How IBAN Validation Works (and How to Catch a Typo Before You Wire Money)
An IBAN validates by rearranging its digits into one long number and checking that number against a fixed rule: divide it by 97, and the remainder must be exactly 1. That single arithmetic check, defined in ISO 13616 and called MOD-97, is why banks can reject a mistyped account number in a fraction of a second, before any money moves.
What’s actually inside an IBAN
An IBAN is not a random string. It’s built from three fixed parts, in this order:
- A 2-letter ISO country code (
DEfor Germany,FRfor France,GBfor the UK). - 2 check digits, the ones the MOD-97 formula validates against.
- The BBAN (Basic Bank Account Number): a bank code and an account number, whose exact length and internal format is set per country. Germany’s BBAN is 18 characters, France’s is 23, and they’re not split up the same way internally.
It’s worth being precise about what an IBAN is not. It is not a BIC (also called a SWIFT code). A BIC identifies the bank itself, a specific institution and branch, while the IBAN identifies the account at that bank. International transfers often ask for both, and they’re not interchangeable: you can have a perfectly valid IBAN and still send money to the wrong bank if the BIC is wrong, or vice versa.
It’s also not proof that an account is open or belongs to a particular person. An IBAN can pass every structural check described below and still refer to a closed account, or one that belongs to someone other than the person who gave it to you. Structural validity and account validity are two different questions, and only the receiving bank can answer the second one.
The MOD-97 checksum, worked step by step
Take a real, valid German IBAN, the one commonly used worldwide as the canonical example: DE89 3704 0044 0532 0130 00.
Step 1: Strip the spaces and move the first 4 characters to the end.
DE89 3704 0044 0532 0130 00 becomes DE893704004405320130 00, and moving DE89 to the back gives:
370400440532013000DE89Step 2: Convert each letter to a number. The rule is A=10, B=11, C=12, and so on up to Z=35. That makes D=13 and E=14. Substituting those into the rearranged string turns it into a pure 24-digit number:
370400440532013000131489Step 3: Divide that number by 97 and check the remainder. You can do this digit by digit without needing a calculator that handles 24-digit numbers: keep a running remainder, and at each new digit compute remainder = (remainder × 10 + digit) mod 97. Carried all the way through, the final remainder for this number is exactly 1. ISO 13616 requires that remainder to equal 1 for the IBAN to be structurally valid, so this one passes.
Now change one digit. Take the same IBAN and flip the very last digit, 0 to 1: DE89 3704 0044 0532 0130 01. Run the identical three steps and the 24-digit number becomes 370400440532013100131489. Divide that by 97, and the remainder comes out to 28, not 1. The checksum fails immediately, and a validator flags the IBAN as invalid before it ever reaches a bank’s transfer system.
| Original IBAN | With one digit changed | |
|---|---|---|
| IBAN | DE89 3704 0044 0532 0130 00 | DE89 3704 0044 0532 0130 01 |
| Rearranged 24-digit number | 370400440532013000131489 | 370400440532013100131489 |
| Remainder mod 97 | 1 | 28 |
| Result | Valid | Invalid |
That’s the whole mechanism. A single mistyped digit changes the 24-digit number enough that it almost never lands back on a remainder of 1, which is exactly why this checksum catches nearly every fat-finger error, transposed pair of digits, or dropped character before a wire transfer goes out.
Check your own IBAN
Paste any IBAN below and the tool runs the same three steps automatically, along with a length check against the account’s country.
Common mistakes
Assuming any string starting with 2 letters and roughly the right length is a valid IBAN. Each country has exactly one fixed length, not a range. Germany is 22 characters, France is 27, Spain is 24, the UK is 22, and Norway is the shortest IBAN in use at just 15 characters. A number that’s one character too long or short for its country fails regardless of what the checksum says.
Confusing an IBAN with a BIC/SWIFT code. These are two separate identifiers that serve two separate purposes, and plenty of international transfer forms ask for both at once. Sending the BIC where the form wants the IBAN (or the reverse) will get the transfer rejected or, worse, routed incorrectly.
Assuming a passing checksum means the account exists or belongs to the right person. The MOD-97 check only proves the number is mathematically well-formed. It says nothing about whether the account is open, whether it belongs to the person or company you intend to pay, or whether the bank code within it maps to a real branch. Verifying the actual recipient is a separate step that only the receiving bank can do.
Typing O instead of 0, or I/l instead of 1. Many countries do allow real letters inside the BBAN portion of an IBAN, so a letter appearing there isn’t automatically wrong. But when people copy an IBAN by hand from a printed document or dictate it over the phone, this is one of the most common places a genuine error slips in, and it’s worth reading the character back carefully rather than assuming it’s a typo either way.
Frequently asked questions
What is MOD-97? It’s the checksum method defined in ISO 13616 for validating IBANs. It works by moving the first four characters of the IBAN to the end, converting every letter to a two-digit number (A=10 through Z=35), and dividing the resulting large number by 97. A valid IBAN always leaves a remainder of exactly 1.
Does a passing MOD-97 check mean the account is real and active? No. It only confirms the number is structurally correct, that is, the right length for its country and mathematically consistent with the checksum rule. Whether the account actually exists, is still open, and belongs to the person or business you expect to pay is something only the receiving bank can confirm, typically at the moment the transfer is processed.
Why do different countries have different IBAN lengths? Each country designed its own BBAN format before IBAN was standardized internationally, based on how its domestic bank codes and account numbers were already structured. Norway’s domestic account numbers are short, so its IBAN comes out to 15 characters. Germany’s bank code and account number scheme is longer, landing at 22. The length is fixed per country and registered internationally, which is exactly what lets a validator cross-check a number’s length against its country code as a second, independent test.
Can the MOD-97 checksum catch every possible typing mistake? It catches the overwhelming majority of real-world errors: a single wrong digit, a dropped or added character, and pretty much any single-digit transposition all change the resulting number enough to break the remainder-of-1 requirement. It is not a mathematical guarantee against every conceivable error, though. In principle, a rare, specific combination of altered digits could produce a different 24-digit number that still happens to leave remainder 1, slipping through the checksum untouched. In practice, this kind of coincidental match is uncommon enough that it’s not the failure mode worth worrying about; the checksum’s job is catching ordinary human error, and it does that reliably.