Validating IBANs and Bank Details at Checkout: Check Digits Are Not Account Checks

What the check digits actually do

The IBAN standard, ISO 13616, builds the number from country code, check digits, and the domestic account identifier. Validation rearranges the string, converts letters to numbers, and runs a mod 97 calculation that must return a remainder of one. That arithmetic catches transposed digits and most single character errors with remarkable reliability, entirely offline, in milliseconds.

It also validates length per country, since IBAN lengths are fixed within each country though different between them, and basic bank code structure where directories are available. All of that proves exactly one thing: the string is a plausible IBAN, typed correctly. The account's existence, status, and ownership live behind bank systems a format check cannot reach.

Ownership and existence need a different tool

Account verification services query bank networks or use confirmation of payee style checks where available, matching the name on the account against the name provided. Micro deposit verification works too, slowly: small test credits the user reports back. Each method trades speed, cost, and coverage differently, and none of them is the mod 97 check wearing a bigger coat.

For payouts, the strongest common pattern is layered: format validation at entry, a name match or verification service before the first payment, and step up checks when details change. Detail changes are the fraud moment, a compromised account swapping in new bank details the day before a large payout. The validation that matters most happens then, not at signup.

Typing experience decides error rates

Most IBAN errors are human, not fraudulent: thirty characters copied from a statement invite slips. Format the field in blocks of four as the user types, accept pasted strings with spaces stripped, and validate on entry with a specific message, this IBAN fails its check digits, rather than a red box and a shrug. Country aware length hints stop the commonest error of all, the truncated paste.

Offer the domestic alternative where customers know it better. In several markets people know their local bank code and account number cold and have never seen their IBAN. Converting domestically entered details to IBAN behind the scenes, with the conversion shown back for confirmation, produces fewer errors than demanding the format the back office prefers.

Storing bank details is its own obligation

Bank account data at rest needs encryption, access logging, and a retention reason, because a breach of payout details is a direct financial harm, not an abstract privacy event. Mask stored IBANs in every interface, showing only the last characters, and treat any support request to read a full IBAN aloud as the social engineering attempt it often is. Validation gets the data in cleanly. Governance keeps it from leaving the same way.

Keep reading

Related guides on this site: Address Autocomplete: When the Helpful Dropdown Picks the Wrong Address Date Input Validation: Why Date Fields Break More Forms Than Any Other https://validatorwall.com/blog/index.md.

Frequently asked questions

What does IBAN validation check?

Structure and typing accuracy. An IBAN contains check digits verified by a mod 97 calculation, plus a country specific length and format. Passing validation means the string is a plausible, correctly transcribed IBAN. It does not prove the account exists or belongs to a particular person.

How long is an IBAN?

Length is fixed per country but varies between them, from 15 characters in some countries to over 30 in others. Validation should therefore be country aware: the same string length can be correct for one country code and impossible for another.

How can a business verify account ownership?

Through account verification services that query bank networks, confirmation of payee style name matching where available, or micro deposit verification. These are separate from format validation and are typically applied before a first payout and whenever bank details change.

Why format an IBAN field in blocks of four?

Because long unbroken strings cause transcription errors. Grouping characters in fours, matching how IBANs are printed on statements, accepting pasted input with spaces, and validating immediately with specific error messages measurably reduce failed entries.