A well-formatted IBAN is not necessarily a secure one. This is the core challenge of IBAN validation: most free tools only confirm that a string of characters follows a standard, not that it belongs to the person or company you intend to pay. In 2025, bank transfers became the most defrauded payment method in France by value, with 485 million euros stolen, representing 39.1% of the total amount of payment fraud (Payment Means Security Observatory, Banque de France).

This guide details the four verification methods actually available, what each covers and does not cover, and why this topic quickly shifts from the realm of payments to that of KYC and AML-CFT compliance.

‍

‍

What is an IBAN and what can you actually verify?

The structure of an IBAN

The IBAN (International Bank Account Number) is standardized byISO 13616. Its length varies from 15 to 34 characters depending on the country, and it is always broken down in the same way:

• Country code (2 letters, ISO 3166): FR — the country where the account is held.
• Check digits (2 digits): 14 — the mathematical check for the entire string.
• BBAN (national identifier): 20041 01005 0500013M026 06 — bank code, branch code, account number, and RIB key.

A complete French IBAN is 27 characters long: FR14 2004 1010 0505 0001 3M02 606. In Germany, it is 22 characters, in Belgium 16, and in Malta 31. This variability explains why a simple length check is not enough: you must know the expected format for each country.

What the IBAN doesn't tell you

An IBAN identifies an account, not an account holder. It contains no information about the identity of the owner, whether the account is open or closed, or its ability to receive a SEPA transfer. This is precisely the blind spot that fraudsters exploit: a perfectly valid IBAN can belong to a money mule account opened just yesterday.

That is why the relevant question is not "is this IBAN valid?" but "does this account actually belong to the counterparty I believe I am paying?". There are four methods to answer this, each with its own scope.

The four methods for verifying an IBAN

1. Syntactic validation (modulo 97)

This is the check performed by almost all free online IBAN validators. The algorithm, defined byISO 7064 (MOD 97-10), consists of four steps:

1. Move the first four characters (country code + check digits) to the end of the string.
2. Replace each letter with its numerical value (A = 10, B = 11, … Z = 35).
3. Interpret the result as a large integer.
4. Divide by 97: the remainder must be equal to 1.

This check is instantaneous, free, and requires no network call. It detects all single-character entry errors and the vast majority of digit transpositions—the most common cause of a mistyped IBAN. This is usually supplemented by a national format check: the expected length and BBAN structure for the specified country.

Its limitation is structural: it proves nothing about the existence of the account. An artificially generated IBAN with the correct check digits will pass the test without difficulty. Syntactic validation is a data quality filter, not an anti-fraud check.

2. Account verification via open banking (PSD2)

The second method queries the account-holding bank directly via the open interfaces mandated by PSD2. An authorized Account Information Service Provider (AISP) connects to the account and retrieves the actual IBAN, BIC, and the identity of the holder as recorded by the bank.

This is the most reliable method for a simple reason: the data comes from the source, not a database. It confirms that the account exists, that it is active, and who it belongs to.

Its constraint is equally structural: it requires the account holder's consent and strong authentication. It therefore works very well during onboarding, when your customer connects their own account to prove they are the holder. It does not work for unilaterally verifying the bank details of a supplier who has sent you a PDF: you cannot connect to their account.

3. Ownership verification via SEPAmail DIAMOND

In France, ownership verification without the account holder's consent relies on SEPAmail DIAMOND, an interbank system managed by the SEPAmail.eu association and distributed by major banking groups—Société Générale, BPCE, Crédit Mutuel-CIC, BNP Paribas, Crédit Agricole, and La Banque Postale. Some banks market it under their own brand names, such as SécurIBAN at Crédit Agricole.

The principle: you submit an IBAN along with the supposed identity of the account holder, and the network queries the bank holding the account. DIAMOND handles both legal entities (matching against SIREN/SIRET numbers and company names) and individuals, typically returning a result in one of three colors: confirmed match, potential mismatch (homonyms, spelling variations, multiple names), or confirmed mismatch.

This method is ideal for verifying a supplier database: it can be applied to existing records as well as new entries, it covers both direct debits and credit transfers, and it requires no action from the counterparty. Its limitation is geographical: it only applies to French IBANs.

4. Document OCR and forgery detection

The first three methods assume that the entered IBAN matches the one on the received document. However, in bank account change fraud, the document itself has been altered—meaning the fraudulent IBAN is authentic and linked to a real account opened in the name of a money mule.

This fourth method therefore focuses on the document itself, rather than the account. It consists of:

• extracting bank account details via OCR — IBAN, BIC, account holder name, issuing bank — rather than relying on manual entry or copy-pasting;
• analyzing the document to detect forgery : pixel retouching, font or line spacing inconsistencies, layered overlays, suspicious generation metadata, or discrepancies with the issuing bank's known template;
• checking for internal consistency between the extracted IBAN, the BIC, the bank code, and the institution displayed on the document;
• timestamp and store the result as legally admissible evidence.

This is the only method independent of any banking infrastructure: it works in any country, including outside the SEPA zone, and with any document format. However, it does not verify the actual existence of the account—it must be used in combination with other methods, not as a replacement.

‍

Why bank account fraud is on the rise

Data from the Payment Systems Security Observatory highlights the shift in risk. For the year 2025:

• total payment fraud reached 1.241 billion euros ;
• the bank transfer accounts for 39.1% (€485M), ahead of bank cards (34.9%, €475M);
• the number of fraudulent transactions fell by 7.6%, but the average value of a fraudulent transfer remains significantly higher than that of card fraud;
• the manipulation fraud — where the victim authorizes the transaction themselves — accounts for 516 million euros, an increase of 34% over one year, with 376 million from bank transfers alone.

The mechanism is always the same: the fraudster does not attack the payment system, they attack the bank account database. Intercepted and altered invoices, fake bank account change requests, impersonating a bank advisor, or compromising a supplier's email account. The IBAN provided is authentic, the transfer is legitimate, and the widespread use of instant payments makes the transaction irreversible in seconds.

This is why verification must take place upstream, at the moment the bank details are entered into your database — not at the time of payment, when it is already too late.

From IBAN verification to KYC: the real issue is the account holder

Bank KYC and regulations: what AML-CFT requirements mandate

KYC (Know Your Customer) refers to the set of identification and verification checks that a regulated entity applies to its clients. In France, the foundation is set out in Articles L. 561-1 et seq. of the Monetary and Financial Code, which transposes European anti-money laundering directives under the supervision of theACPR and Tracfin.

KYC regulations are structured around four obligations:

1. Identify the client and, for a legal entity, its beneficial owners.
2. Verify this identity based on documents, data, or information from a reliable and independent source.
3. Understand the nature and purpose of the business relationship, and then exercise ongoing monitoring throughout the duration of the relationship.
4. Retain verification records and report them to Tracfin in the event of suspicion.

The regulatory framework is tightening. Regulation (EU) 2024/1624 (AMLR), directly applicable from July 10, 2027, harmonizes these obligations across the entire Union and makes them significantly more prescriptive. The new European authority AMLA will select the first supervised entities starting in July 2027, for direct supervision beginning on January 1, 2028. KYC systems built on manual checks and attachments stored in shared folders will not survive this deadline.

KYC procedure: documents and checks

A banking KYC procedure relies on a relatively stable foundation of documents. For an individual : a valid identity document, proof of address, and increasingly, biometric verification of physical presence. For a legal entity : a Kbis extract (or RCCM in the OHADA region), updated articles of association, register of beneficial owners, and identity documents for directors.

The bank account details (RIB) are an integral part of these KYC documents, yet they are often the weakest link in the chain. They are provided as a PDF or photo, rarely analyzed, and never cross-referenced with the identity verified just a few screens earlier—even though the entire KYC file has just established who the counterparty is.

It is this reconciliation between the account and the identity that transforms a simple IBAN check into a genuine KYC compliance check—and it is also what makes it defensible during an audit, as it is timestamped and linked to the client file.

IBAN, KYB, and credit score

For a business counterparty, the check extends to KYB (Know Your Business). Verifying the company, its ownership structure, and its beneficial owners helps answer the question that really matters: is the company listed on the invoice the same one that holds the account to be credited?

These same data points fuel financial risk analysis. A solvency score or a credit scoring model built on verified corporate data—legal status, company age, filed accounts, executives, and ownership structures—is significantly more reliable than a score based on self-reported information. Compliance and credit risk management rely on the same foundation: a properly identified counterparty.

Implement end-to-end IBAN verification

An operational checklist applicable to both client onboarding and supplier database management:

1. Systematically validate the syntax at the point of entry (modulo 97 + national format), on both the interface and server sides.
2. Analyze every bank statement received as an attachment : OCR extraction and forgery detection, before any entry into the database.
3. Verify account ownership for every new beneficiary—using open banking if the counterparty cooperates, or SEPAmail DIAMOND otherwise.
4. Match the account holder with the verified identity during KYC/KYB: this is the check that truly stops bank account change fraud.
5. Treat every change of bank details as a high-risk event : perform a callback using a number known from your records, never the one provided in the incoming message.
6. Separate duties : the person entering bank details should not be the same person who approves them or initiates the payment.
7. Trigger an alert for transfers made shortly after a change of bank details.
8. Keep a record of proof for every check, timestamped and attached to the file.
9. Periodically review bank details of active counterparties, as part of ongoing due diligence.

Verify the account and the counterparty in a single workflow

Standalone IBAN verification quickly reaches its limits: it merely validates a string of characters when the real challenge is authenticating a counterparty. Dataleon treats bank details like any other document in a compliance file: structured extraction of banking data, IBAN consistency checks, document forgery detection, and automatic reconciliation with the identity or company verified during KYC/KYB—in France, Europe, and the OHADA zone.

Request a demo →

‍