Sending money to the wrong account is a costly and stressful mistake. Bank transfers — especially wire transfers — are difficult or impossible to reverse once processed. In the UK alone, over £485 million was lost to Authorised Push Payment (APP) fraud in 2022, according to the Financial Conduct Authority. In the US, the Federal Trade Commission reports that wire transfer fraud remains one of the top methods used by scammers, with victims losing a median of over $1,000 per incident. Taking a few minutes to verify bank details before clicking "Send" can save you significant time, money, and frustration. This guide walks you through a comprehensive verification process for both personal and business payments.
Before diving into the verification steps, it helps to understand how bank transfer fraud works. The most common type in the UK is Authorised Push Payment (APP) fraud, where a victim is tricked into voluntarily sending money to a fraudster's account. Unlike unauthorised fraud (where someone steals your card details), APP fraud is particularly devastating because the victim initiates the payment themselves, making it much harder to recover the funds.
APP fraud takes many forms. In purchase scams, victims pay for goods or services that do not exist. In impersonation scams, criminals pose as banks, government agencies, or trusted organisations. In invoice redirection fraud (also called business email compromise), scammers intercept genuine business communications and substitute their own bank details. The Action Fraud reporting centre in the UK received over 40,000 reports of APP fraud in a single year.
In the US, wire fraud is similarly pervasive. The FBI's Internet Crime Complaint Center (IC3) consistently ranks business email compromise among the most financially damaging cybercrimes. Once a wire transfer leaves your bank, the money typically moves through multiple accounts within hours, making recovery extremely difficult. The FTC warns that wire transfers are a preferred method for scammers precisely because they are fast, irreversible, and difficult to trace.
One of the most sophisticated fraud techniques is business email compromise (BEC). In a typical BEC attack, a criminal gains access to a company's email system — often through phishing or credential theft — and monitors email conversations. When they spot a legitimate invoice being sent, they intercept the email and replace the bank details with their own.
The victim receives what appears to be a genuine invoice from a trusted supplier, complete with correct logos, formatting, and references. The only difference is the bank details. Because the email comes from the supplier's actual email address (or a very similar one), there is nothing obviously suspicious about it. Victims often only discover the fraud weeks later when the real supplier chases for the unpaid invoice.
Scammers also target individuals. A common tactic is to pose as a solicitor during a property purchase, sending "updated" bank details for the deposit payment. Property transactions are particularly attractive to fraudsters because the amounts involved are large and the time pressure is high. A single intercepted conveyancing payment can result in the loss of a buyer's entire deposit.
Before anything else, check that the bank number you received is structurally valid. Each format has built-in error detection that can catch typos, missing digits, and transposition errors — which account for the vast majority of payment failures:
A valid format does not guarantee the account exists or that it belongs to the right person, but it does eliminate the most common cause of failed payments: simple data entry errors. Think of format validation as your first line of defence — it costs nothing and takes seconds.
When you validate an IBAN, routing number, or sort code, the result should include the bank name. This is a critical cross-check. Verify that the bank name matches what the recipient told you. If someone says they bank with HSBC but the sort code resolves to Barclays, something is wrong. Similarly, if you are paying a German company but the IBAN starts with PL (Poland), that mismatch should raise immediate concerns.
For sort codes and routing numbers, the bank name lookup is deterministic — each code maps to exactly one bank. For IBANs, the country code and bank code portion will identify the institution. If the bank name does not match the recipient's stated bank, stop the payment and investigate further.
Confirmation of Payee (CoP) is a name-checking service introduced by Pay.UK in 2020 to combat APP fraud. When you set up a new payee at a participating UK bank, CoP checks whether the name you entered matches the name on the recipient's account. You will receive one of three responses: a match, a close match (with the correct name suggested), or no match.
CoP is a powerful fraud prevention tool, but it has limitations. Not all UK banks and building societies participate (though coverage has expanded significantly since launch). CoP does not work for international payments. And a name match does not guarantee legitimacy — a scammer could open an account in a name that matches the person they are impersonating. Despite these limitations, CoP has prevented hundreds of millions of pounds in fraud since its introduction and should always be used when available.
If you received bank details via email, text, or messaging app, confirm them through a separate, trusted channel. Call the recipient directly using a phone number you already have — not one provided in the same message. Payment redirection fraud (where scammers intercept emails and change bank details) is one of the most common financial scams, and the only reliable defence is out-of-band verification.
Red flags to watch for
accounts@supp1ier.com instead of accounts@supplier.com)For high-value payments, especially property transactions, always verify bank details in person or by phone. Solicitors and conveyancers should never send bank details by email alone, and many have adopted policies requiring clients to collect payment details in person or verify them by phone using a known number.
For large transfers or first-time recipients, consider sending a small test amount first (e.g., £1 or $1). Ask the recipient to confirm receipt before sending the full amount. This is standard practice for business payments, real estate transactions, and payroll setup. The cost of a test payment is negligible compared to the potential loss from sending the full amount to a fraudulent account.
When the recipient confirms the test payment, verify that they can identify the exact amount, the sender name, and the date it arrived. This confirms not only that the bank details are correct, but also that you are communicating with the genuine account holder. Read our guide to sending money internationally for more on international transfer best practices.
Before you submit the transfer, review every field one more time:
Many banks now show a summary screen before you authorise the transfer. Take the time to read it carefully rather than clicking through automatically. If anything looks unfamiliar, cancel the payment and re-verify.
Businesses face additional risks because they process higher volumes of payments and are prime targets for invoice fraud. Corporate verification procedures should be more rigorous than personal ones:
For personal payments
For business payments
If you realise you have sent money to a fraudulent or incorrect account, act immediately. Every minute counts. Here is what to do, step by step:
Recovery rates vary widely. If you act within hours, the receiving bank may be able to freeze the funds before the fraudster withdraws them. After 24–48 hours, the chances of recovery drop significantly. Speed is the most important factor. Learn about transfer processing times in our guide to international transfer times.
Online validation tools like BankCheck cannot tell you who owns an account, but they are an essential first step in the verification process. By validating the format and looking up the bank name, you can catch obvious errors and red flags before you even contact the recipient. A sort code that does not correspond to any bank, an IBAN with an invalid checksum, or a routing number that fails the 3-7-1 check — all of these are immediate indicators that something is wrong.
Validation is especially valuable when bank details are entered manually. Studies have shown that manual data entry has an error rate of approximately 1 in 300 characters. For a 22-character IBAN, that means roughly a 7% chance of a typo in any given manual entry. The MOD-97 checksum will catch virtually all of these errors, preventing failed payments or misdirected funds.
BankCheck validates IBANs, routing numbers, and sort codes for free. All validation runs client-side — your bank details never leave the browser. Use it as the first step in your verification process every time you make a payment to a new recipient.
Back to all guides.