How to Validate an IBAN: The Mod-97 Check, Common Errors and What Validation Cannot Prove

Validating an IBAN is one of the few checks in everyday finance that is both powerful and widely misunderstood. It is powerful because a short calculation can catch most typing errors before money is sent, saving the delay, fees and anxiety of a failed or misdirected payment. It is misunderstood because a result that says valid is often taken to mean much more than it actually means. This guide explains what an IBAN validator actually does, walks through the mod-97 check in plain language, names the errors it catches and the errors it misses, and states clearly what validation cannot prove. The IBAN Validator on this site performs the format and mod-97 checks; it does not contact a bank, and it cannot confirm an account holder.

The validation process has three stages. First, the IBAN is normalised: spaces are removed and letters are converted to upper case, so that a human-readable grouping does not affect the result. Second, the country code and expected length are checked against the known format for that country, and the characters in each field are checked for the right type. Third, the mod-97 check itself is run. That check works by moving the first four characters of the IBAN to the end, converting each letter to a two-digit number where A equals 10, B equals 11, and so on through Z equals 35, and then dividing the resulting long number by 97 and looking at the remainder. A correctly formed IBAN leaves a remainder of exactly 1. The check digits in positions three and four are calculated to make that true, which is why changing almost any digit breaks the check.

Work through the idea with a clearly labelled sample IBAN for Germany, which is a documentation example and not a real person's account: DE89 3704 0044 0532 0130 00. Remove the spaces to get DE89370400440532013000, which is 22 characters, the correct length for Germany. The country code is DE, the check digits are 89, the eight-digit bank code is 37040044, and the ten-digit account number is 0532013000. To run the mod-97 check, move DE89 to the end and convert the letters: D becomes 13 and E becomes 14, so the rearranged numeric string begins with the bank and account digits and ends with 131489. Dividing that long number by 97 leaves a remainder of 1, which is why the sample passes. You do not need to do that long division by hand, and indeed for a 22-character IBAN the numeric string is far too long for ordinary mental arithmetic, but understanding the steps explains why the check is so effective: it ties every character, including the check digits, into a single arithmetic condition.

The errors that mod-97 catches are the errors people actually make. A single wrong digit changes the remainder and fails the check. Swapping two adjacent digits usually changes the remainder as well, although a small number of transpositions can slip through any check-digit scheme. Omitting or duplicating a digit changes the length and fails before the arithmetic even starts. Entering the IBAN for the wrong country, or mixing the bank code of one account with the account number of another, will almost always fail the check, because the check digits were calculated for the original combination. That is why validators are valuable at the point of entry: they catch the mistake while it is still cheap to fix, by asking the sender to re-enter the details, rather than after the payment has been sent.

The errors that validation misses are just as important. First, a validator cannot detect a completely different but correctly formed IBAN: if a fraudster substitutes their own valid IBAN for the intended payee's, the validator will happily report it as valid, because it is valid as a string. Second, a validator cannot tell you whether the account is open, closed, frozen, or able to receive your currency. Third, it cannot confirm the account holder's name, so it cannot catch a payment to the right bank but the wrong person. Some banks now offer confirmation-of-payee services that compare the name you enter with the name on the account, and where such a service is available it should be used in addition to, not instead of, IBAN validation. The two checks answer different questions, and both are needed for a safe payment.

Good practice for senders follows directly from those limits. Always copy the IBAN from a trusted source, such as the payee's bank statement, invoice from a verified supplier, or secure portal, and check it character by character rather than relying on memory or on a message that could have been tampered with. Run the validator, and if it fails, stop and re-confirm the details through a separate channel, such as a phone call to a number you already have, rather than replying to the message that supplied the suspect details. If it passes, still confirm the payee name, the amount, the currency and any reference, because those are outside the validator's scope. For large or first-time payments, many businesses send a small test payment first and confirm receipt before sending the full amount, which is a practical extra layer of protection.

There is also a privacy point worth making. An IBAN validator that runs in your browser does not need to send your IBAN to a server to perform a format check, and a well-designed tool will not do so. Even so, you should avoid pasting real IBANs into untrusted websites, screenshots or public forums, and you should treat any site that asks for additional personal or banking details alongside a validation as suspicious. Validation requires only the IBAN string itself. If a site asks for passwords, card numbers or one-time codes in connection with an IBAN check, close it and report it through the appropriate channel, because no legitimate validator needs those details.

In short, IBAN validation is a necessary but not sufficient condition for a safe payment. It answers the question, is this string internally consistent and correctly formed for its country? It does not answer the question, is this the right account for the right person? Keeping those two questions separate is the key to using the validator well. Run the check every time, treat a failure as a stop signal, and treat a pass as permission to proceed to the next checks, namely payee confirmation and amount confirmation, rather than as a guarantee that the payment will reach the intended recipient.

Try it next: use the iban-validator with your own figures, then compare with the IBAN Format Guide and the Canada Bank Transit Number Validator. For background reading, see Bank Account Masker Guide.