How to check if an IBAN is valid: what the mod-97 checksum tells you

You are about to send money abroad, someone hands you an IBAN, and you want to know it is right before you trust it with a payment. “Valid” has a precise meaning here, and it is worth understanding both what the check proves and, more importantly, what it does not.

TL;DR: An IBAN is valid when two things hold: its length matches what its country code requires, and its two check digits agree with a calculation called mod-97 run over the rest of the number. That reliably catches typos. It does not, and cannot, prove the account is open or belongs to anyone in particular.

Two things make an IBAN valid

Validation has two halves, and a real IBAN has to pass both.

The first is length. Every country fixes the exact length of its IBANs. Germany is always 22 characters, the UK 22, France 27, the Netherlands 18, Spain 24. If a number starts with DE but is not 22 characters once you strip the spaces, it is wrong, full stop, before you do any math.

The second is the checksum. The two digits sitting right after the country code are not part of the account number. They are a check value calculated from everything else in the IBAN. If even one other character is off, those two digits no longer match, and the number is rejected. That second test is the mod-97 check, and it is worth seeing how it actually runs.

How the mod-97 check works

The method comes from a standard called ISO 7064, and you can do it by hand on a short example. There are three steps.

Move the front to the back. Take the first four characters, the country code and the two check digits, and move them to the end of the string. So DE89 3704 0044 0532 0130 00 becomes 3704 0044 0532 0130 00 DE89.

Turn letters into numbers. The country code letters are now at the end, and letters are not allowed in the arithmetic. So each letter becomes a two-digit number by its position in the alphabet: A is 10, B is 11, C is 12, and so on up to Z, which is 35. D becomes 13, E becomes 14, so DE89 turns into 13 14 89.

Take it modulo 97. You now have one very long string of digits. Read it as a single integer and divide by 97. If the remainder is exactly 1, the checksum is correct and the IBAN passes. Any other remainder means it fails.

That is the whole check. The remainder-of-1 rule is what every validator, including the IBAN validator at finance.hivly.net, is doing under the hood. The numbers are big, so software handles them, but the logic is simple enough to follow on paper.

Why this catches almost every typo

The reason mod-97 was chosen is that it is unusually good at catching the mistakes humans actually make. Change a single character, and the remainder almost never stays at 1. Swap two adjacent characters, the classic transposition error, and again the checksum breaks. The math is sensitive to exactly the slips a tired person makes copying a long number off a screen.

So when a payment form accepts your IBAN, it is telling you the number is internally consistent: the right length, legal characters, and a checksum that agrees with the rest. That rules out the overwhelming majority of typos in one quiet step.

What a valid IBAN does not prove

Here is the part that trips people up. Passing validation does not mean the money will arrive at the right place. It means the number is well-formed. Those are not the same thing.

Two gaps remain. First, a valid IBAN might point at an account that is closed, or one that never received the funds for some other reason. Validation never contacts the bank, so it cannot know. Second, and more dangerous, you can mistype your intended IBAN into a different number that also happens to be valid. The checksum is happy, the length is right, and the money goes to a real account that simply is not the one you wanted.

This is why banks increasingly run a separate name check, confirming the account holder’s name matches before releasing a transfer. The IBAN checksum is the first line of defence against fumbled fingers; the name check is the second line against sending to the wrong real person. Validate the number to catch the typos, then rely on the name confirmation, not the checksum, to prove you have the right account.