An IBAN looks like a random string. It is not. Every part of it means something, and understanding the parts explains why some payments bounce, why some go to the wrong account, and what the checks on your account are actually checking.
The four parts
Take a UK IBAN: GB29 NWBK 6016 1331 9268 19.
- Country code (GB). Two letters, which country's banking system the account sits in.
- Check digits (29). Two numbers calculated from the rest of the IBAN. If a digit is mistyped, the check fails and the payment is rejected before it goes anywhere.
- Bank identifier (NWBK). Which bank. In the UK this is the bank code plus the sort code (60-16-13).
- Account number (31926819). The account at that bank.
Together the parts after the check digits are called the BBAN, the domestic account number. An IBAN is just a BBAN with a country code and a checksum on the front.
Length varies by country
IBANs are between 15 and 34 characters. Malta uses 31, the UK 22, Germany 22, Lithuania 20, Cyprus 28. A validator knows the expected length per country, so a Maltese IBAN with 30 characters fails immediately.
Why a valid IBAN can still be wrong
The check digits only prove the IBAN is well-formed. They do not prove it belongs to the company you think it does. Two ways this goes wrong:
- Transposed digits that still pass. Rare, but swapping two digits can produce another valid IBAN.
- The right IBAN for the wrong person. Invoice fraud works by sending you a real IBAN that belongs to the fraudster. The IBAN validates perfectly.
This is why the name check matters more than the checksum. On GBP payments, Confirmation of Payee compares the name you entered with the name on the destination account. On euro payments, Verification of Payee does the same across SEPA. You see Match, Close Match or No Match before the money moves.
BIC: the other identifier
For SWIFT and some SEPA payments you also need a BIC, sometimes called a SWIFT code. It identifies the bank, not the account: 8 or 11 characters, such as MALTMTMT for a bank in Malta. Inside SEPA the BIC is usually optional because it can be derived from the IBAN. Outside SEPA it is required, and for USD you may also need the intermediary bank's details.
Practical rules
- Copy IBANs from documents, do not retype them. Most errors are typing errors.
- Enter the payee name exactly as it appears on their bank account, not their trading name.
- Treat a Close Match as a question, not a warning to click through.
- Treat a No Match as a stop. Verify by phone on a number you already hold.
- For international payees, collect IBAN, BIC and intermediary details when you onboard them, not when the first payment is late.
The IBAN tells the system where to send money. The name check tells you whether you should.
