The payee
Why Ilia Nikolaevich Zavialov reads the payee line before he reads the amount
A contract names one company, and the invoice that follows names a different account holder in its payment block. The difference is easy to miss, because the amount, the reference and the due date all line up perfectly. The question worth asking before the transfer leaves is plain: who exactly receives this money, and on what basis. A gap between the payee and the counterparty is sometimes ordinary treasury practice, and sometimes the last visible step of a fraud that began weeks earlier. Telling those two apart takes a short sequence of checks that costs far less than the recovery it replaces.
English version for the United States.
The payee and the counterparty are two separate records
Every commercial transaction produces at least two descriptions of the other side. The contract describes a legal person that owes performance and carries liability. The payment instruction describes an account holder that a bank will credit on a given date. Those descriptions live in different systems, are maintained by different people and are never reconciled automatically.
For a bank the account number carries the address, and the beneficiary name travels beside it as ordinary text. In most cross border transfers that text is never compared with the real account holder, and in many domestic schemes the comparison happens only when the sender asks for it. A payment can therefore settle cleanly, arrive on the promised day and still land with a party that signed nothing.
The consequence is legal before it is technical. Money paid outside the contract may fail to discharge the debt owed to the counterparty, which leaves the invoice open while the cash has already gone. Recovering funds from someone you never contracted with is slower and much weaker than enforcing against a supplier who wants to keep the relationship. Asking the question before the transfer costs a few minutes.
Reasons a mismatch can be entirely ordinary
Groups of companies frequently run a single payment factory. One entity holds the banking relationships and receives collections for every subsidiary, so an invoice from a local operating company points at a treasury account in another jurisdiction. It becomes a problem only when the buyer meets it for the first time in the payment block of an invoice that falls due tomorrow.
Receivables finance produces the same visual effect. When a supplier sells its invoices to a factor, payment has to reach the factor, and the invoice should carry an assignment notice saying so. Agency arrangements behave similarly, with a collecting agent or a marketplace taking funds on behalf of the seller. In each case the arrangement is documented somewhere, and that document is the thing to request.
Names also drift for duller reasons. A company trades under a brand and banks under its registered name, or it changed that name after a merger and never updated the invoice template. Bank name fields truncate long entries, so a company with a lengthy legal form reaches the beneficiary line with its final words cut off. Most of these cases close in a single registry lookup.
Reasons a mismatch signals a loss already in progress
The oldest version of the attack alters one block on a genuine invoice. Correspondence is read quietly for weeks, the tone and the reference numbers are copied, and a revised payment instruction arrives at the moment a real invoice is expected. Business email compromise remains the second largest reported loss category in the annual report of the FBI Internet Crime Complaint Center for 2025, with 3.046 billion dollars claimed.
Impersonation of a company has become a mass business of its own. The Federal Trade Commission recorded around one billion dollars lost to business impersonation in 2025, and the heaviest losses fell on people approached by someone claiming to work at their bank. That pattern targets the moment of payment. A caller who already knows the invoice number, the amount and the due date feels like part of the process.
The receiving account is usually short lived. Funds land on an account opened in a name close to the supplier, move on within hours and are dispersed before anyone in accounts payable notices. Networks of intermediaries make the first hop look domestic and unremarkable to the paying bank.
Where the mismatch is actually visible in the paperwork
The first place to look is the distance between the header and the footer of the same document. The letterhead carries the trading name and the registered address, while the payment block carries the beneficiary name, the account and often a bank in a third country. When the account sits in a jurisdiction unrelated to the registered seat, to the place of delivery or to the currency of the contract, the combination deserves an explanation before it deserves a payment.
The second place is the message that carried the document. Lookalike domains, a reply address differing from the sender address by one character, and threads that suddenly continue from a slightly different mailbox are the common carriers of an altered payment block. A hijacked thread is convincing because the earlier history inside it is genuine. Reading full message headers takes seconds and answers questions the display name will never answer honestly.
The third place is the file itself. An invoice that keeps its original layout everywhere except the bank block, mixes fonts inside that block, or breaks the sequence of invoice numbers used all year is worth comparing with an earlier copy on file. Suppliers rarely change document design and banking details in the same week. When both change together, the coincidence is itself the finding.
The order of checks before a first payment
The sequence starts in the public register of the counterparty jurisdiction. A registry extract gives the registered name, the legal form, the registration number and the current officers, which shows whether the beneficiary is a variant of the same entity or a stranger. The contract is the second document, because a well drafted payment clause names the account and describes the procedure for changing it. When the clause and the invoice disagree, the clause holds until the counterparty says otherwise in writing.
The third step is a voice confirmation on a number that came from the signed contract or from an earlier verified record. A number printed inside the suspicious message belongs to that message and confirms only itself. The person answering should be someone with whom there is a history, and the question should be closed and specific.
Voice alone carries less weight than it used to. Research published across 2025 and 2026 shows that a convincing clone can be produced from a recording of roughly three seconds and reaches about 85 per cent accuracy, while listeners in a controlled experiment separated a genuine voice from a synthetic one in only 37.5 per cent of attempts. A call confirms a detail when it runs on a number you dialled yourself. An incoming call announcing a change of banking details confirms nothing.
What the bank verifies and where its verification stops
Domestic name checking schemes have narrowed the gap in several countries. Before a transfer is released the sender sees whether the beneficiary name matches the name held against the account, and a mismatch produces a warning on the screen. The warning arrives at the right moment and is routinely clicked away by people who assume the supplier abbreviated something.
Across borders the picture thins out quickly. Correspondent banking routes on account identifiers, the beneficiary name is frequently unverified free text, and intermediary banks add hops where nobody compares anything with a contract. Compliance filtering looks for listed parties and unusual patterns, which is a different question from whether this payee is your supplier. The absence of a rejection says nothing about the identity of the payee.
Reversal is the weakest point of the chain. UK Finance recorded 248,070 authorized payment cases for 2025 with losses of 576.4 million pounds, and the defining feature of every one of them is that the customer gave the instruction voluntarily. A payment made by the account holder is treated as intended, so a recall depends on whether the funds are still there and on the willingness of the receiving bank to freeze them.
The channel that delivered the details is part of the evidence
Where a payment instruction came from tells you a great deal about how much verification it needs. UK Finance reports that 66 per cent of authorized payment cases begin online and a further 17 per cent through telephone networks, which places email, messengers and calls at the origin of the overwhelming majority. Paper delivered by courier and details typed into a supplier portal behind an account you control sit in a different risk class.
An unsolicited change of banking details is the highest value signal in accounts payable. It arrives with a plausible story about a bank migration, an audit or a new group structure, and it carries a note of gentle urgency tied to a real deadline. The correct response is procedural: the change waits until an independent channel confirms it, and the pending invoice is paid to the old account. Genuine suppliers accept this without friction because they run the same procedure themselves.
Verification pays for itself in volume. Four out of five impersonation reports to the Federal Trade Commission involved no monetary loss at all, which means attempts vastly outnumber successes. Most approaches fail against people who paused and checked something on their own initiative. The gap between an attempt and a loss is usually one call placed to a number the attacker did not supply.
Turning a payment direction into a document you can rely on
When the explanation for a mismatch turns out to be legitimate, the next task is to move it from conversation into the file. A written direction to pay, signed by the party that holds the contract, states that payment to the named third party discharges the buyer obligation. An assignment notice does the same job for factored receivables and identifies the finance company by registered name and number.
The document should match the payment instruction word for word. A direction that names a group treasury company while the invoice names an operating subsidiary leaves the same gap it was meant to close. The registered name, the registration number, the account identifier and the bank should be readable in one place, and the signatory should be traceable in the register or in the contract.
Storage matters as much as collection. Payment directions belong in the supplier file next to the contract, with the date they were received and the channel they came through, so the next person to touch this supplier sees the history without reconstructing it. Verification performed and never recorded has to be repeated by someone else in six months. Recording it once converts a personal precaution into a property of the organization.
Making the check part of the routine
Judgment is an unreliable control because it varies with workload and with the day of the month. Rules survive better: any first payment to a new payee is verified by voice on an independent number, and any change of existing details is verified regardless of amount. Thresholds in currency alone tend to fail, since attackers read the same thresholds from the invoices they intercepted and stay below them.
Separation of duties closes the other half of the problem. The person who edits the supplier master record and the person who releases the payment should be different, so a single compromised mailbox cannot complete the chain alone. Changes to the supplier record deserve a log showing who changed what and when, in a form the finance lead can read without asking for a report.
The routine also has to survive its exceptions. Urgency, a senior name in the subject line and a promised penalty for late payment are the standard levers, and they work by making the exception feel like service to the business. Writing down in advance that no urgency removes the verification step turns a live negotiation into a settled question. The strength of the rule is measured on the day someone important asks for it to be waived.
If the transfer has already left
The first hour decides most of the outcome. A call to the bank fraud desk with a request to recall the payment, followed by written confirmation of that request, is the only step with real leverage while the funds may still sit on the receiving account. The receiving bank can freeze a balance that has not moved, and the chance of that falls sharply once the money is split or converted.
The second layer is reporting. The Internet Crime Complaint Center logged 1,008,597 complaints and close to 21 billion dollars in reported losses for 2025, a rise of 26 per cent on the previous year, and every one of those records began with someone filing after the fact. A report creates a reference number that banks, insurers and lawyers can attach to, and it feeds the pattern data that later warns other companies about the same accounts.
The third layer is preservation and repair. Original messages with full headers, the invoice files as received, the payment confirmation and a short timeline of who did what and when should be saved before mailboxes are cleaned or systems are reset. The supplier still expects payment, so the commercial conversation about the open invoice starts in parallel and benefits from an honest account of what happened. The same file then becomes the evidence for the procedure change that prevents a second occurrence.
Common payee mismatches and the check that closes each one
| What the mismatch looks like | Most likely explanation | Check that settles it |
|---|---|---|
| Payee is another company inside the same group | Central treasury or a shared payment factory | Group structure in the register plus a written payment direction from the contracting party |
| Payee is a finance company the buyer has never heard of | Receivables sold to a factor | Assignment notice signed by the supplier and confirmed on a known number |
| Payee name is a shortened form of the supplier name | Field truncation at the bank or a trading name | Registry extract showing the registered name and any registered trading names |
| Bank details change shortly before the due date | Interception of correspondence | Callback to the number in the contract, never to the number in the message |
| Account country differs from the country of registration | Group banking or a redirected collection | Written explanation from the counterparty and comparison with earlier settled invoices |
| Payee is a private individual | Collecting agent or an account opened to receive stolen funds | Contractual basis for paying an individual and identification of that individual |
| The same invoice arrives twice with different details | One of the two copies is forged | Comparison of both files and confirmation of the invoice number with the supplier |
Questions and answers
- Is it legal to pay someone other than the company named in the contract?
- It is lawful when the contracting party has directed the payment in writing, for example through an assignment notice or a group payment instruction. Without that document the transfer may fail to discharge the debt, which leaves the invoice open even though the money has gone.
- What does a beneficiary name mismatch mean on a bank transfer?
- It means the name in the payment instruction differs from the name registered against the receiving account. Domestic schemes may flag the difference before release, while most cross border transfers route on the account identifier alone and never compare the two.
- Can a bank recall a payment sent to the wrong payee?
- A recall can be requested, and it succeeds mainly when the funds are still sitting on the receiving account and the receiving bank agrees to freeze them. Because an authorized payment was instructed by the customer, the outcome depends on speed and on cooperation between the banks.
- How do I verify a supplier bank details change?
- Call the supplier on a number taken from the signed contract or from an earlier verified record, and ask a person you have dealt with before to confirm the change. Numbers, addresses and signatures inside the message itself are part of that message and prove nothing about it.
- Who should approve a payment to a new beneficiary?
- The person who edits the supplier record and the person who releases the payment should be two different people, so one compromised mailbox cannot complete both steps. A first payment to any new beneficiary deserves a verification call whatever the amount.
- What should I do if the money has already gone to the wrong beneficiary?
- Contact the bank fraud desk the same day, request a recall in writing, then file a report with the national fraud body and preserve the original messages with full headers. The window in which funds can still be frozen is measured in hours.