How to Validate an IBAN Number: Step-by-Step Guide

Validating an IBAN is a critical step in any payment processing system to ensure accuracy and prevent costly transfer errors. IBAN validation involves checking the format, verifying the country code, confirming the correct length, and most importantly, validating the check digits using the MOD-97 algorithm defined in ISO 13616. Proper validation catches typing mistakes, formatting errors, and invalid account numbers before they enter your payment pipeline, saving time, money, and customer frustration.

Step 1: Format Verification

The first step in IBAN validation is format verification. Every valid IBAN must start with a two-letter country code followed by two check digits (0-9), then the Basic Bank Account Number (BBAN). Remove all spaces and convert the entire string to uppercase before validation, as IBANs are case-insensitive but should be normalized for processing. Reject any input that contains special characters, starts with numbers, or does not follow the country-code-plus-digits pattern.

Step 2: Country Code & Length Check

Next, verify that the country code is recognized and supported by your system. Valid IBAN country codes include DE (Germany), FR (France), GB (United Kingdom), ES (Spain), IT (Italy), and over 75 other countries. Each country has a specific IBAN length:

If the input length does not match the specification for the given country code, the IBAN is invalid.

Step 3: MOD-97 Check Digit Validation

The most important validation step is verifying the check digits using the MOD-97 algorithm. This mathematical process ensures the IBAN's structural integrity and catches over 99% of transcription errors:

1. Move the first four characters (country code and check digits) to the end — e.g., DE89370400440532013000 becomes 370400440532013000DE89
2. Replace each letter with its corresponding numeric value (A=10, B=11, ..., Z=35) — D=13, E=14 → 37040044053201300013​1489
3. Calculate modulo 97 — divide the resulting number by 97
4. Check the remainder — if it equals 1, the IBAN is valid

Code Example: JavaScript

function validateIBAN(iban) {
  const cleaned = iban.replace(/\s/g, '').toUpperCase();
  const rearranged = cleaned.slice(4) + cleaned.slice(0, 4);
  const numeric = rearranged.replace(/[A-Z]/g, (ch) =>
    (ch.charCodeAt(0) - 55).toString()
  );
  const remainder = BigInt(numeric) % 97n;
  return remainder === 1n;
}

Implementation Best Practices

For production systems, implement validation at multiple points in your data flow:

• Client-side — validate in the browser for immediate user feedback
• Server-side — repeat validation on your backend to guard against tampering
• Storage — store only validated IBANs in your database
• Monitoring — log validation failures for fraud detection

You can test your validation logic using our IBAN generator to create known-valid test cases, and verify your implementation with our online IBAN validator.

Common Mistakes to Avoid

• Forgetting to normalize the input (removing spaces and converting to uppercase)
• Using the wrong character-to-number mapping (remember A=10, not A=1)
• Attempting to validate as regular integers instead of big integers (overflow errors)
• Failing to update country length specifications when regulations change

Always validate against the most current ISO 13616 specifications.