IBAN verification: strengthening transfer security with VoP

In a context where instant payments are becoming widespread, securing bank transfers has become a major issue for both businesses and individuals. Verifying bank account details – and IBANs in particular – is an essential step to avoid errors and protect against fraud. With the introduction of the VoP scheme in October 2025, the rules of the game are changing. An overview.

The IBAN, or International Bank Account Number, is the identity card of a bank account. First published as a standard in 1997, this unique alphanumeric identifier facilitates and secures transfers between banks worldwide.
In France, an IBAN follows a specific format:

• Country code: 2 letters (FR for France)
• Check digits: 2 numbers used to validate the format
• Bank code: 5 digits identifying the bank
• Branch code: 5 digits identifying the branch
• Bank account number: 11 alphanumeric characters
• RIB key: 2 digits validating the account

This structure complies with ISO 13616, the international standard governing IBAN codes. While the length varies from country to country, the underlying logic remains the same.

Entering an incorrect IBAN can lead to several problematic outcomes:

• If the incorrect number does not correspond to any existing account, the transfer will be rejected, potentially generating fees and delays.
• If the IBAN exists but belongs to another account holder, the funds will be transferred to the wrong beneficiary, making recovery difficult or even impossible.
• The chances of recovery are even slimmer if the IBAN is fraudulent and has been misappropriated by a malicious actor.

When entering or checking an IBAN, several types of errors regularly compromise transactions:

With IBANs that can be up to 34 alphanumeric characters long, a simple typing error can easily occur. Copy and paste remains the safest method to avoid such mistakes.

When making an online transfer, it is recommended to use the IBAN in a continuous format, without spaces between characters. Some payment interfaces or validation systems may reject transfers if the IBAN is entered with spaces.

These must also be accurate. Even if a correct IBAN technically allows a transfer to be executed, incorrect beneficiary details can complicate validation and traceability processes.

The check digits immediately following the country code play a fundamental role in IBAN validation. Banks use them to automatically determine whether an IBAN complies with the ISO standard.
However, while this check quickly identifies incorrectly formatted codes, it does not guarantee that the bank account actually exists or that it matches the declared account holder.

Many free IBAN validators are available online. These tools instantly check whether an IBAN is correctly formatted, but they have significant limitations: they cannot confirm whether the account is active, identify the account holder, or detect sophisticated fraud attempts.
For organisations managing large volumes of transactions, more comprehensive professional solutions are required. These make it possible to automate IBAN checks by querying databases to confirm the existence, activity and identity of account holders.

Businesses can integrate IBAN validation solutions directly into their management systems via secure APIs. This automation offers several advantages: instant results for most IBANs analysed, centralised checks on a single platform, and full traceability of all verifications.

Effective from 9 October 2025, the Verification of Payee (VoP) regulatory framework strengthens transfer security within the euro area. Introduced by the European Commission as part of the regulation on instant payments, this mechanism requires all payment service providers (PSPs) to verify the match between the beneficiary’s IBAN and their identity before executing a transfer.

When a customer initiates a SEPA transfer, whether standard or instant, their bank automatically and in real time queries the beneficiary’s bank to check the consistency between the name provided and the IBAN entered.
The VoP control mechanism operates in four steps:

1. Data entry: the payer initiates the transfer by entering the IBAN and the name of the third party (or the company name for a business).
2. Verification request: the PSP queries the beneficiary’s bank.
3. Result returned in one of four possible responses:
   • exact match
   • close match, with indication of the correct name
   • no match
   • no answer
4. Payer decision: depending on the result, the customer can confirm, correct or cancel the transaction with full awareness.

VoP provides a concrete response to increasingly sophisticated fraud attempts, particularly fake IBAN fraud and invoice fraud, where criminals impersonate legitimate suppliers. By systematically verifying the beneficiary’s identity, the scheme significantly reduces the risk of fraudulent transfers.

Beyond security, VoP helps to limit human errors when entering payment details. Businesses can therefore avoid the fees and delays associated with rejected transfers and the complex procedures required to recover funds sent in error.

VoP also represents an opportunity to improve the reliability of supplier and customer databases. Better structuring of bank detail records and the integration of robust checks into payment processes enhance operational efficiency and strengthen trust with business partners.

Automatic validation of bank details helps finance departments meet their internal control and know-your-customer obligations, particularly under the Sapin II law, audit requirements, and European anti-money laundering regulations.

By providing a precise and reliable verification status, VoP is a major step forward in transfer security. However, responsibility for the payment always remains with the company. Only sound organisation will allow businesses to fully benefit from VoP.

Finance teams must anticipate the right responses to different scenarios, for example:

• Defining an alternative procedure in the event of a “no match” when paying a new foreign supplier.
• Carrying out a telephone verification with a long-standing supplier if VoP returns a “close match” following a change of IBAN.
• Alerting the finance team and blacklisting a fraudulent IBAN identified by a “no match”.

Such scenarios require ongoing vigilance and a clear action plan to adapt treasury, finance and accounting team organisation:

• Defining internal validation procedures for the various “close match”, “no match” and “no answer” cases.
• Training staff on the different VoP statuses and the corresponding validation procedures.
• Regularly updating company databases based on VoP feedback and downstream validations.
• Integrating VoP into approval workflows configured in the ERP or TMS to automate alerts and avoid payment delays.

This list is not exhaustive.
For example, when managing inbound payments, you can also enhance the security of your flows and protect your main IBAN by using virtual IBANs.
In an environment where every transaction matters, Xpollens supports you in integrating payment solutions via API into your tools and processes.