Most payment fraud does not involve a hacked account. It involves a real user paying a real-looking payee whose bank details changed last week. The payment approval catches nothing, because the payment matches the invoice. The control has to sit on the payee.
How payees work in Xace
A payee is a saved recipient. In Xace, payees belong to one account: a payee on your EUR account is not automatically on your GBP account. That keeps each list short and stops one entity's supplier being paid from another entity's funds by mistake.
When you add a payee you pick Person or Business, enter the name and account details, and can set a default reference and payment purpose. Get the name exactly right. It is checked against the receiving bank.
The name check
On GBP payments this is Confirmation of Payee. On euro payments it is Verification of Payee, which Xace runs across its SEPA flows from 9 October 2025. Either way, you see one of three results when you create or approve a payment:
- Match - name and account line up.
- Close Match - similar but not identical. Often a trading name versus a legal name. Check before you continue.
- No Match - they do not correspond. Stop, and verify through a channel you already trust, never the contact details on the invoice.
The check informs, it does not block. The result is logged against the payment so compliance can see what was decided.
Two things to know. File and batch uploads skip the check, so control where those files come from. And a Match proves the account belongs to the name you typed, not that the name is who you think it is.
Put payee changes behind approval
Three policies, under Team → Approval Policies:
- Payee creation - one approver. The single most effective anti-fraud control on the platform.
- Payee update - one approver, ideally not the person who handles supplier requests. Always confirm a bank-detail change by phone on a number you already hold.
- Payee deletion - one approver, so the log shows who removed what.
These apply on top of payment approvals. A user who can send £500 unaided still cannot add the payee for it alone.
Whitelisting group accounts
If you move money between group companies that bank elsewhere, Xace can whitelist those accounts to simplify fees on agreed flows. It is a premium feature arranged through support or your account manager. Review the whitelist whenever the group structure changes.
A light routine
- Every quarter: export the payee list and have someone outside AP confirm each supplier is still a supplier. Remove the rest.
- Every bank-detail change: phone the supplier. Email is not verification.
- Every Close Match: write down why you went ahead. If you cannot, do not.
- Every new entity: do not copy the payee list across. Recreate what that entity actually pays.
A few minutes a quarter and the occasional phone call. That is what closes the route most fraud actually takes.
