An IBAN received by email, an incoming transfer with unclear origins, a supplier providing new bank details: these situations all raise the same question. Identifying the holder of an IBAN remains governed by banking secrecy and GDPR, which significantly limits the steps available to individuals and businesses.
However, the European regulatory framework has evolved since October 2025, with the implementation of the Verification of Payee (VoP), which changes the game for verifying beneficiaries of SEPA transfers.
Verification of Payee: what the European obligation of October 2025 changes
Since October 9, 2025, payment service providers in the eurozone must automatically compare the name entered for the beneficiary with the actual holder of the IBAN before executing a SEPA transfer. This mechanism, stemming from Regulation (EU) 2024/886 on instant payments, is free and mandatory for the payer.
In practice, when you initiate a transfer from your banking app, your bank queries the beneficiary’s bank to verify the match between the name you entered and the registered holder. The system returns four types of responses: match, close match (with disclosure of the registered name), no match, or verification not possible.
This verification does not give you access to the identity of the holder based on an IBAN alone. It confirms or denies a match that you have declared yourself. The nuance is central: the VoP does not function like a reverse directory. You must already have a name to verify.
To explore the steps available outside the banking circuit, the Guide Banque website details several complementary avenues suitable for both individuals and professionals.
Responsibility in case of ignored alert on a SEPA transfer
The VoP system is not limited to a passive warning. If your bank alerts you to a close match or a no match and you still confirm the transfer, the responsibility for any potential loss is transferred to you. This point, stipulated by European regulation and clarified by recent VoP frameworks, changes the usual logic where the bank could be approached for a recall of funds.
In the case of fraud involving bank details (a third party substitutes their bank details for those of the real beneficiary), this shift in responsibility makes the payer’s vigilance crucial. An entrepreneur who validates a transfer after a no match warning loses their ability to contest the operation with their bank.
What this implies for businesses
Accounting services must integrate this constraint into their supplier validation processes. A change of bank details communicated by email, even from a known address, must systematically undergo verification before payment execution. The VoP alert becomes a safety net, but only if it is taken seriously.
Practical limits: accounts, currencies, and areas not covered by the VoP
The mandatory name-IBAN verification does not cover all scenarios. Several blind spots remain and deserve to be identified before considering the system as complete protection.
- Only SEPA transfers in euros are concerned. A transfer in foreign currency or to an account outside the SEPA zone does not trigger a VoP check.
- Payment accounts hosted by certain neobanks or electronic money institutions are not always connected to the mechanism, which can generate a “verification not possible” response without indicating fraud.
- SEPA direct debits are not subject to this verification. A fraudulent direct debit mandate thus escapes the system.
A “verification not possible” response does not mean the account is suspicious. It indicates that the beneficiary’s bank has not yet implemented the service or that the type of account is not covered. Field reports vary on the frequency of this response depending on the institutions.
Identifying the holder of an IBAN without going through a transfer
Outside the VoP circuit, options for tracing back to the holder of an IBAN remain very limited for an individual. Banking secrecy prohibits institutions from disclosing a client’s identity to an unauthorized third party. There is no public directory of IBANs.
What an IBAN structure reveals
An IBAN contains usable information without violating any rules. The first two letters identify the country (FR for France, DE for Germany). The bank code and branch code, integrated into the sequence, allow for identifying the banking institution and the account’s domiciliation agency. The BIC code, often associated with the IBAN on a bank statement, confirms this identification.
These elements do not provide the name of the holder, but they allow for verifying the consistency of a situation. A supplier based in France whose IBAN starts with LT (Lithuania) can legitimately use an account in a Lithuanian neobank, but this information deserves to be questioned.
Direct request to your bank in case of suspected fraud
If you suspect fraud, your own bank can initiate an internal verification procedure or a recall of funds. It will not disclose the identity of the holder to you, but it can contact the beneficiary’s bank to attempt to block or recover the funds. This process should be initiated as quickly as possible after the transfer, ideally within the first hours.
IBAN verification scams: services to avoid
Some websites offer to find the holder of an IBAN for a fee. These services have no legal access to banking databases. The information they provide is either public (country, bank, branch) or fabricated.
A legitimate IBAN verification service checks the format (ISO 13616 standard), the existence of the account, or the name-IBAN match through authorized banking channels. No online tool can legally provide the name of the holder based solely on an IBAN, whether for an individual or a business without a judicial mandate.
The European regulatory framework is gradually strengthening the security of transfers without creating transparency regarding the identity of account holders. The VoP represents a significant advancement in preventing errors and fraud at the time of payment, but it does not answer the initial question when only an IBAN without an associated name is available. In this case, only a judicial procedure or an investigation conducted by the competent authorities can lift banking secrecy.
