Payout verification for travel agencies: ID and bank checks before you pay advisors and suppliers

Payout verification means confirming who you are paying, and that the bank account really belongs to them, before money leaves your agency. For advisors and suppliers, that takes five checks: identity, tax ID (W-9 plus IRS TIN Matching), bank account ownership, OFAC sanctions screening and, for euro payouts, the bank's name check. A call back on a known number covers bank-detail changes.

Check once, pay every week. Here is why each check matters, how it works, and a safe process for the moment a payee says "we have new bank details".

What is payout verification?

It is the set of checks you run on a payee, meaning an advisor or supplier you pay, before the first payout and again when their details change.

Payment platforms already do a version of this. Stripe says every country has rules that accounts must meet so that Stripe can pay out funds to individuals and companies, usually called Know Your Customer (KYC) rules. Your agency's own checks sit on top of that. Stripe itself tells platforms not to rely on Stripe's verification to meet any independent legal KYC or verification requirements.

Why verify before paying out?

Because one of the costliest frauds aimed at businesses targets exactly this moment. The FBI's 2025 IC3 annual report logged 24,768 business email compromise (BEC) complaints with $3,046,598,558 in reported losses. That makes BEC the second-largest loss category after investment fraud.

The FBI defines BEC as a scam targeting businesses working with suppliers and businesses that regularly make wire transfer payments. Criminals take over or fake email accounts, phone numbers and virtual meeting apps to redirect payments.

The FTC says people reported losing nearly $1 billion to business impersonators in 2025, and $3.5 billion to imposter scams overall.

Nacha, which runs the US ACH network, has a name for the pattern: payments made under false pretenses. Its definition covers business email compromise, vendor impersonation, payroll impersonation and other payee impersonations.

What identity checks do payment processors require?

Name, date of birth, address and a tax ID, at minimum. For a US company, Stripe says you might need the business's name, address and tax ID number. It also asks about the person opening the account (name, date of birth) and beneficial owners. It may request a scan of a valid government-issued ID, a proof of address document, or both.

The exact list varies by country, capabilities, business type and risk level, and Stripe publishes it per country and setup. If the information isn't provided or verified in time, Stripe temporarily pauses charges or payouts.

Banks follow the same logic under the US Customer Identification Program (CIP) rule. Before opening an account, a bank must collect at least the customer's name, date of birth, address and taxpayer identification number. It then verifies them with documents, such as photo ID, or with non-documentary methods, such as checks against public databases.

What this means for agencies: The CIP rule binds banks, not travel agencies. It is still a sensible floor for your own payee file: legal name, date of birth for individuals, address, tax ID and one verified document.

How do you check a payee's tax ID?

Collect a W-9, then confirm it with the IRS. Form W-9 is how a payee gives you their correct Taxpayer Identification Number (TIN) when you must file an information return about them. The current form is the March 2024 revision. For which advisors need a W-9 and a 1099, see W-2 and W-9 tax forms.

IRS TIN Matching then lets you validate the name and TIN combination before you file. Two conditions apply:

• You need an IRS account to apply.
• Your agency must be in the IRS Payer Account File. The IRS adds payers that filed Forms 1099 within the last 2 years to report backup withholding.

A mismatch can be a typo or an old business name. Either way, fix it before the first payout, not at tax time.

How do you verify a bank account before paying out?

Prove the payee controls the account, using one of two methods.

Instant account verification. The payee logs in to their bank through a service such as Stripe Financial Connections, which can share tokenized account numbers and ownership details.

Micro-deposits. You send one or more tiny deposits, and the payee confirms them. In Stripe's ACH flow, people who enter details by hand have 10 days to verify with microdeposits.

Payouts are covered by Nacha's newer fraud monitoring rules. Phase 1 took effect March 20, 2026 for all banks that originate ACH and for business originators with 2023 volume of 6 million entries or more. Phase 2 reached all remaining non-consumer originators, with a practical effective date of June 22, 2026.

Covered originators must establish and implement risk-based processes and procedures reasonably intended to identify ACH Entries initiated due to fraud, and review them at least annually. Nacha doesn't prescribe the method. For more on how ACH works, see ACH transfers.

What this means for agencies: If your agency sends ACH payouts from its own bank account, it is most likely a non-consumer originator, so the June 2026 phase probably applies to you. Validating payee accounts and controlling bank-detail changes are the most direct ways to show a process. Ask your bank what it expects.

Do you need to screen payees against the OFAC list?

Yes, if you are a US agency. All U.S. persons must comply with OFAC sanctions, wherever they are located. U.S. persons are generally prohibited from dealing with the individuals and entities on the SDN List, the Treasury's Specially Designated Nationals and Blocked Persons List.

OFAC's Sanctions List Search checks the SDN List and every other OFAC list at once. Screen at onboarding and before large or unusual payouts, especially to foreign suppliers.

OFAC says many potential matches identified through screening are false positives. Compare the full entry, including date of birth, nationality, addresses and ID numbers. If several identifiers line up, stop and follow OFAC's guidance before paying. Violations may result in civil and, in some cases, criminal penalties.

How does verification of payee work for euro payouts?

In the EU, the sending bank checks the name for you. Since October 9, 2025, banks in euro-area countries must offer a verification of payee service for both standard and instant credit transfers. Banks in non-euro EU countries follow by July 9, 2027. The European Commission says the check is free of charge and helps prevent mistakes and scams.

You see a match, a close match with the correct name shown, or a warning that the account might not be held by the payee you entered. You can still send. If you ignore a mismatch warning, the bank is generally not liable for a payment to the wrong account.

Two catches for agencies. Businesses can opt out of the check for payments submitted as a package, so a bulk payout file may skip it. And the rule covers only euro transfers from EU providers. A SWIFT payment from a US account gets no name check. See SEPA Instant payments and SWIFT transfers.

Payout verification checklist

How to change a payee's bank details safely

Treat every change request as suspicious until confirmed. These steps combine FBI guidance with common payment practice.

1. Never accept a change by email alone. The FBI says to verify requests to change account information through a secondary channel.
2. Call back on a number you already had. The FBI says to use previously known numbers, not the numbers provided in the e-mail request. The FTC gives the same advice: use a number or website you know is real.
3. Slow down when it is urgent. The FBI says to be skeptical of unexplained urgency regarding payment requests.
4. Re-verify the new account. Run micro-deposits or instant verification again.
5. Hold the first payout. Pay nothing to the new account for a few business days, and tell the payee the old details stay active until then. Have a second person approve the change, the secondary sign-off the FBI recommends.
6. Confirm after the first payment. Ask the payee, on the known number, to confirm the money arrived.

What this means for agencies: Steps 5 and 6 are practical guidance, not a rule. A short hold costs a supplier a few days. A redirected payout can cost you the whole amount.

What if you already paid a fraudster?

Move fast. The FBI says time is of the essence: call your bank, request a recall of the funds, and file a complaint at IC3.gov with full transaction details. Your bank will need the payment's reference number, and tracing a payment shows which one each rail uses.

Speed works. In 2025, the IC3's Recovery Asset Team handled 3,900 incidents involving $1,163,919,846 in attempted theft and froze $679,013,183, a 58% success rate.

How Tripdash handles payouts

Tripdash Pay sends weekly payouts, paid directly to your bank account. Payment tracing follows each traveler payment to the exact supplier that received the funds, and to the bank account paid out to. See how Tripdash Pay works, or read how travel agencies collect payments.

Sources

1. Federal Bureau of Investigation, IC3. 2025 IC3 Annual Report, 2025 data. Pages 9, 17, 25, 26, 59.
2. Federal Bureau of Investigation, IC3. Business Email Compromise: The $55 Billion Scam, I-091124-PSA, September 11, 2024.
3. Federal Bureau of Investigation, IC3. Business E-mail Compromise, E-mail Account Compromise: The 5 Billion Dollar Scam, I-050417-PSA, May 4, 2017.
4. FBI, FDA OCI and USDA. Criminal Actors Use Business Email Compromise to Steal Large Shipments of Food Products and Ingredients, AA22-340A, December 15, 2022.
5. Federal Trade Commission. FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025, June 15, 2026.
6. Federal Trade Commission. Keep scammers out of your business, August 7, 2025.
7. Stripe. Identity verification for connected accounts.
8. Stripe. Required verification information.
9. Stripe. ACH Direct Debit payments.
10. eCFR. 31 CFR 1020.220, Customer identification program requirements for banks, current text.
11. Internal Revenue Service. About Form W-9, March 2024 revision, page updated June 27, 2026.
12. Internal Revenue Service. Taxpayer Identification Number (TIN) Matching, page updated August 10, 2026.
13. Nacha. Risk Management Topics: Fraud Monitoring Phase 1, effective March 20, 2026.
14. Nacha. Risk Management Topics: Fraud Monitoring Phase 2, effective June 19, 2026 (practically June 22, 2026).
15. Office of Foreign Assets Control. Basic Information on OFAC and Sanctions FAQs, FAQs 9–12, 91.
16. Office of Foreign Assets Control. FAQ 5: potential matches.
17. European Central Bank. Requirements and milestones of the Instant Payments Regulation for PSPs.
18. European Commission. New EU rules make instant euro payments faster and safer, October 10, 2025.
19. European Union. Regulation (EU) 2024/886 on instant credit transfers in euro, Article 5c.