How to Check That Bank Transfer Details Aren't Forged
A fabricated IBAN usually fails the built-in mod-97 check — but the real risk today is invoice-redirection fraud, where a real IBAN belongs to a criminal who has intercepted the invoice. Here is how to verify payment details before you send.
How an IBAN is built
The International Bank Account Number is defined by ISO 13616. It starts with a two-letter ISO country code, two check digits, then the Basic Bank Account Number (BBAN) which is country-specific — for example 20 digits in France, 22 in Germany, 27 in Italy. Total length is fixed per country.
The two check digits use the mod-97 algorithm: rearrange the country and check digits to the end, replace letters with numbers (A=10 … Z=35) and compute the integer mod 97. A valid IBAN always yields a remainder of 1. This is why a random string of characters, or a single digit swapped by accident, almost never passes as a valid IBAN. It doesn't prove the account exists — it proves the number is well-formed.
The BIC (SWIFT code) identifies the bank itself: 8 or 11 characters combining institution, country and branch. Within the EU/EEA the BIC is optional for SEPA transfers since 2016 — the IBAN alone is sufficient — but it is still often required for cross-border transfers outside SEPA.
The real threat: invoice redirection
The fraud that costs European businesses hundreds of millions of euros a year is not a wrong IBAN — it is Business Email Compromise (BEC), also called invoice-redirection fraud. Attackers gain access to an email account (either the payer's or the supplier's), watch for a pending invoice, then send a lookalike email announcing that the supplier has 'changed bank details' and asking that payment be sent to a new IBAN. The new IBAN is real and passes every checksum — it just belongs to the fraudster.
The pattern is easy to spot once you know it. The email arrives late in the process, often in the final week before a large payment. The domain is a near-lookalike (an extra letter, a swapped .com/.eu). The message emphasises urgency and asks not to call, only to reply by email. In many cases the supplier's real employee is copied but never actually receives the message.
A verification checklist
Use these six steps before any first-time transfer or any transfer where bank details have changed:
1. Confirm the IBAN passes the mod-97 check — most online banking apps do this automatically. If it fails, reject immediately.
2. Verify the account holder name using Verification of Payee where offered (mandatory for euro credit transfers in the euro area since 9 October 2025).
3. If the beneficiary just changed bank details, call the supplier on a phone number obtained independently — the supplier's website, a previous invoice, the phone book — never the number in the new email.
4. For large payments, send a small test transfer first and wait for the supplier to confirm receipt before releasing the balance.
5. Look at the sender's email domain character by character; hover over links to check the true URL.
6. Never approve a change of bank details on the strength of a single email, even from a trusted address. Require dual confirmation.
Frequently asked questions
- A checksum defined in ISO 13616: rearrange the IBAN, convert letters to numbers, take the integer modulo 97. A valid IBAN always yields 1. Random or mistyped IBANs almost never satisfy this — a cheap first filter.
Related on Banks.eu
Informational purpose only. Rates and product terms change frequently — always verify with the issuing institution before opening an account. Some links may be affiliate or partner links and never influence editorial rankings.
