- CountryTwo letters
- Check digitsModulo 97, a transposed digit shows up in the calculation
- Account identifierNational identifier, fixed layout per country
- Germany
- 22 characters
- Austria
- 20 characters
- Switzerland
- 21 characters
A schema, not a real IBAN. The calculation only shows that the digits are consistent. Whether the account exists and who owns it is known only to the bank.
Structure of IBAN and BIC
The IBAN (International Bank Account Number) is the Europe-wide standardised account number; the BIC (Bank Identifier Code, formerly SWIFT code) additionally identifies the account-holding institution. Together they are required for SEPA transfers within Europe, for example when a shop demands advance payment by bank transfer.
The structure is the same everywhere: two letters for the country, two check digits, then the national account identifier. The total length is fixed per country: a German IBAN has 22 characters, an Austrian one 20 and a Swiss one 21. The two check digits are calculated using the internationally standardised modulo-97 procedure; that is why transposed digits are detected arithmetically straight away, before a transfer is sent.
That arithmetic test only shows that the sequence of digits is internally consistent. It does not show whether the account exists or who owns it. Whether a formally correct IBAN has a live account behind it is known only to the bank in question. In the SEPA procedure the IBAN is traditionally treated as decisive, and the recipient name entered comes second: if the two do not match, the money goes to whoever holds the IBAN. Compare both before the payment.
The BIC has lost importance within the SEPA area. For transfers inside Europe the IBAN alone is generally sufficient; the BIC is only strictly required for payments outside the SEPA area. So if a shop emphasises its BIC or presents it as additional proof of legitimacy, that says nothing. The BIC is one more detail that can be written down at will.
Checks before paying
Several things can be checked before paying. Is the account holder the company from the legal notice, or a private individual? Does the IBAN’s country code fit the stated company seat? A German shop with an account in another EU country is unremarkable in itself, because payment service providers with Europe-wide accounts are common. A private name as recipient for a supposed limited company, by contrast, stands out. It is equally striking if the same company names different accounts depending on the order.
Where the IBAN turns up in the ordering process is telling as well. If it appears transparently on the payment page and is held by the company from the legal notice, that is unremarkable. If it only arrives in a confirmation email sent from a free webmail address, or if it changes between two orders at the same shop, both are clear indications that accounts are being swapped through quickly here.
An IBAN can be checked against already known fraud reports before you pay. A hit settles the question immediately. No hit merely means that nothing is on file for this account, and that is true of the vast majority of accounts. As a free extra step before a transfer, the check is nonetheless one of the few actions that can prevent the loss entirely.
For later evidence the payment reference matters. Always enter the order number there and, if there is room, the shop name. That allows the payment to be linked unambiguously to a transaction, both at the bank and in any subsequent police report. An empty or meaningless reference makes that matching needlessly difficult, especially when several payments are involved.
Recall and reporting
A SEPA transfer executed via IBAN is, contrary to common belief, not an anonymous payment. It is fundamentally traceable and can be reported to your own bank. The money is barely recoverable, however, once it has been credited to the recipient’s account. A recall is only possible within very short time windows and only with the cooperation of the recipient’s bank, and there is practically no entitlement to it.
If fraud is suspected, your own bank should be informed as quickly as possible, even if recovery is not guaranteed. In addition, filing a report with the police, using the recipient’s IBAN as evidence, is advisable. It also makes sense to check the number against already known fraud reports beforehand: if it shows up there, the matter is settled before any money moves.
When you report the case to your bank, have the date, amount, recipient IBAN, recipient name and payment reference ready. Explicitly ask for a payment recall and have the answer given in writing. Even a refusal is a record that helps later. In parallel the case belongs with the police; the recipient IBAN is one of the few leads that still exist once the website has been taken down.
Not every recipient account belongs to the perpetrators themselves. Frequently the accounts of well-meaning third parties are used, recruited via a supposed job offer as “payment processors” who pass money on. For those involved this is an additional problem, because such accounts are quickly frozen and their holders themselves become the subject of investigations. A reported IBAN therefore evidences a flow of money. It does not show who planned the fraud.