Before you pay a new supplier

The vendor form has two identifiers that matter: a VAT number and an IBAN. Validate both and you know each is well formed, and the VAT number is registered. You do not know the thing accounts payable actually needs to know before the first transfer: do they belong to the company you think you are paying?

That is a name question, and it is where payment diversion fraud lives — the email announcing a supplier’s “new bank details”, the lookalike company, the account opened last week. This page is about what each field can and cannot answer, with one measurement nobody seems to publish: which member states will actually tell you the name behind a VAT number.

What a VAT number can say about its holder

VIES answers “is this number registered?” everywhere. Whether it also tells you who holds it depends on the member state — and the VIES interface offers two ways, returning the holder’s name, or checking a name you send (“approximate matching”: traderNameMatch of VALID, INVALID or NOT_PROCESSED).

We asked VIES directly, on 24 September 2026, for one VAT number per member state that VIES itself confirmed as valid, sending a deliberately wrong company name:

Spain’s check is a real one, and tolerant where it should be: for the same number, “TELEFONICA, S.A.”, “TELEFONICA SA” and “Telefonica” all came back VALID; “TELEFONICA DE ESPANA SAU” — a different company in the same group — came back INVALID. That last case is exactly the lookalike a diversion attempt uses.

Germany is the gap that matters. It is the largest B2B market in the Union, and VIES tells you only that a German number is registered — never whose it is. For a German supplier, the name has to come from somewhere else: the Handelsregister, the invoice, a call to a number you already had.

Asking VerifNow

Send the name you expect with the number, and the answer comes back whichever row the member state is in:

POST https://api.verifnow.io/api/v1/validate/vat
 
{ "value": "ESA28015865", "traderName": "Telefonica" }

"vatDetails": { "registered": true, "trader_name_match": "MATCH", "trader_name_match_source": "VIES" }

• Where VIES publishes the name — the thirteen — VerifNow compares it with yours, ignoring case, accents, punctuation and the common legal forms, and says "trader_name_match_source": "VERIFNOW".
• Spain — VerifNow has VIES check your name, and says "VIES".
• Germany — "trader_name_match": "NOT_AVAILABLE", and no source: nobody compared anything.

A MISMATCH is a question, not a verdict — “Google Ireland Ltd” matches “GOOGLE IRELAND LIMITED”, but a trading name, a brand or a new legal name will not. It is also still one validation against your quota.

What the IBAN adds

An IBAN check tells you the number is possible in its country and correctly typed, and whether a SEPA credit transfer can reach it (ibanDetails.sepa). It says nothing about the holder: no validator can, from the number alone.

It does give you one comparison for free — the country:

VAT number  DE…  (registered in Germany)
IBAN        LT…  (an account in Lithuania)

A German company paid into a Lithuanian account is not proof of fraud. Groups centralise treasury, fintech accounts carry the provider’s country code, and plenty of legitimate businesses bank abroad. But it is the combination that should stop an automatic payment run and send a human to the phone — especially when it appears on an existing supplier’s changed bank details, which is the shape most diversion attempts take.

Two codes need translating before you compare: VIES calls Greece EL where the IBAN says GR, and a Northern Ireland VAT number (XI) comes with a UK IBAN (GB).

The name check that matters is the bank’s

Since 9 October 2025, a payer’s bank in the euro area must check, before you authorise a credit transfer, whether the IBAN and the payee name you entered match — Verification of Payee, introduced by the Instant Payments Regulation (EU) 2024/886, Article 5c. Banks in member states outside the euro must follow by 9 July 2027.

The bank answers in three ways: a match; an “almost” match, where it must show you “the name of the payee associated with the payment account identifier”; and no match, where it must warn that paying “might lead to transferring the funds to a payment account not held by the payee indicated by the payer.”

That is the check that actually binds the account to a name, done by the only party that knows who holds the account. Two things about it matter to an accounts payable team:

• It comes at payment time, not at onboarding. A supplier record can sit with the wrong IBAN for months before the first transfer surfaces it.
• Businesses can switch it off for batch payments. Article 5c(6) lets payers “that are not consumers” opt out “when submitting multiple payment orders as a package” — which is how most supplier payment runs are sent. If yours are, the bank’s name check may never run on them.

Putting it together

Neither field proves ownership on its own. Together, at onboarding, they give you a short list of things worth a human look before the first payment:

import { VerifNow } from '@verifnow/sdk';
 
const client = new VerifNow({ apiKey: process.env.VERIFNOW_API_KEY! });
 
/** VIES and IBANs disagree on two country codes. */
const ibanCountryOf = (vatCountry: string) => ({ EL: 'GR', XI: 'GB' } as Record<string, string>)[vatCountry] ?? vatCountry;
 
export async function checkNewSupplier(supplier: { name: string; vatNumber: string; iban: string }) {
  const [vat, iban] = await Promise.all([
    client.validateVat(supplier.vatNumber, { traderName: supplier.name }),
    client.validateIban(supplier.iban),
  ]);
  const flags: string[] = [];
  const v = vat.vatDetails;
 
  if (!v?.formatValid) flags.push(`VAT number: ${vat.message}`);
  else if (v.registered === false) flags.push('VAT number is not registered in VIES');
  else if (v.registered === null) flags.push(`VIES could not confirm the registration (${v.source}) — re-check`);
 
  if (v?.traderNameMatch === 'MISMATCH') {
    flags.push(v.traderName
      ? `VIES names the holder "${v.traderName}"`
      : 'VIES says the holder is not this company');
  } else if (v?.registered && v.traderNameMatch === 'NOT_AVAILABLE') {
    flags.push(`No name check is possible in ${v.countryCode}: confirm the name elsewhere`);
  }
 
  if (!iban.valid) flags.push(`IBAN: ${iban.message}`);
  else if (iban.ibanDetails?.sepa === false) flags.push('The account is outside SEPA');
 
  const ibanCountry = iban.ibanDetails?.countryCode;
  if (v?.countryCode && ibanCountry && ibanCountryOf(v.countryCode) !== ibanCountry) {
    flags.push(`Account in ${ibanCountry}, VAT registration in ${v.countryCode}`);
  }
 
  return { flags, viesName: v?.traderName };
}

An empty list is not a guarantee, and a non-empty one is not an accusation. What turns a flag into a decision is the control every payment fraud guide ends on: confirm new or changed bank details through a channel you already had — a phone number from your records, not from the email that announced the change.

In short

• A valid VAT number and a valid IBAN are two facts about two numbers, not proof they belong to your supplier.
• VIES returns the holder’s name in 13 of the 15 member states we tested, checks a name you send in one (Spain), and does neither for Germany. VerifNow answers trader_name_match for all fourteen.
• The IBAN’s country against the VAT country is a free comparison; a mismatch on changed bank details deserves a call.
• The bank’s Verification of Payee binds account to name — at payment time, and not at all for batch payment files a business chose to exempt.

Where this leaves you

Supplier onboarding is the same two fields as billing, read from the other side. The registration check, the name comparison in fourteen of the fifteen member states we measured, the account’s country and its SEPA reach come from one API key and one call each. The phone call stays yours.

• VAT number and IBAN in one call — the same two fields when you are the one invoicing
• Validate VAT · Validate IBAN
• How often is VIES actually down? — why registered can be null

Sources: VIES REST API contract  (European Commission) · Regulation (EU) 2024/886 on instant credit transfers , Article 5c · VIES queries by VerifNow, 24 September 2026