🏦 IBAN Validator

How the IBAN check digits work, and what they cannot tell you

An IBAN carries its own error detection. The two digits after the country code are a checksum calculated from everything else, so a single mistyped character almost always makes the whole number fail a simple arithmetic test. That test is defined in ISO 13616 and it is what this page runs — locally, in your browser, without the number leaving your device.

Move the first 4 characters to the end → letters to numbers (A=10 … Z=35) → mod 97 must equal 1

The mod-97 scheme was chosen because it catches every single-character error and almost every transposition of two adjacent characters, which are the two mistakes people actually make when copying an account number by hand.

What an IBAN is made of

Only the first four characters are standard across countries. Everything after them is the national account number in whatever structure that country already used, padded to a fixed length. That is why the total length varies: 15 characters in Norway, 24 in Spain, 31 in Malta.

Length by country

Checking the length first is worth doing, because a wrong length is almost always a missing or duplicated character and is easier to spot than a checksum failure. If the country code is not in the list, this tool still runs the checksum and says so rather than guessing.

What a valid IBAN does not prove

This is the important limitation, and it is the reason invoice fraud works. A valid IBAN means the number is internally consistent. It does not mean the account exists, it does not mean it is open, and above all it does not mean it belongs to the person you think you are paying. A fraudster who changes the bank details on an invoice will supply a perfectly valid IBAN — their own.

No offline check can tell you the account holder. Some countries now run confirmation-of-payee services where the bank compares the name you type against the name on the account, and in the EU the instant payments regulation requires this verification for euro transfers. Where it exists, use it. Where it does not, phone the supplier on a number you already had — not one printed on the invoice — before paying new details.

The single most effective habit: treat any email that changes payment details as suspect until confirmed by voice. Checksum validity is reassurance about typing, not about trust.

BIC, SWIFT and why you often no longer need one

A BIC, also called a SWIFT code, identifies the bank rather than the account: 8 or 11 characters covering the institution, country, location and optionally the branch. For transfers within the SEPA area the BIC has not been required since 2016, because the IBAN already contains the bank identifier. Outside SEPA, it is usually still needed.

A BIC cannot be meaningfully validated offline beyond its format, because there is no checksum in it — the only real check is against the official registry.

A worked example

Take ES91 2100 0418 4502 0005 1332. Move ES91 to the end, giving 210004184502000513 32ES91, then replace E with 14 and S with 28. The resulting number divided by 97 leaves a remainder of 1, so the IBAN is structurally valid. Change the final 2 to a 3 and the remainder becomes something else, and the check fails — which is exactly what you want it to do.

If the number here raised another question, it is probably one of these: the currency converter or the invoice generator.

Frequently Asked Questions (FAQs)