The quiet giant: Confirmation of Payee hits 100M uses

A hundred million name checks across eighty-two institutions. Eighteen months ago Confirmation of Payee was a quiet project. In July it was two major banks switching something on. Now it looks like infrastructure, and almost nobody clapped.

The part that makes it interesting is what lands on the same day. AFCA’s receiving-bank jurisdiction takes effect, which drags the bank that receives scam funds into the complaint frame. The old pattern was easy to summarise: the sending bank dealt with the customer and the receiving bank got to be scenery. That’s changing. The bank whose account took the money now has an answerability problem it can’t wave off.

Put the two together and the frame shifts. Confirmation of Payee catches one class of mismatch before payment, asking whether the account name really belongs with the BSB and number sitting in front of the customer. The AFCA change turns up the pressure after the fact, asking what the institution that hosted the destination account is on the hook for. One works before the transfer and one works after, and both land on the same idea: payment trust isn’t just the sender’s problem any more.

That’s a big change for a system that used to treat account numbers as enough. The rail was built to move money to the details supplied, and fraud lived in the gap between correct details and honest context. Confirmation of Payee narrows that gap. Receiving-bank accountability makes it more expensive to ignore.

Don’t skip past the voluntary part. Australia didn’t kick this off with one hard mandate across every institution. The larger banks moved, industry coordination did its work, coverage spread. It’s not perfect, but a hundred million checks across eighty-two institutions is a serious proof point for the Australian habit of building trust controls through coordinated rollout rather than decree. That doesn’t mean voluntary always works. It means this one got far enough, fast enough, to deserve the credit.

There’s still a ceiling, though. Confirmation of Payee checks who the customer is paying, not why. It can’t tell whether a caller talked them into moving the money, whether a supplier’s email was compromised, whether a family member was impersonated or whether the voice on the phone stitched a false story out of real leaked facts.

That gap matters because the back half of the scam chain is getting crowded with controls. Payee checks. Bank warnings. Transaction monitoring. Mule-account disruption. AFCA jurisdiction. The Scams Prevention Framework heading toward 1 July. All of it makes the movement of money harder to abuse, and the front half is where the mess still lives.

The front half is the ad, the message, the call, the compromised email, the account recovery flow, the support desk chat, the social pretext. It’s where the victim gets convinced before the system ever sees a payment. It’s where leaked information turns into confidence, where the person on the other end of the line sounds legitimate because they showed up carrying enough truth.

Confirmation of Payee doesn’t solve that, and it was never meant to. Its real value is showing what happens when you move a trust question out of the customer’s head and into the infrastructure around the action. That’s the bit worth carrying forward. The posture, more than the mechanism. Ask the trust question where the risk gets real, make the answer visible before the damage is done, and give institutions clear responsibility when the system waves obvious abuse straight through.

A hundred million name checks later, that idea isn’t theoretical any more. The open question is who answers for the call that started the whole thing.