Bank Account Verification: Why Payout Fraud Starts With an Unchecked Account

Most payout fraud does not look like a break-in. It looks like a customer updating their bank details. Someone links a new account, changes where withdrawals go, or asks for a refund to a different IBAN. If nobody checks who owns that account, the money leaves and rarely comes back.

That is why bank account verification has moved from an optional extra to a basic payment control for any business that sends money out, from marketplaces and gig platforms to fintech, gaming and forex operators.

Where does the risk actually sit?

Fraudsters target the moments when bank details change, because checks there are usually weakest. The common ones are:

• Account linking at onboarding, when a stolen or synthetic identity connects an account it does not own

• Payout or withdrawal changes after an account takeover, when the attacker swaps in their own account

• New beneficiaries in business payments, often after a spoofed email from a supplier

• Direct debit set-up, when someone authorises payments from an account that is not theirs

• Refunds sent to an account that never paid in

In each case, the identity on file may be genuine, but the bank account behind it belongs to someone else, often a money mule.

Picture a freelance marketplace. An attacker phishes a user's login, adds a new payout account, and withdraws the balance that afternoon. A biometric re-check before the change, plus an ownership check on the new account, would have stopped it.

Validation is not verification

Teams often treat these terms as one check. They answer three different questions.

Validation asks whether the account number or IBAN is correctly formed and the account exists. It catches typos but says nothing about who owns the account.

Verification asks whether the name registered to the account matches the name you hold. It still does not show that your customer is that named person.

Ownership verification binds a verified identity to the account and re-confirms it at risky moments, such as a payout change. It is the check that stops payout fraud, and many flows skip it.

How businesses verify a bank account today

Most businesses use more than one of these four methods.

Micro-deposits: Small test amounts are sent, and the customer confirms them. It takes one to three business days and needs the customer to come back, which many never do.

Instant checks: Instant account verification matches the account details against bank records in seconds. Depending on the market, it returns the account holder's name, a masked name where local rules restrict disclosure, or a pass or fail on the name submitted.

Name-check schemes: In the UK, Confirmation of Payee compares the payee's name with the account details before a payment is sent. The EU runs its own version, Verification of Payee. Both help, but a mule account can carry a genuine matching name, so a match alone does not prove ownership.

Document checks: Where live bank data is unavailable, some businesses compare a recent bank statement instead. It is slower and easier to fake, so it works best as a fallback.

Regulators are turning the check into a payment control

• UK: The Payment Systems Regulator's Specific Direction 17 extended Confirmation of Payee to around 400 more payment firms, with the second group due by 31 October 2024.

• EU: Under the Instant Payments Regulation, payment providers in the euro area have had to offer Verification of Payee on credit transfers since 9 October 2025. Providers outside the euro area will have to follow suit by 9 July 2027.

• US: Since 19 March 2021, Nacha's rules have required businesses taking WEB debits to validate an account number before its first use and after a change. New 2026 rules add risk-based fraud monitoring.

Bank account verification is not a standalone KYC or AML requirement. It supports customer due diligence by confirming that funds move to and from an account the verified customer controls.

Building the check into a payout flow

One check at sign-up is not enough, because the risk returns whenever bank details change. A practical set-up looks like this:

1. When an account is first linked, check the applicant's identity and the account holder's name together before approving it.
2. Before payout or withdrawal details change, ask the customer to re-authenticate with a biometric liveness check, then verify the new account.
3. Screen the customer and the beneficiary against sanctions, PEP, and watchlist data before a payout is approved, and keep screening them after onboarding.
4. Send failed or partial matches to manual review rather than rejecting the customer outright.
5. Save each result to the same case record as the identity check, showing which account was verified, which method was used, and when.

Most teams run this through a bank account verification service that sits in the same flow as onboarding and payout approval. A change of bank details then triggers a check automatically.

Mistakes that leave the gap open

Even teams that verify accounts make these mistakes:

• Treating a partial match as a pass. Names differ for honest reasons, such as initials, married names, or trading names. A rule that approves every near match will also approve a mule account with a similar name.

• Keeping results in separate systems. When the identity check and the account check sit in different tools, nobody notices the two names do not match.

• Ignoring business accounts. Supplier and merchant payouts need the account name matched to the company verified through KYB, not just the person filling in the form.

The bottom line

Payout fraud usually exploits the gap between knowing who your customer is and knowing whose account you are paying. Closing it means treating the bank account as part of the customer's identity.

Identity and compliance platforms such as Shufti now run the identity check and the account ownership check in one decision and save both to one case record. That record shows the person and the account belong together before funds are released.