Does confirmation of payee identify the actual user?¶

No. It compares an entered name with the receiving institution's account name; it does not observe who logs in, operates the endpoint or moves funds onward.

Account name and operator can diverge¶

Joint, business, mule and compromised accounts can return valid matches. An offender may use a real name or an associate's correctly named account. The result says nothing by itself about login, device possession or ultimate benefit.

Move from warning to access evidence¶

Preserve the exact result, entered details, time, wording and user response. A mismatch ignored by the payer may be relevant to what they saw and believed, but needs the surrounding instructions and circumstances.

Obtain holder and authorised-user data, logins, endpoints, IP-related records, security events and onward transactions from the receiving bank. Report only that the names matched under the service unless that wider evidence identifies the operator.