On 27 October 2021, a draft bill was introduced that will oblige banks to check with each transfer whether the IBAN account number and the name of the beneficiary match and to inform the payer whether both match. If they do not match, the payer can choose not to make the payment.

Fraud prevention measure

This extra check is not only to protect payers from accidentally entering a wrong account number (which can lead to a long ordeal to recover the money). It is primarily a fraud prevention measure.

At present, banks are not obliged to check, when making a transfer, whether the IBAN account number corresponds to the name of the beneficiary indicated on the transfer. Moreover, the payer is not even obliged to state the name of the beneficiary in order for the transfer to be executed.

Fraudsters make good use of this by approaching their victims via e-mail (phishing), telephone (vishing) or text messages (smishing), where they then pretend to be someone else, such as the person's bank, but also a friend, family member, colleague, supplier, etc.

An IBAN name check significantly reduces the chance of fraud and errors when executing a payment order. The system of IBAN name verification as proposed in the draft bill is not new. It already exists in the Netherlands and the UK.

In 2017, an IBAN name check was introduced in the Netherlands (as the first country in the European Union) under the name “IBAN-Naam Check”. The service was developed by Rabobank as part of its own innovation programme. In the Netherlands, the check is not a legal obligation, but all major Dutch banks apply it. According to Rabobank's figures ([1]), since the introduction of the IBAN-Naam Check in 2017, the number of fraud cases has decreased by 81% until 2020, while the number of incorrect payments (mistakes) has decreased by 67%.

In the United Kingdom, the Payment Systems Regulator (PSR) instructed the six largest banking groups in August 2019 to implement a Confirmation of Payee (CoP). The CoP system went into effect on 30 June 2020 and works in a similar way to the IBAN-Naam Check in the Netherlands: the system checks whether the name of the beneficiary entered matches the account number. If this is not the case, a warning appears and the user can decide whether or not to continue to make the payment. In the first half of 2018, some GBP 145 million was reportedly stolen from bank customers through bank fraud and, according to UK consumer organisations, GBP 320 million worth of fraudulent bank transfers were reported over the years 2018 to 2020.

European legislation

The payment market is obviously not a purely national phenomenon but has a European and even international dimension. In the SEPA (Single Euro Payments Area), international bank account numbers, the IBAN (International Bank Account Number), have been used since 1 August 2014.

In the European Union, payment services are largely regulated by the Payment Services Directives (PSD), with the aim of creating a uniform payment market within the European Union.

The 2015 PSD II Directive stipulates the following about banks' liability for erroneous transfers:

• Article 88.1: 'If a payment order is executed in accordance with the unique identifier, the payment order shall be deemed to have been executed correctly with regard to the payee specified by the unique identifier';
• Article 88(5): ‘If the payment service user provides information in addition to that specified in point (a) of Article 45(1) or point (2)(b) of Article 52, the payment service provider shall be liable only for the execution of payment transactions in accordance with the unique identifier provided by the payment service user’.

In 2018, the PSD II Directive was transposed into Belgian law and Article 88 of the PSD II Directive was transposed with maximum harmonisation into Article VII.55/2 of the Belgian Economic Code (WER).

The European liability rule means that a bank is only liable for checking the "coherence" of the IBAN number (unique identifier), namely that it is a correct combination of numbers and letters. If the IBAN number proves to be inconsistent, the bank must refuse the payment order and inform the payer accordingly. The Bank's liability is limited to the correct execution of the payment transaction in accordance with the Payment Service User's order. Thus, the Bank is not liable according to European regulations if a correct IBAN number is entered but the additional information (such as the name of the payee) proves to be incorrect.

Privacy

The IBAN name check can offer protection to the payer without having to compromise the privacy of the payee. The solutions in the Netherlands and the United Kingdom are sufficient proof that this can be done in accordance with the privacy rules. The IBAN name check there only gives a warning that the correct name known for the account number has not been entered. It does not say what the correct name should be; that is something the payer has to find out for itself. Moreover, banks do not share data among themselves, but use an algorithm that only checks for discrepancies in the information provided by the payer.

Conclusion

Although this issue deserves to be tackled on a European level, this draft bill is a very necessary and commendable initiative. An IBAN name check gives payers greater assurance that their payments are being routed to the intended recipient (and therefore are not being accidentally or deliberately) misdirected. It is also quite beneficial for the bank because, in the event of an incorrect transfer, they are obliged to investigate it. The IBAN name check thus may save both the Belgian payers and the Belgian banks a lot of headaches in the near future.

[1] Source: https://www.surepay.nl/surepay-jaaroverzicht-2020/ figures Rabobank NL