IBAN Explained: How to Read, Check and Trust an IBAN

One string, three jobs

An IBAN — International Bank Account Number — looks like an account number that got out of hand. In fact it's three things welded into one string: a country code, a pair of check digits, and the account's domestic numbering, packed together so that a bank anywhere in the world can read it and can tell before sending anything whether it was copied correctly. The format is defined by the ISO 13616 standard, and it's used across Europe and in dozens of other countries.

Two properties surprise people. First, the length isn't fixed globally: an IBAN runs from 15 characters (Norway) up to a maximum of 34, but within one country every IBAN is exactly the same length — every German IBAN has 22 characters, every French one 27. Second, the spaces are cosmetic: printed in groups of four on paper to make copying easier, removed in electronic form. Both forms are the same number.

Reading one, segment by segment

Take the standard textbook example, a German IBAN: DE89 3704 0044 0532 0130 00. It reads left to right in three parts. The first two letters are the country code — DE for Germany. The next two digits, 89, are the check digits, and they're the clever part of the whole design. Everything after that is the BBAN, the domestic part, which each country arranges differently. Germany's BBAN is an 8-digit bank code (the Bankleitzahl) followed by a 10-digit account number.

Other countries slice the BBAN their own way. A British IBAN such as GB29 NWBK 6016 1331 9268 19 hides a familiar pair inside it: the 6-digit sort code 60-16-13 and the 8-digit account number 31926819, behind a 4-letter bank identifier. France's 27 characters carry a bank code, a branch code, an 11-character account part — which can contain letters — and two national check digits. The shell is standard; the filling is local, which is why a structure breakdown helps: forms that ask for the bank code and account number separately are asking for pieces the IBAN already contains.

The mod-97 check, step by step

The two check digits aren't decoration or a serial number. They're computed from the rest of the IBAN with an algorithm called mod-97, and any bank or validator can rerun the same calculation to test an IBAN in milliseconds:

1. Strip the spaces and check the length against the country's fixed length. A German IBAN with 21 or 23 characters is wrong before any maths happens.
2. Move the first four characters — country code and check digits — to the end of the string.
3. Convert every letter to a number: A becomes 10, B is 11, and so on up to Z at 35. Digits stay as they are.
4. Divide the resulting long number by 97 and keep the remainder. (Software does this in chunks, since the number can run to 30-plus digits.) A valid IBAN always leaves a remainder of exactly 1.

Try it against the example above and you get 1. Now change the final digit from 0 to 1 and run it again: the remainder comes out at 28. Swap two neighbouring digits in the account part instead, and it fails too. That's the point of the design — a single mistyped digit, or two digits transposed while copying, breaks the checksum essentially every time, so the error gets caught by the sender's bank, or by a validator like the one below, before money moves rather than after.

What a green tick doesn't prove

Here's the limit, and it matters more than the maths. A passing IBAN is internally consistent. Nothing more. Validation doesn't prove the account exists, that it's open, or that it belongs to the person you mean to pay. A well-formed IBAN pointing at the wrong person will pass every check on this page and still send your money to them — and payments sent to a valid account are usually hard to pull back.

Invoice fraud exploits exactly this: the fake invoice carries the fraudster's own perfectly valid IBAN. So treat validation as a typo filter, not a trust stamp. For a new payee or changed bank details — especially on a large payment — confirm the details through a second channel you already trust: a phone call to a number you already have, not one printed on the invoice that just arrived. Send a small test payment first where the amount justifies it. The checksum catches your typos. Only you can catch someone else's intentions.

Small habits that prevent expensive typos

Most IBAN errors are boring: a dropped digit in the long account section, a 0 read as an O. Copy and paste instead of retyping whenever you can. If you must type it, work in the printed groups of four and count the characters at the end against the country's length — the validator below tells you the expected length, which turns "looks about right" into a definite yes or no. And if a check fails, don't nudge digits until it passes; a number you've edited into validity is worse than one that fails loudly. Go back to the source document. One more boundary worth knowing: not every country uses IBANs at all — the United States, for instance, routes payments with a 9-digit routing number plus a domestic account number.