How to Validate an IBAN Number: Step-by-Step Guide

Validating an IBAN is a critical step in any payment processing system to catch malformed or mistyped values before they enter your payment pipeline. IBAN validation involves checking the format, verifying the country code, confirming the correct length, and most importantly, validating the check digits using the MOD-97 algorithm: ISO 13616-1 defines the IBAN structure, while ISO/IEC 7064 defines the MOD97-10 check-digit scheme. These checks do not prove that an underlying bank account exists, is assigned, or can receive a payment.

Step 1: Format Verification

The first step in IBAN validation is format verification. Every valid IBAN must start with a two-letter country code followed by two check digits (0-9), then the Basic Bank Account Number (BBAN). Remove all spaces and convert the entire string to uppercase before validation, as IBANs are case-insensitive but should be normalized for processing. Reject any input that contains special characters, starts with numbers, or does not follow the country-code-plus-digits pattern.

Step 2: Country Code & Length Check

Next, verify that the country code is recognized and supported by your system. Random IBAN currently supports 42 countries, including DE (Germany), FR (France), GB (United Kingdom), ES (Spain), and IT (Italy). Each country has a specific IBAN length:

If the input length does not match the specification for the given country code, the IBAN is invalid.

Step 3: MOD-97 Check Digit Validation

The most important validation step is verifying the check digits using the MOD-97 algorithm. Under a simple uniform-random-error model, an incorrect value passes with probability 1/97, giving an estimated detection rate of about 98.97%; real typo patterns can differ. The check confirms internal consistency, not the existence of an account:

1. Move the first four characters (country code and check digits) to the end — e.g., DE89370400440532013000 becomes 370400440532013000DE89
2. Replace each letter with its corresponding numeric value (A=10, B=11, ..., Z=35) — D=13, E=14 → 370400440532013000131489
3. Calculate modulo 97 — divide the resulting number by 97
4. Check the remainder — if it equals 1, the IBAN is valid

Code Example: JavaScript

This snippet checks only the MOD-97 checksum. Validate the country, length, allowed characters, and any applicable national rules separately; a passing checksum does not verify that the account exists.

function validateIBAN(iban) {
  const cleaned = iban.replace(/\s/g, '').toUpperCase();
  const rearranged = cleaned.slice(4) + cleaned.slice(0, 4);
  const numeric = rearranged.replace(/[A-Z]/g, (ch) =>
    (ch.charCodeAt(0) - 55).toString()
  );
  const remainder = BigInt(numeric) % 97n;
  return remainder === 1n;
}

Implementation Best Practices

For production systems, implement validation at multiple points in your data flow:

• Client-side — validate in the browser for immediate user feedback
• Server-side — repeat validation on your backend to guard against tampering
• Storage — store only validated IBANs in your database
• Monitoring — record aggregate validation-failure metrics and avoid logging complete IBANs

You can test your validation logic using our IBAN generator to create checksum-valid synthetic test cases, and verify your implementation with our online IBAN validator. Neither tool verifies that an account exists or is assigned.

Common Mistakes to Avoid

• Forgetting to normalize the input (removing spaces and converting to uppercase)
• Using the wrong character-to-number mapping (remember A=10, not A=1)
• Attempting to validate as regular integers instead of big integers (overflow errors)
• Failing to update country length specifications when regulations change

Always validate against the most current ISO 13616-1 specifications and the ISO/IEC 7064 MOD97-10 check-digit scheme.