Confirmation of Payee quietly arrives in Australia

Two of the four majors flipped a switch this week and most of the country didn’t blink. CommBank and Westpac will now tell you, before you press send, whether the name on the account matches the BSB and account number you typed in. The UK has been doing this for years. Europe is heading there by mandate. Australia got there on a Wednesday, with no press conference big enough to break through the usual noise.

Worth paying attention to.

Confirmation of Payee is easy to undersell because the experience is deliberately boring. You enter the payment details. The bank checks the name against the account. If it looks right, the payment goes through. If it looks wrong, you get a warning before the money moves.

None of that feels like a grand redesign of Australian fraud control. It feels like plumbing. That’s the point.

The best scam controls usually arrive as small interruptions in a familiar flow. They don’t ask the customer to learn a new category of risk, or depend on a staff member spotting a perfect pretext. They just put a check at the moment the mistake becomes expensive. That’s what makes this one interesting.

For years the weak point in payment scams has been the gap between account details and account reality. A victim thinks they’re paying a builder, a solicitor, a supplier, a family member, their own new account. The BSB and number are valid. The rail does exactly what it was asked to do. But the name in the victim’s head and the account at the other end aren’t the same thing.

Confirmation of Payee makes that mismatch visible.

It doesn’t stop every scam. It won’t catch the authorised payment where the victim really does mean to pay the account in front of them, and it won’t fix the social engineering upstream, where the caller has already done the work of convincing someone the new details are legitimate. But it changes the default. A bank is no longer just moving money to a set of numbers. It’s checking whether the story around those numbers has a basic claim to truth.

That’s a quiet shift from fraud features to fraud infrastructure.

The Australian model is also worth watching because it’s voluntary. AusPayNet has been chairing the project and the majors are moving first, but that’s not the same as a hard legal obligation. The test over the next year is whether industry coordination can reach enough coverage quickly enough, and whether the smaller institutions follow before the absence of the check becomes its own risk signal.

Europe gives the comparison its edge. The EU is moving towards mandatory Verification of Payee across SEPA. Australia has started with a bank-led rollout and coordination. Neither model should be crowned in July. The useful thing is that we now have two live versions of the same basic idea.

For Australian fraud teams, the lesson isn’t that name checks are magic. It’s that identity claims are becoming part of the transaction itself. The system is starting to ask whether the person, name, account and context belong together before the costly action happens.

That matters beyond payments. The same shape will show up elsewhere. Not because Confirmation of Payee is caller verification, or SMS sender verification, or identity proofing — it’s none of those. It matters because it shows the direction of travel: trust signals are moving from advice to infrastructure.

Two majors on a Wednesday with no press conference. The boring announcements are usually the important ones.