IBAN checker and validator

An IBAN is a two-letter country code, two check digits and a country-specific account part of fixed length. Validation confirms the country is known, the total length is right for that country, and the check digits are consistent with the rest of the number under the ISO 7064 mod 97-10 algorithm. That checksum catches all single-character errors and almost all transpositions, which is most of what goes wrong when a person types an IBAN.

Check digits of 00, 01 and 99 can never be produced by the algorithm, so they are rejected before the checksum runs. It is a small rule, and a surprising number of validators omit it.

A valid IBAN is well formed. Whether the account exists, is open and belongs to the named payee is something only the receiving bank can confirm. That gap is what payee verification services exist to close: Confirmation of Payee in the UK, and Verification of Payee, which payment providers in the euro area have had to offer on euro credit transfers since October 2025.

If your product sends payments to an IBAN, test both halves: format validation in the form, and the behaviour when the bank or the verification service reports a mismatch, a closed account or a name that does not match.

Accept the IBAN the way people copy it: with spaces, in lower case, sometimes with a trailing space from the clipboard. Normalise before validating and before storing. Display it back in groups of four, which is how people check it against a paper document. Validate in the browser for immediate feedback, and again on the server, because client-side validation is a convenience rather than a control.

Never truncate an IBAN for display without showing the country code and the last four characters, which are the parts a person uses to recognise their own account.

A BIC, or SWIFT code, is eight or eleven characters: a four-letter bank code, a two-letter country code, a two-character location code and an optional three-character branch code. An eight-character BIC refers to the primary office, equivalent to a branch code of XXX.

The second character of the location code carries meaning. A 0 marks a test BIC that cannot be used for live payments, and a 1 marks a passive participant on the SWIFT network. When a payment test fails for reasons that look like a bank refusal, the BIC is worth checking. For euro payments between EU countries an IBAN alone has been enough since 2016, so a form that insists on a BIC for one is asking for more than it needs.