To CoP, or not to CoP, that is the question

In this blog we shine a light on the latest developments in the UK’s Confirmation of Payee (COP) account name checking service.

How it all started…

It all started with a Which? Super Complaint in 2017 demanding that banks in the UK must do more to protect its customers from Authorised Push Payment (APP) fraud.

This call to action inspired John Bertrand to put pen to paper:

To CoP, or not to CoP, that is the question
Whether ’tis nobler in the mind to suffer
The slings and arrows of outrageous scams,
Or to take arms against a sea of fraudsters
And by opposing end them delay
John Bertrand.

It’s not a silver bullet but…

In 2020 the Confirmation of Payee (CoP) service was formally launched in UK to help reduce fraud and misdirected payments.

Confirmation of Payee helps protect consumers and businesses from certain types of fraud and misdirected payments by letting them know if the account name they have entered matches the account name of the recipient.

The Confirmation of Payee service seeks to give businesses and consumers greater assurance that they are sending payments to the intended recipient.

Whilst not a silver bullet, the implementation of Confirmation of Payee is expected be an effective way of combatting Authorised Push Payment Scams (e.g. where a fraudster tricks their victims into willingly making a large bank transfer to them).

Confirmation of Payee also helps to avoid payments being sent to the wrong account due to ‘fat fingers’ (keyboard errors) when we type in somebody’s Sort Code and Account Number.

How it works

Pay.UK, who operate the Confirmation of Payee account name checking service, describe CoP here:

Safer payments need service ubiquity

The Payment Systems Regulator states that there are eight types of APP scams which are either:

‘malicious payee’, for example, tricking someone into purchasing goods which don’t exist or are never received.
‘malicious redirection’, for example a fraudster impersonating bank staff to get someone to transfer funds out of their bank account and into that of a fraudster.

The PSR expects to see more action from financial institutions to stop these scams from happening and to better protect people if they do fall victim.

Every year thousands of individuals and businesses fall victim to Authorised Push Payment (APP) scams – where they are tricked into sending money to an account controlled by a fraudster. There are also a significant number of accidentally misdirected payments that are not recovered.

The latest figures show that in the first half of 2021, £355 million was lost to APP scams, overtaking card fraud losses.

Back in May 2021 Northey Point stated that ‘safer payments need service ubiquity’.

Following two very nervous payments – one to HMRC and one to a company we stated that a ubiquitous and ‘always on’ Confirmation of Payee service cannot come soon enough.

Northey Point had concluded that making payments and having to click a number of ‘scam check’ and liability boxes without the comfort of Confirmation of Payee checks puts the payer in an increasingly difficult and vulnerable position.

At the time Northey Point called that for the benefit of the PSP’s, to protect the payer and to thwart the fraudster surely Confirmation of Payee (CoP) service ubiquity should be mandated by the regulator and not be left as an optional extra.

Wider Adoption

CoP was designed to help stop fraud and accidentally misdirected payments by checking whether the name of a payee’s account matches the name and account details provided by a payer.

The PSR’s analysis of Phase 1 of CoP has shown that it had:

slowed the increase in authorised push payment (APP) scams
reduced the levels of fraudulent funds received by PSPs that have implemented CoP
reduced the number of accidentally misdirected payments.

In summary, the analysis carried out by the Payment Systems Regulator showed that a wider adoption of CoP by banks and building societies is necessary.

At the end of 2021, the regulator set out its proposed plans for the service to be rolled out to institutions that rely on different reference information, which would see more financial institutions able to offer CoP to their customers when making payments.

The Payment Systems Regulator (PSR) have now confirmed and published a new rule that paves the way for more banks and building societies to adopt Confirmation of Payee (CoP), the bank account name checking service.

This decision will make sure that the technical and system requirements for Phase 2 will be implemented by 31st May 2022.

Confirmation of Payee is a key part of our fight against APP scams, and this new rule is an important step in taking protections to the next level. Today, we have made it clear to the industry the work that needs to be completed by the end of May to ensure that the right systems are in place to offer this vital protection to more people.
“Used more widely, this service will make sure that everyone who makes payments will benefit from the same levels of protection as that currently offered by the directed banks and those that voluntarily implemented the checking system.
Genevieve Marjoribanks, Head of Policy at the PSR

PS22/1 Confirmation of Payee: response to consultation CP21/11 ending dual running

Following the PSR’s consultation at the end of 2021, they have decided to direct Pay.UK to ensure the Phase 1 environment is closed by 31 May 2022. This means that all PSPs will use Phase 2, making sure the service can be available to even more payment systems users.

For most of us the reference to phase 1 and 2 is confusing and not relevant – after all, all we need is the safety net of CoP service ubiquity. However the PSR have provided a simple graphic to explain the journey from phase 1 to phase 2:

To achieve its aims the PSR has decided to issue Specific Direction 11 which:

requires Pay.UK to terminate the terms and conditions for participating in Phase 1, withdraw each PSP’s CoP Phase 1 accreditation, and retire the Phase 1 rules and standards on 31 May 2022
requires Pay.UK to notify the OBIE of this action, so the OBIE can close the Phase 1 technical environment
requires Phase 1 PSPs to only use the Phase 2 technical for the CoP service after 31 May 2022
requires relevant PSPs to regularly report to Pay.UK on their progress migrating CoP traffic to the Phase 2 Open Banking environment by 1 May 2022, and requires Pay.UK to pass this information to the PSR
requires relevant PSPs to undergo enhanced reporting to both Pay.UK and us if we consider they are at significant risk of failing to migrate by 1 May 2022, with an obligation to implement a remediation plan agreed with the PSR;
revokes SD10 on 31 May 2022.

This direction came into effect 11 February 2022.

This means that existing CoP participants should continue their work to migrate to Phase 2 to ensure that after 31 May 2022, they only send and respond to CoP requests in the Phase 2 technical environment.

Confidence and Trust

For the benefit of the PSP’s, to protect the payer and to thwart the fraudster we are pleased to see that the Confirmation of Payee service will soon achieve service ubiquity (mandated by the regulator) and will no longer be left as an optional extra.

The majority of us will not need to worry about different phases or whether or not the sending / receiving bank has adopted the COP service.

Service ubiquity will mean that we will all have greater confidence when we make online payments, increase the trust we have in our banks and play a greater part in thwarting the (APP) fraudster.