How to check a bank account before you pay in the UK: Confirmation of Payee, call-backs and what to do if it goes wrong

Why bank details are the target

Fraudsters do not need to break into a bank account. They intercept or fake an email and swap the bank details just before a payment. UK Finance calls this an invoice and mandate scam, and its definition includes “criminals targeting consumers posing as conveyancing solicitors, builders” and others. It says the fraud “often involves the criminal either intercepting emails or compromising an email account”.

The sums in property cases are large. In the City of London Police figures, residential conveyancing fraud (140 reports) averaged £78,393 per report. Across all 143 reports the average was about £82,000, the figure the NCA and the Law Society use. One email can change where a deposit goes. For firms, our guide to payment diversion fraud for estate agents covers how these attacks usually start.

How Confirmation of Payee works

Confirmation of Payee (CoP) checks the name you enter against the name on the account that the sort code and account number belong to. Your bank runs it when you set up a new payee or change an existing one, for Faster Payments and CHAPS. It is free, but only inside your own banking app or online banking.

The Payment Systems Regulator (PSR) requires most banks and payment firms to offer it. On 22 October 2026 the PSR removed the planned 1 November 2026 end date, so the requirement stays in place until the PSR changes it. More than 320 organisations offer CoP, covering over 99% of organisations that send Faster Payments, and over 2 million checks run every day (PSR PS26/2).

Bank wording varies, but the results fall into four groups.

Nationwide’s own wording is a useful reminder on both ends. On a match: “Although the name matches, make sure you’re happy that you know who you’re paying and that they’re trustworthy.” On a no match: “If you choose to go ahead anyway, we may not be able to get your money back.”

What Confirmation of Payee does not cover

CoP is a strong check, but it has gaps. Know them before you rely on it.

• A match only means the name matches. A fraudster can control an account in a matching name, and in some scams the person you intend to pay is the fraudster.
• No international payments. CoP covers UK Faster Payments and CHAPS only.
• Not every payment firm is required to offer it. The PSR has not yet brought voluntary providers into the rules and plans to consult.
• Instructions sent by post, email or fax are exempt. If your bank receives the payment details by post, email or fax, or in a note handed in at a branch and processed without you there, it does not have to run CoP.
• It only works if you act on it. Banks warn against being pressured into ignoring a no match. Anyone who rushes you past the warning is a reason to stop.

What a sort code and account number check can and cannot tell you

You may come across websites that check a sort code and account number. These use the UK modulus check, the published maths banks use to catch typing errors. A pass is valid in format only and does not confirm who owns the account, or even that the account is open.

Vocalink, which publishes the check, says it plainly: a valid result “means that the account number is a possible account number for the sorting code, but does not necessarily mean that it is an account number being used at that sorting code”. Some sort codes have no rule at all, so they cannot be checked this way. That does not make them wrong.

A format check is useful for catching typos. It is not a fraud check. A fraudster’s account passes it just as easily as the real one. Vocalink’s own free sort code checker requires registration and allows up to 5 lookups a day.

Before you pay a firm: steps for buyers, sellers and tenants

If you are paying a solicitor, conveyancer, estate agent or letting agent, the most dangerous moment is just before completion or when a deposit is due. That is when fraudsters send “updated” bank details. Propertymark advises buyers that an email about changed bank details is “likely to be a scam”.

1. Get the bank details at the start, in person, by phone or in the client care letter, not in a late email.
2. Treat any change of details as suspect. The National Crime Agency (NCA) says “LAW FIRMS RARELY CHANGE THEIR BANK DETAILS”.
3. Call before you transfer. Use the firm’s published number or the one you already have, “not the one given in the email” (NCA).
4. Add the payee and read the CoP result. Anything other than a match means stop and call.
5. Send a small test payment first for large sums, and make sure it has arrived before you send the rest, as the NCA suggests.
6. Do not let anyone rush you. “NEVER transfer money until you are satisfied the details are correct” (NCA).
7. Keep the purchase quiet. Propertymark advises against checking emails on public wifi during a property transaction and against posting about your purchase on social media.

For firms paying or receiving client money

Estate agents holding deposits, solicitors paying out completion monies and accountants making refunds face the same risk in both directions. The difference is that most firms above micro size are not covered by APP reimbursement, so a loss usually stays with the firm or its insurer.

If you receive client money:

• Give your bank details at the start of the job, in person, by phone or in the client care letter.
• Say in every email signature, and in your terms, that you will never change bank details by email.
• Tell clients to call you on a number they already have before they pay.
• Check your email security. Our free email security checker looks at your domain’s SPF, DKIM and DMARC records, which make your emails harder to fake.

If you pay money out:

• Run CoP on every new or changed payee. Treat close match, no match and unable to check as a stop.
• Call back on a number already on file before paying any new or changed details.
• Ask a second person to approve any change of bank details.
• Consider a small test payment for large sums (NCA).
• Be wary of urgency, late changes and requests that arrive just before a deadline or at the end of the week.
• Watch for email rules that forward or hide messages. The SRA advises checking for mail forwarder rules.

Solicitors: the SRA Codes require you to “safeguard money and assets entrusted to you” (Code for individuals rule 4.2, Code for firms rule 5.1). The SRA Accounts Rules require any money wrongly paid out of client account to be replaced immediately, and the SRA says firms should also report the loss to it.

Bank details checks are fraud prevention, not customer due diligence. An AML check, such as an AML Buddy check, confirms who your client is and screens them for sanctions, PEPs and adverse media. It does not check bank accounts. See our guide to customer due diligence and the glossary entry on fraud prevention.

APP fraud reimbursement: what you can get back

If you are tricked into sending a payment, your bank may have to refund you under the APP fraud reimbursement rules. They apply to Faster Payments and CHAPS payments between UK accounts made on or after 7 October 2024. The limit is £85,000 per claim (PSR, as at 25 October 2026).

You are expected to report promptly, answer your bank’s questions and report to the police or let the bank do so. The rules are working: an independent evaluation for the PSR found APP fraud losses down by an estimated £73m a year, with 97% of in-scope claims reimbursed (PSR, 1 July 2026). The PSR plans to consult on changes in December 2026, with decisions due in May 2027. The PSR is due to become part of the FCA, but the bill to do this is not yet law.

If you have paid a fraudster

Speed matters. The sooner your bank acts, the better the chance of freezing the money at the receiving bank.

1. Call your bank immediately on the number on the back of your card or on its website, not a number from any message. Ask it to contact the receiving bank to freeze the funds.
2. Report to Report Fraud (formerly Action Fraud) at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101.
3. Tell your solicitor or conveyancer if the payment was for a property, as the NCA advises.
4. Keep everything. Save the emails, messages, bank details and payment confirmations.
5. Firms: tell your insurer. SRA-regulated firms must replace any client account shortfall immediately and should report the loss to the SRA.

Do not reply to the fraudster or try to recover the money yourself. Let your bank and the police deal with them.

See also our guides to who pays for AML checks when buying a house and source of funds vs source of wealth, and the estate agents and solicitors hubs.

This guide is general information, not legal or financial advice. Your bank’s own guidance decides what happens with a specific payment.