IBAN-swap fraud: why you should verify ownership before paying
Every year, businesses and individuals lose enormous amounts by paying into the wrong account. It's not always a typo: behind it there's often fraud that swaps the IBAN on an invoice. Since October 2025, European regulation requires checking who an account belongs to before you transfer. Here's what's happening and how to protect yourself.
A real case: €130,000 to the wrong account
Spain's Supreme Court ruled in 2025 (Judgment 1294/2025, of 27 March) on an illustrative case: a business ordered a transfer of €130,000 that, due to an incorrect account number, ended up in the IBAN of a company unrelated to the transaction. Recovering that money, when possible, requires months of litigation. It's the typical pattern of the problem: the payment goes out, but the account holder isn't the one who should have been paid.
IBAN fraud (BEC): how it works
The most damaging variant for businesses is IBAN-swap fraud or Business Email Compromise (BEC): scammers impersonate a supplier — or intercept their email — and send an invoice that looks legitimate but carries a fake account number. The victim pays believing they're paying their usual supplier; the money goes to the fraudster's account. The impact of phishing and this type of fraud runs into hundreds of millions of euros a year in Spain.
- The email and invoice look authentic.
- Only the IBAN changes — the easiest detail to skip checking.
- By the time it's detected, the money is already gone.
What changes from October 2025: VoP
To cut off this vector, the EU introduced Verification of Payee (VoP): from 9 October 2025, payment service providers must check that the beneficiary's name matches the IBAN before executing a transfer, warning the payer if it doesn't match. It's a substantive change: checking ownership is no longer optional.
How to verify account ownership
There are ways to check, in seconds and without asking the customer for certificates, whether an IBAN belongs to a specific person or company. That's what YOiD Account Verify does: it confirms account ownership before you issue the payment, with a result of match / no match / partial match.
Verify the IBAN before you pay
With YOiD Account Verify you check from the browser whether a bank account really belongs to your customer, supplier or beneficiary — before transferring.
See account verification →Frequently asked questions
What is VoP (Verification of Payee)?
It's the obligation to check that the beneficiary's name matches the IBAN before executing a transfer. It applies across the EU from 9 October 2025 and aims to curb impersonation fraud and payments to the wrong account.
If I pay the wrong account, do I get the money back?
Not always, and almost never quickly. If the IBAN belongs to a third party, recovering the amount usually requires a legal claim. That's why the effective approach is to check ownership before paying, not after.
Does this only affect banks?
VoP obliges payment providers, but the risk of paying the wrong account falls on any business that issues transfers. Verifying ownership is good practice for all of them.
Sources: Spanish Supreme Court, Judgment 1294/2025 (via elEconomista); European Verification of Payee (VoP) regulation, in force since 9 October 2025 (Legal Today). Informational content, not legal advice.