reach out, you talk. That's the whole model.

View post

Jul 16, 2026

Heelr — Cyberr Marketplace (Beta)

Heelr is live in limited beta — the cybersecurity marketplace by Cyberr.

Vetted providers can list services, get discovered, and start earning through Cyberr's trusted network. General browsing, fees, and buyer flows unlock as we onboard the first supplier cohort.

• Providers: /marketplace/become-provider — categories, services, intro video, references, day rate.

• Public preview of your listing shareable outside Cyberr.

• Announced on your feed automatically when you publish.

Full guide: /help?article=heelr-beta

View post

Jun 12, 2026

📰 Over 73,000 French govt employees affected in Tchap messenger breach

https://www.bleepingcomputer.com/news/security/french-govt-says-tchap-breach-affected-over-73-000-accounts/

via BleepingComputer · 🛡️ Powered by Cyberr Threat Intelligence — cyberr.ai/?tab=news

View post