Confirmation of Payee (CoP) Regulation: All You Need to Know

This article is written by Trustpair

The CoP was launched in 2020 to lower payment fraud and errors in the UK. Today, 90% of faster payment methods are managed by the CoP. The EU will introduce similar Eurozone regulations, such as the Validation of Payee (VoP). This will develop further, so keep reading to learn what you need to know about the Confirmation of Payee regulation. Trustpair is an anti-fraud software that goes beyond the CoP. Our solution protects your company from third-party fraud, even with international suppliers, thanks to automated account validation.

What is confirmation of payee?

Confirmation of Payee (CoP) is a verification system that checks if the name on the bank account matches the name of the intended recipient. CoP is used in the UK for digital payments for both personal and business accounts. To ensure the information is correct, users have to go through it when they:

  • Send a transfer to a new payee.
  • Establish a new standing order or direct debit.
  • Update the payee sort code account number to other credentials.

The goal of the confirmation of payee regulation? To lower transfers sent to the wrong account, either through:

  1. Typing mistakes when entering the bank account details (sort code, bank account numbers, and name).
  2. Scams luring victims into sending money, like with Authorized Push Payment (APP) fraud.

WEBINAR ALERT: Fighting Fraud in 2025: Are You Ready for the Next Generation of Threats?

Over 70% of businesses have experienced fraud attempts, and the financial impact continues to rise. As fraud tactics become more sophisticated, relying on outdated prevention strategies simply isn’t enough.

Join Tom A. (Senior Fraud Consultant UK at Trustpair) and our very own Royston Da Costa (Assistant Treasurer at Ferguson PLC) on February 20, 2025, at 11:00 AM for an essential webinar that will equip you with the latest insights and strategies to protect your organization from evolving AI-driven fraud threats. Moderated by Patrick Kunz, FRM QT

What you’ll learn:

  • How cyber fraud is evolving with real-world AI-driven scams
  • Why confidence gaps in fraud detection are widening and what it means for finance leaders
  • How to leverage technology for real-time fraud detection
  • Why breaking down organizational silos is crucial for effective fraud prevention

This session is tailored for finance professionals, treasury leaders, and risk managers who want to stay ahead of fraud risks.

How does CoP work?

The Confirmation of Payee regulation is quite straightforward. When entering a new recipient’s bank details, the payor must indicate the recipient’s name. The CoP services then check account details to ensure the name matches the bank’s records.

The system will carry out this verification automatically (and instantaneously) and will come back to the sender with a response.

There are four main possible answers:

  1. YES: all details match (sort code, account number, name).
  2. NO, BUT CLOSE: the name indicated is a close match (e.g., John Smith instead of John Smithh), which is likely due to a typo.
  3. NO: The account name doesn’t match account records.
  4. DATA UNAVAILABLE: There was a system error, or the account isn’t valid.

If the entered information doesn’t match the account, the payment initiator is then asked if they want to proceed with their transfer. This additional step creates another layer of protection against mistakes and fraud.

While the payment sender always has the final say, the confirmation of the payee puts the onus onto the payer to double-check payment details. They need to pause and ask themselves if they really trust the recipient in case of inconsistency (answers 2, 3, and 4) and assume responsibility for their decision.

To be effective, confirmation payee CoP must happen before the payment is initiated and processed by the banking establishment. It’s a peer-to-peer service with no centralized infrastructure, which works through an API.

What is the CoP calendar?

The Confirmation of Payee regulation was introduced in the UK in 2020. Originally, the CoP only applied to mobile and online payments. Its scope has broadened with the years, demonstrating the intention of making more payment methods secure.

The confirmation payee first became mandatory for the six largest banks in the country in June 2020, as specified by the Payment Systems Regulator (PSR). A few waves of integrating more banking establishments into the CoP followed throughout the years.

More than 400 payment service providers (PSPs) have now adopted the CoP. All PSPs handling faster payments and CHAPS (Clearing House Automated Payment System) are due to abide by the CoP standards by October 2024.

Every day, about 2 million checks are completed on the CoP in the UK. Over 90% of faster payments (instant payment methods up to 24 hours) are managed through the system. It is now widely recognized as an anti-fraud tool and is due to be adopted in the EU through the Validation of Payee (VoP) regulation.

Which banks are part of the confirmation of payee regulation?

The Confirmation of Payee regulation was set up by the Payment Systems Regulator PSR in the UK. Its goal: reduce fraud misdirected payments in the country.

This interbank system is managed by Pay.UK and works directly and indirectly with customers and payment service providers. While many big banks (such as Barclays, Halifax, HSBC, and Nationwide) were mandated to join in 2020, many have followed since.

The PSR regularly produces new directives calling for more banking establishments to implement CoP regulations. Payment service providers can also choose to join the regulation of their own accord by working with aggregators such as SurePay, Bottomline, and Banfico.

Those systems connect third-party banking establishments, customers, and businesses to the Pay UK CoP system. It allows smaller actors to benefit from the CoP’s added safety without having to wait. In the EU, the arrival of PSD3 will change the regulatory landscapes, no doubt including the VoP for all SEPA payments.

Why is the confirmation of payee regulation not enough to stop fraud?

An incomplete protection

While the Confirmation of Payee regulation was much needed to prevent push payment APP fraud, it isn’t enough to protect businesses against fraud. CoP only checks if the name on a recipient’s account matches with the intended beneficiary. That’s not nearly enough protection against common types of B2B payment fraud, where scammers come up with elaborate payment schemes.

For example, in vendor fraud, criminals can create a fake company and ask you to pay for invoices for services or goods never delivered. The CoP would come back clear because the information matches, but it doesn’t help to check if the transaction is legal or legitimate.

Moreover, the CoP regulation only covers transfers sent to the UK. For companies with international suppliers, this creates a massive security gap. Scammers often have bank accounts located abroad, meaning the CoP doesn’t actually protect you against cybercriminal activity. Lastly, CoP still requires manual validation of payments—a task that’s both inefficient and error-prone.

Using Trustpair for 100% fraud protection

Fortunately, there is a solution that covers all the failings of the CoP and provides complete protection: Trustpair. Trustpair is an anti-fraud software that secures your payment chain from end to end.

Our solution automatically checks your suppliers’ bank account information to ensure your recipients are who they say they are.

Our software uses three-way matching to establish:

  • The bank account exists and is valid.
  • The name is correct.
  • Both sets of information match.

Where CoP only does a name match, we go in-depth to ensure the validity and legitimacy of the bank account you’re about to send funds to. We go further than CoP as we check account credentials against international databases—making working with vendors abroad 100% safe.

The automated account validation is done in real-time, in the background, so you always know who you’re paying. We use AI to identify suspicious activity and stop any fraudulent-looking transfer from being sent. Using Trustpair is safer and quicker than using manual validation methods such as the CoP validation. 

Key Takeaways:

  • The CoP is a UK-based regulation that prevents push payment fraud and payment misdirections.
  • It’s enforced by PSR and managed by PayUK.
  • Most PSPs in the country use CoP nowadays.
  • While useful, this regulation isn’t enough to efficiently protect your business against third-party fraud.
  • Use Trustpair to ensure you send money to the right recipients, not criminals.

Read More from Trustpair

Join our Treasury Community

Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click [HERE] or fill out the form below.

Check our other blogs

This article is written by our partner, Nilus

Cash flow forecasting in treasury fails structurally, not occasionally. Here are the 5 root causes, what driver-based AI forecasting actually does, and what a 30% accuracy improvement is worth in dollar terms.

Cash flow forecasting is the process of predicting a company’s cash inflows and outflows over a defined horizon – typically 13 weeks (short-term operational) or 12 months (strategic planning). Accurate forecasting requires integrating data from A/R, A/P, payroll, FX, and banking sources – and knowing which inputs are most likely to shift.

Here’s an uncomfortable truth most treasury professionals already know: the forecast is wrong. Not occasionally. Structurally, predictably, every single week. The question isn’t whether it’s wrong – it’s whether you can explain why it’s wrong before someone else points it out.

In 2026, that question has become significantly more consequential. Rising interest rates mean idle cash carries a real opportunity cost. PE sponsors and senior lenders require covenant-compliant forecasts as a contractual obligation, not a best-practice exercise. And boards – having watched CFOs get blindsided by cash crunches in 2022 and 2023 – are holding finance leaders accountable not just for forecast direction, but for forecast variance. “We were directionally right” doesn’t land the same way it used to.

This piece is an honest attempt to explain why forecasting fails, what driver-based AI forecasting actually does (as opposed to the breathless marketing claims you’ve already dismissed), and what a 30% improvement in accuracy is actually worth in dollar terms. No crystal balls. No transformation promises. Just the math.

  • 30%+ – Average forecast accuracy improvement for Nilus customers
  • 4-8 hrs – Typical weekly time to build a manual 13-week forecast
  • <30 min – Exceptions-only review time with AI-native forecasting
  • $5.5M – Stagnant cash identified and optimized at Optibus

What Is a 13-Week Cash Flow Forecast?

The 13-week cash flow forecast is the workhorse of treasury operations – and one of the most misunderstood documents in finance. Let’s be precise about what it actually is, because the details matter for everything that follows.

The 13-week horizon isn’t arbitrary. It spans exactly one fiscal quarter – short enough that the inputs are grounded in real transaction data (not budget assumptions), and long enough to support covenant monitoring, revolver management, and operational liquidity planning. If you’re running tighter, you can’t see around corners. If you’re running longer, you’re kidding yourself about the precision.

A complete 13-week forecast includes:

  • Beginning cash balance – your actual bank positions at the start of the period
  • Operating inflows – customer collections, primarily driven by A/R aging and historical payment behavior
  • Operating outflows – payroll, vendor payments (A/P), rent, and other recurring operating costs
  • Investing activity – capex, asset sales, and similar non-operating cash movements
  • Financing activity – debt service, draws or repayments on revolving credit facilities, equity transactions

One thing that trips people up: the 13-week forecast uses the direct method – it models actual cash transactions, not accounting income. FP&A typically builds their forecasts using the indirect method, starting from net income and adjusting for non-cash items.

These two methods answer different questions. Treasury needs to know when cash actually moves; FP&A needs to know what the P&L looks like. Translating between them is one of the most friction-generating handoffs in corporate finance – and a root cause of forecast error we’ll return to shortly.

When is a 13-week forecast required?

Always, ideally. But contractually, it’s typically required in three scenarios: PE portfolio company covenant packages (weekly submission is standard), revolving credit facility compliance monitoring, and IPO readiness (SOX preparation requires demonstrable financial controls, and a documented weekly cash forecasting process is part of that).

The 13-week forecast connects to the 12-month rolling forecast – the strategic layer used for board reporting, M&A planning, and long-range liquidity modeling. Best practice is to run both, integrated, so actual weekly cash signals continuously inform the strategic model. Most mid-market companies only have one or the other. That’s a gap worth closing.

Why Cash Flow Forecasts Are Always Wrong – 5 Root Causes

Here’s the thing: your forecaster is probably quite good at their job. The forecast is wrong because of architecture, not ability. Here are the five structural reasons it keeps happening:

  • A/R timing is guesswork. Collections are the single largest variable in any cash forecast, and they’re also the hardest to pin down. A/R teams provide their “expected” payment dates – but actual payment timing is driven by customer behavior: payment terms, relationship dynamics, invoice age, and whether accounts payable at the other end is running smoothly. Most companies have no systematic way to model collection timing based on historical payment patterns at the customer or invoice level. So they guess, optimistically, and variance accumulates.
  • A/P data is stale by the time it arrives. By the time A/P has processed an invoice and it enters the forecast, the cash impact has often already shifted. An unexpected early payment approval or a late vendor authorization is invisible to treasury until it clears the bank. The forecast says one thing; the bank says another. Post-mortem ensues.
  • FP&A and treasury speak different languages. FP&A builds revenue forecasts in accrual terms. Treasury needs cash-basis timing. Translating between them requires manual conversion, and the conversion is always lagging. FP&A’s numbers are typically three weeks old by the time they reach treasury, because they’re on a monthly close cycle. Treasury is trying to forecast this week’s collections using inputs that haven’t been updated since last month.
  • FX moves faster than spreadsheets. For companies with multi-currency operations, FX exposure is a continuous source of forecast error. A 2% move on a €20M receivable generates $400K in cash variance. Most Excel-based forecasting processes update FX rates once a week, at best. By then, the rate you used for last week’s forecast is already stale.
  • Inputs are collected manually. Email threads. Spreadsheet attachments. Slack messages asking A/P for their payment run. Every manual handoff is a delay, and every delay means the forecast is built on data that reflects last week’s reality, not today’s. By the time the forecast is assembled and formatted for distribution, half the inputs have already moved.

The bottom line

The problem isn’t the forecaster. It’s the architecture. A skilled treasury analyst running a manually-collected, weekly-batch forecasting process is operating at a structural disadvantage – not because of skill gaps, but because the data pipeline they’re working with was designed for a world that no longer exists.

Traditional Forecasting vs. AI-Native Forecasting

Let’s put the comparison on paper, because the differences aren’t cosmetic.

DimensionExcel / ManualAI-Native (Nilus)
Data freshnessWeekly batchReal-time, continuous
A/R input sourceManual submission from A/R teamAutomated from ERP + bank data
FX rate updatesWeekly manual refreshLive market rates
Forecast horizon13-week only (usually)13-week rolling + 12-month integrated
Variance explanationManual post-mortem (if it happens)Automated driver attribution
Accuracy vs. baselineBaseline30%+ average improvement
Build time per week4-8 hours<30 minutes (exceptions-based review)
Board-readinessManually formatted and summarizedAuto-generated board summary
Audit trailNone – spreadsheet history is not an audit trailFull input lineage and approval timestamps
Multi-entity / multi-currencyPainful consolidationNative support

The column that matters most to most CFOs: variance explanation. Not because they can’t do a post-mortem manually – they can – but because the post-mortem happens after the board meeting, not before it. Driver attribution turns that sequence around. You walk into the room already knowing why the forecast changed. That’s a different conversation.

What Driver-Based Forecasting Actually Means

If you’ve made it this far and you’re still skeptical about AI forecasting claims, good. That skepticism is well-earned – the space has been oversold relentlessly. So let’s be very specific about what driver-based forecasting does and doesn’t do.

It does not predict the future. No system does. Your customers’ payment behavior is influenced by factors no model will ever fully capture.

What it does do is systematically identify which inputs changed and quantify their impact on the forecast. That’s the entirety of the value proposition – and it turns out that’s worth a great deal.

Driver Attribution: A Concrete Example

Traditional forecasting tells you: “The week 6 cash position forecast is down $2.1M versus last week.”

Driver-based forecasting tells you: “The week 6 position is down $2.1M. Here’s why: three enterprise A/R invoices totaling $1.4M have shifted 10 days right based on updated payment timing from your ERP. GBP depreciated 1.8% against your hedged position, generating a $390K FX variance. One new A/P outflow of $310K was approved and added to the schedule this morning.”

The number is the same. But the second version tells you which levers to pull – call the three enterprise accounts, review your GBP hedge ratio, confirm the A/P approval is correct. You’re managing drivers, not outcomes.

Confidence Scores and Ranges

A well-designed AI forecasting system doesn’t just output a number – it outputs a range and a confidence level for each input driver, based on the historical accuracy of that driver across comparable periods.

A customer that has paid within 3 days of terms for 24 consecutive months gets a different confidence weight than a customer with erratic payment history. The aggregate forecast inherits those confidence levels, which means you know where the uncertainty lives before it becomes variance.

What This Means for the CFO

You can walk into the board meeting and explain variance before you’re asked. The forecast is defensible, not just directional. When a board member asks “why was cash $3M lower than forecast last month,” you have a prepared, data-backed answer – not a post-hoc rationalization constructed at midnight before the meeting.

The core framing

This is not a black box. The AI surfaces the math. The CFO makes the call. A forecast that shows its reasoning isn’t just more accurate – it’s categorically more useful than one that only tells you what it predicts.

Proof Points

This is where we put the numbers on the table. Across Nilus customers, the average improvement in cash flow forecast accuracy is 30%+. That’s not a projected improvement from a vendor model – it’s measured against each customer’s pre-implementation baseline.

At StackAdapt, 95% of transaction auto-tagging now feeds directly into forecast inputs, eliminating the manual categorization step and saving more than 30 hours of treasury analyst time per month.

At Optibus, automated real-time cash visibility surfaced $5.5M in stagnant cash that had been sitting in suboptimal positions – undetected by the prior manual process – and enabled its redeployment.

Time saved is meaningful. But the bigger return is the variance reduction. A 30% improvement in forecast accuracy doesn’t sound like much until you do the math on what a cash forecast miss actually costs.

What changed in your last forecast? See the drivers – not just the delta. Ask Nilus →

The 13-Week Forecast vs. 12-Month Rolling Forecast – When to Use Each

These two forecasting tools answer different questions and serve different audiences. Conflating them is a common source of organizational friction – and running only one when you need both is a gap that creates blind spots in both directions.

13-Week Cash Forecast12-Month Rolling Forecast
PurposeOperational liquidity managementStrategic planning, covenant monitoring
FrequencyWeekly refreshMonthly refresh
Input basisDirect cash transactionsActuals + budget assumptions
Primary userTreasurer, Cash ManagerCFO, FP&A
When criticalCovenant compliance, tight liquidity, revolver managementBoard reporting, M&A planning, IPO prep
AI advantageReal-time transaction data, automated driver attribution, instant refreshScenario modeling, sensitivity analysis, variance attribution across longer horizon

The integration gap

Most mid-market finance teams run only one of these – typically the 13-week, because it’s required. What they’re missing is the feedback loop: weekly actuals that continuously re-anchor the 12-month model, so the strategic forecast doesn’t drift from operational reality. Nilus supports both, integrated – the 13-week feeds the 12-month automatically.

Cash Forecasting for PE-Backed Companies – Higher Stakes, Less Margin for Error

If you’re a CFO at a PE-backed company, you already know that “best practice” is not the right frame for cash forecasting. It’s a contractual obligation with financial penalties attached.

PE sponsors typically require weekly 13-week cash forecasts as a condition of the credit agreement – submitted to the sponsor, and sometimes to the senior lender, by end of business Monday. The forecast is covenant evidence. It’s not a management tool; it’s a legal document.

Debt covenants – leverage ratio, interest coverage, minimum liquidity threshold – are triggered by actual cash positions.

But the point of the forecast is to see trouble coming 4 to 8 weeks ahead, not the week it hits. That’s the early warning system that keeps treasury out of a technical default conversation.

The consequences of getting it wrong aren’t academic. A covenant breach triggers fee clauses, accelerated lender scrutiny, potential cross-default provisions, and in some structures, acceleration of the debt. Even a near-miss – where treasury identified the risk late and had to scramble – damages the CFO’s credibility with the sponsor in ways that are hard to recover.

Nilus builds a covenant tracking layer directly on top of the cash forecast – automatically flagging when projected cash positions approach threshold levels, so treasury has 4-6 weeks of runway to take corrective action before a breach becomes visible.

That’s not a nice-to-have for PE-backed companies. That’s table stakes. Learn more about how this fits into a broader treasury management system.

How to Evaluate Cash Flow Forecasting Software – 6 Questions to Ask

The market for cash forecasting software is crowded, and the demos are polished. Here’s how to cut through the noise and ask the questions that actually differentiate systems. (Spoiler: competitors like Kyriba and Trovata have very different answers to some of these)

  • Does the system ingest live A/R and A/P data from your ERP, or does someone still have to feed it inputs? This is the foundational question. If the answer involves a weekly export, a CSV upload, or an email to A/R, the system has not solved the root cause of forecast error – it has just digitized the manual process.
  • Does it support both the 13-week direct method and 12-month rolling forecasts? Many tools do one well and the other poorly. If you need both integrated – and you do – confirm the integration is native, not a workaround.
  • When the forecast changes, does the system tell you why? Which drivers moved, by how much, and in which direction? If the answer is “you can run a variance report,” that’s not driver attribution – that’s a spreadsheet with better formatting. See the section on driver-based forecasting above for what this should actually look like.
  • Does it support multi-currency and multi-entity consolidation natively? If you have 10+ entities or operate in 3+ currencies, the consolidation step is where most tools fall apart. Ask to see a live demo of a multi-entity consolidation. Watch how long it takes. That’s your answer.
  • Can it model scenarios? Specifically: “What happens to our 13-week cash position if our top 3 customers pay 15 days late?” This is the question treasury asks most frequently when things get uncertain. If scenario modeling requires a separate tool or manual manipulation, the workflow breaks under pressure – which is exactly when you need it most.
  • What is the audit trail on the forecast? Can you show an auditor, a PE sponsor, or a lender exactly what inputs were used, when they were ingested, who approved the forecast, and what changed between versions? If the answer is “we have version history in SharePoint,” that’s not an audit trail – that’s a prayer. Full input lineage is a requirement for PE-backed companies and a strong expectation for anyone preparing for an IPO or reconciliation automation at scale.

Also Read

Join our Treasury Community

Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.

This article is written by Palm

Categorisation is one of the oldest jobs in treasury. Tag every transaction so the data downstream actually means something: forecasts, Variance Analysis, Cash Positioning, board reporting. For years, treasurers have done it one of two ways: by hand, or with rules. AI is replacing both.

The interesting argument isn’t AI vs manual. Most teams gave up on tagging thousands of transactions a week by hand long ago. The real argument is AI vs rules, because rules are what most TMSs and Excel-based processes still run on. That’s the layer AI is taking out.

Why rules-based transaction categorisation breaks down

Rules look elegant on paper. If the counterparty contains “HSBC” and the amount is negative, tag it as a bank charge. If the description starts with “PAYROLL”, tag it as payroll. Easy.

Reality is messier. Counterparty names change when a vendor rebrands. Payment descriptions get truncated by the bank. A new entity is acquired and starts paying into the same account with a different reference format. A subsidiary in another country sends a tax payment no rule has ever seen. Each of those breaks the rule silently. The transaction either falls into “Uncategorised,” or gets miscategorised and quietly distorts the forecast.

Then there is the maintenance burden. Every new counterparty needs a rule. Every edge case needs an exception. The person who built the engine left two years ago, and nobody is sure which rules are still in use. The library grows, contradictions multiply, and the rules never quite catch up with how the business actually moves money.

Rules work on the world you’ve already seen. They collapse on the one you haven’t.

How AI transaction categorisation works

AI categorisation is pattern recognition with feedback.

The model trains on your historical transactions and the categories a human assigned to each one. It learns the signals that distinguish a customer payment from an intercompany transfer, a one-off bonus from a payroll run, a tax settlement from a supplier payment. Not just the counterparty name, but the amount, the description, the account pair, the currency, the timing, all weighed together.

When a new transaction lands, the model doesn’t ask “does this match any rule?” It asks “which pattern does this look most like?” and outputs a category with a confidence score. Above the threshold, it tags automatically. Below it, the transaction goes to a treasurer for review. Their decision feeds back into the model.

That feedback loop is the key difference. Rules don’t learn. AI does. Every correction makes the next prediction sharper. New counterparties get classified the moment they appear. Description changes don’t break anything. The model handles ambiguity because it doesn’t need an exact match.

What AI categorisation can do that rules can’t

Rules need explicit logic. AI captures patterns you’d never think to encode: that a particular customer always pays on the 27th, that a supplier’s invoices come in two amount bands, that a certain intercompany flow only happens at quarter-end. Those signals improve accuracy in ways no rule library could.

And rules don’t scale across entities. AI does. One model categorises transactions across every subsidiary, in every currency, with consistent logic.

How treasurers stay in control with AI categorisation

The fear with AI is the black box. A good system isn’t one. Every prediction comes with a confidence score and a visible reason. The treasurer can override any tag, and the model learns from that override. Transactions can be marked as System Outliers so they don’t pollute future training. The taxonomy can be set at any level of hierarchy: entity, account, subsidiary.

You keep the control rules gave you. You lose the maintenance burden.

AI vs rules-based categorisation: the bottom line

Rules-based categorisation was a step forward thirty years ago. It is now the bottleneck: the library nobody owns, the edge cases nobody covered, the silent miscategorisations nobody catches until the forecast misses.

AI categorisation handles the messy reality of real treasury data, learns from every correction, and stays accurate as the business changes. It isn’t a faster rules engine. It’s what rules engines were trying to become.

Also Read

Join our Treasury Community

Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.

This article is written by Trustpair

Imagine discovering that one of your trusted employees had spent years editing real supplier invoices to redirect payments into their own account. That’s exactly what happened at Miami University, which lost over $2.3 million to an internal fraudster. Vendor fraud is a severe and growing threat to UK businesses. The Home Office estimates fraud cost UK businesses £5.2 billion in the year ending March 2024, while fake invoice fraud alone affected 11% of UK businesses in the same period.

In this article, learn the most common types of vendor fraud and how to fight against it with Trustpair.

Key Takeaways

  • Vendor fraud refers to schemes in which fraudsters impersonate or compromise real suppliers to divert business payments.
  • The three most common vendor fraud schemes are: phishing/BEC attacks, internal employee fraud, and invoice fraud through compromised supplier accounts.
  • Fraud is now the UK’s most prevalent crime type, accounting for 45% of all crime in England and Wales (year ending September 2025). The total economic and social cost reached £14.4 billion in 2023–2024 (Home Office Fraud Strategy 2026–2029).
  • 1 in 4 UK businesses (27%) experienced fraud in the last 12 months; fake invoice fraud affected 11% and mandate fraud 7% (Economic Crime Survey 2024).
  • Payment rails commonly targeted in the UK include Faster Payments, BACS, and CHAPS, all of which can be exploited through fraudulent bank detail changes.
  • The UK’s APP fraud reimbursement rules (in force October 2024) place greater scrutiny on corporate payment controls and require businesses to demonstrate pre-payment due diligence.
  • The most effective defence is automated vendor account validation before every payment.
  • Trustpair has blocked 100% of payment fraud attempts for its customers since deployment.

What is phishing and Business Email Compromise (BEC) in vendor fraud?

Phishing emails involve the impersonation of a genuine third party in order to gain access to sensitive information or divert a payment. In the vendor fraud context, this is often called Business Email Compromise (BEC) or Vendor Email Compromise (VEC).

There are different levels of sophistication. Spear phishing involves detailed prior research: fraudsters identify the payment approver’s name, the company’s standard invoicing process, and the real vendor’s email format, often spoofing it convincingly. Busy procurement teams are unlikely to spot the difference.

Pharming goes further, directing victims to malicious websites designed to harvest employee login credentials and gain access to confidential company systems.

A significant and growing threat is AI-enhanced phishing. According to Abnormal Security’s 2026 Attack Landscape Report, 63% of organisations report an increase in email attacks using AI-generated content — text with no spelling errors, accurate tone, and contextually appropriate personalisation. In controlled testing, AI-generated phishing emails achieve a 14% click rate, nearly double the 8% rate for human-crafted attacks.

BEC attacks rose 38% year-over-year in 2025, with Vendor Email Compromise (VEC) — where fraudsters operate from inside a compromised supplier account — growing 67% in the same period (Abnormal Security).

These attacks rely on social engineering tactics. A typical scenario: fraudsters impersonate a known supplier mid-contract and submit a convincing invoice for legitimate-sounding services. Because the supplier relationship exists and no automated verification is in place, the payment goes through unchallenged.

Fraudsters frequently target payments made via Faster Payments and BACS, requesting account detail changes that re-route funds to mule accounts. Given the near-instant settlement of Faster Payments and the direct debit capabilities of BACS, funds can be irrecoverable within minutes. CHAPS payments for high-value transfers carry similar risk.

What is internal employee fraud and how does it work?

Internal fraud, also known as employee fraud, is another example of vendor fraud.

In this scheme, an employee exploits their access to submit and conceal fraudulent invoices. They may siphon payments to a shell company, inflate the price of goods or services, or redirect funds to an account they control. Because the employee understands exactly how invoices are normally processed, the fraud can remain invisible for extended periods.

With hundreds or thousands of suppliers in a typical organisation, accounts payable staff are unlikely to flag an invoice that looks and behaves like all the others.

The fraud triangle explains why employees commit fraud through three converging factors:

  1. Motivation: financial pressure from redundancy, debt, or perceived unfair treatment
  2. Opportunity: authorised access to payment systems or supplier master data
  3. Rationalisation: routing payments through a shell company makes them appear legitimate

One example of employee fraud at a British business illustrates this precisely. The financial controller, facing personal financial pressure after her partner became redundant, noticed an existing supplier had ceased trading. She edited a previous invoice, replaced the bank details with those of her own shell company, and deliberately kept each transaction below the co-authorisation threshold. The CFO, busy and trusting of a long-standing colleague, only scrutinised payments to new suppliers. The fraud went undetected, costing the business approximately £20,000.

Under the PSR’s APP fraud reimbursement rules, which came into force in October 2024, banks and payment service providers must reimburse victims of authorised push payment fraud up to £85,000. The PSR reported that in the first three months of the rules being in force, 86% of money stolen through in-scope APP fraud was returned to victims (UK Finance, Fraud Report 2025). While this applies primarily to personal accounts, it is increasing scrutiny on corporate payment controls and reinforcing the need for businesses to demonstrate pre-payment due diligence.

What is invoice fraud, and why is it so hard to detect?

Invoice fraud is a third attack vector. Here, the communication genuinely appears to come from a real supplier, because that supplier’s email or systems have been hacked.

The attacker, operating from inside the compromised supplier account, requests a change in bank account details. They may also submit invoices for goods or services never delivered. These attacks are particularly dangerous because businesses are far less suspicious of established supplier relationships, typically concentrating verification efforts on new vendors only.

According to the Home Office’s Economic Crime Survey 2024, mandate fraud — where fraudsters trick a business into changing bank details to divert payments — affected 7% of UK businesses in the preceding 12 months, while fake invoice fraud was the most common type of fraud, affecting 11% of all businesses.

Sade Telecom, an electrical network company, fell victim to this type of fraud before partnering with Trustpair. Their accounts payable team received a payment detail change request from what appeared to be an existing supplier. Without an automated verification system, they processed the change and sent subsequent payments to the fraudulent account. It was only when the genuine vendor issued a late-payment notice that the fraud was discovered.

Following the incident, Sade Telecom implemented Trustpair to automatically validate payment details before every transaction. The result: 100% of subsequent fraud attempts were blocked, with the solution live within 72 hours.

For UK organisations, mandate fraud most commonly targets BACS Direct Credit and Faster Payment instructions. Because Faster Payments settle in seconds, early detection before payment authorisation is the only reliable defence. Trustpair’s pre-payment validation integrates directly into your payment workflow to prevent fraud at source.

How can you prevent vendor fraud?

Vendor account validation is the most effective way to prevent all three types of vendor fraud and detect vendor fraud red flags before a payment is ever released.

The process involves cross-checking the details on a supplier invoice against international and domestic databases, verifying:

  1. Bank account details: account holder name, sort code, and account number
  2. Company identity: registered name, ultimate beneficial ownership, sanctions and watchlist screening

By automating this validation across every payment cycle, UK finance teams can confirm they are paying who they believe they are paying, not fraudsters who have intercepted the relationship.

Manual checks are slow, inconsistent, and easily circumvented. Automated vendor account validation removes human error and scales to match the size of your supplier base, whether you have 200 or 200,000 vendors.

In Summary

The three most common vendor fraud schemes are:

  • Phishing/BEC: fraudsters impersonate suppliers using social engineering and AI-generated communications to divert payments
  • Employee (internal) fraud: insiders create shell companies or manipulate existing invoices to siphon funds
  • Invoice fraud: real supplier accounts are compromised to request fraudulent payment detail changes

Protect your business by validating supplier accounts against verified databases in real time, before every payment. With Trustpair, you can demonstrate the due diligence required under current UK payment regulations while blocking 100% of fraud attempts.

Read More from Trustpair

Join our Treasury Community

Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.