Showing posts with label COP. Show all posts
Showing posts with label COP. Show all posts

2020-06-11

Confirmation of Payee

UK banks have been rolling out a new confirmation of payee system recently.

The idea is relatively simple - when paying someone using your bank app or web site, you put not only the sort code and account number, but also payee name (the name of the person or business you are paying). The system can then advise if you have that right, or a "close match" which can then let you confirm the exact name.

As I have said before I think this is problematic at best - banks usually have shortened (18 characters) names for accounts, but companies and people have longer names, trading names, may use initials, or have joint accounts, and so on. It means a match may not work.


It may help typos, but then that is what check digits are for, but what concerns me even more is that scammers will simply change their tactics - telling their marks a different payee name, perhaps justifying as the holding or parent company, etc. That will then match. Indeed, I expect scammers to be slick and make paying them really easy, but normal businesses and individuals to run in to problems.

Just to highlight how stupid this is - I sent a payment from Barclays to Monzo, and Barclays set the payer name in that case to KENNARD AJ. I then sent payment back on Monzo, and it went through confirmation of payee on the (pre-filled) details, and Barclays failed to validate KENNARD AJ as my account name, not even a suggested alternative, even though it is what they sent!!!

This type of stupidity, where you have pre-filled or known correct details totally failing, will get people just doing "click through" of errors and warnings as a matter of course, just like cookie warnings. Some people will have so much trouble they tell payers "just ignore any errors". However, the fraudsters will know exactly how to make it work perfectly and what to tell people. This almost makes it worse than before!

Of course, as you may know, my company is Andrews & Arnold Limited, and like other companies with an ampersand in the company name, we have the occasional issue. Some times it is silly things like a delivery address on a parcel saying Andrews & Arnold Ltd or some such, but some times it is more severe, such as BTs back end systems simply not working for us initially as they forgot to escape the ampersand in XML.

I should not have been surprised, obviously, that the new confirmation of payee system would have issues. I am however shocked at quite how bad it is, and how it seems that several different banks are broken in different ways.

First off, the good guys - Lloyds bank. The app allows me to enter Andrews & Arnold Ltd as the company name, and confirms it is correct - yay!

 

Well done Lloyds, but other banks are more of a challenge!

Barclays web page was OK, but the app does not allow you to even type an ampersand in the name. This is crazy as an ampersand is not some new fangled unicode emoji, but something that is valid in ASCII, BACS, Fast Payments, even old fashioned mechanical typewriters. Apparently it dates back to the 1st century AD!

It seems Nat West mobile app allows an ampersand but then does not match, and we have reports of the same from Co-op bank.

The other odd issue is that when the account does not match, in some cases, the actual account name is advised, and you can pick that. The problem is that what gets advised is ANDREWS ARNOLD LIMITED,ANDREWS ARNOLD LTD



Of course, this long string with something like our name (missing ampersand) twice, does not then match even though it is what was suggested.

The solution?


Update1: By the end of the day of reporting this, Monzo had made a change that helps. The suggested name is now just ANDREWS ARNOLD LIMITED, and using the suggested name now works. This should stop customers having problems as they don't have to ignore the warning now.

Monzo are still working on the ampersand in the suggested name.
Barclays have not said any more, but obviously they need to allow ampersand to be typed.

P.S. It will be fun if ever Companies House allow unicode... Andrews ⅋ Arnold, anyone?

QR abuse...

I'm known for QR code stuff, and my library, but I have done some abuse of them for fun - I did round pixels  rather than rectangular, f...