IBAN Format Explained: Country Codes and the Mod-97 Check

The IBAN format is the standard way to write a bank account number so it works across borders. Those long strings starting with two letters, like DE89 or GB29, aren't random. Every part has a job, and the whole thing is built to catch mistakes before money moves.

An IBAN packs three things into one line: which country the account sits in, a pair of check digits for validation, and the actual account details. Get one character wrong and the number fails a quick math test, so a typo gets caught before a payment is sent to the wrong place.

If you've read how the Luhn check guards card numbers, the idea here is similar, just with a stronger formula. This guide breaks down each piece of an IBAN, shows how the mod-97 check works, and explains why a random-looking account number is actually carefully structured.

What is an IBAN?

An IBAN, short for International Bank Account Number, is a standard format for identifying a bank account in a way any bank in any country can read. Before it existed, each country wrote account numbers its own way, and international transfers often failed or got delayed because a detail was misread. The IBAN fixed that by wrapping the local account number in a common, checkable structure.

It's defined by the ISO 13616 standard, with SWIFT acting as the official registrar that keeps track of each country's format. The system started in Europe and is the backbone of SEPA payments there, but it's now used across much of the Middle East, and parts of the Caribbean and beyond. Over 80 countries use it today.

An important point: an IBAN doesn't replace your normal account number. It contains it. The country code and check digits sit at the front, and your existing bank and account details follow. So the same account can be written as a local number at home and as an IBAN for international transfers.

One IBAN can be up to 34 characters long, and the exact length is fixed per country. A German IBAN is always 22 characters, a UK one is 22 as well, and a Norwegian one is just 15. That fixed length is itself a first clue for spotting a malformed number.

The parts of an IBAN

Every IBAN is made of three blocks, always in the same order. Take this German example:

DE89 3704 0044 0532 0130 00

(The spaces are just for reading. In a system, it's written as one unbroken string.)

1. Country code (2 letters). The first two characters are the country, using the standard two-letter codes, so DE is Germany, GB the UK, FR France. This tells any bank which country's rules to apply to the rest.

2. Check digits (2 numbers). The next two characters, 89 here, are the checksum. They're calculated from everything else in the IBAN using the mod-97 formula covered in the next section. Their only job is validation, catching a mistyped digit before a transfer goes out.

3. BBAN (the rest). Everything after that is the Basic Bank Account Number, and its layout is set by each country. In the German example, 37040044 identifies the bank and branch, and 0532013000 is the account number itself. Another country will slice this part differently, which is why IBAN lengths vary.

So an IBAN isn't a new number you have to memorize. It's your normal account details, 37040044 and 0532013000 in this case, with a country tag and a checksum bolted onto the front.

How the mod-97 check works

The check digits let anyone confirm an IBAN is well-formed using nothing but arithmetic. Here's the procedure, using DE89 3704 0044 0532 0130 00.

1. Move the first four characters to the end. Take the country code and check digits (DE89) off the front and stick them on the back. The number now starts with the BBAN and ends with DE89.

2. Turn letters into numbers. Every letter becomes a two-digit number where A is 10, B is 11, and so on up to Z at 35. So D becomes 13 and E becomes 14. After this step the whole IBAN is one long string of digits.

3. Divide by 97 and look at the remainder. Treat that huge string as a single integer and take it modulo 97. If the remainder is exactly 1, the IBAN passes. Any other result means it's invalid.

That's the entire test. It needs no connection to a bank, so a website or a payment form can reject a bad IBAN the instant it's typed. The number is often too large for ordinary integer variables, so software usually chews through it in chunks, but the math is the same.

If you'd rather not do it by hand, the IBAN validator runs these exact steps and tells you whether a number checks out, along with the country it belongs to.

How the check digits are generated

Creating an IBAN's check digits is almost the same process run backward. When a bank turns your local account number into an IBAN, it calculates those two digits so the finished number passes the mod-97 test.

The steps:

1. Write the IBAN with the country code at the front but put 00 where the check digits go, as a placeholder.

2. Move those first four characters (country code plus 00) to the end, and convert the letters to numbers, exactly like validation.

3. Take that big number modulo 97, then subtract the result from 98. That gives the two check digits. If the answer is a single digit, it's padded with a leading zero.

So the check digits are never guessed or assigned by hand. They fall straight out of the rest of the number. This is also why you can't just change one digit of an account number and keep the same IBAN. The checksum won't match anymore, and the whole thing fails validation.

It's the same reason test IBANs have to be built properly rather than typed at random. A made-up string almost never lands on a valid checksum, so it gets rejected the moment it's checked.

Why 97, and what errors it catches

The choice of 97 isn't arbitrary. It's the largest prime number below 100, and using a large prime as the divisor is what gives the check its strength. Because 97 shares no factors with the base the digits are written in, errors are very unlikely to cancel out and slip past unnoticed.

In practice, the mod-97 check catches around 99% of common transcription mistakes. That includes any single wrong digit, swapping two adjacent digits, and most jumbles of several digits. For a test that's just one division, that's a lot of coverage.

This is where it edges out the simpler card check. The Luhn formula on a credit card catches single-digit slips and most neighbor swaps, but a two-digit checksum divided by a prime casts a wider net. It's the difference between a quick sanity check and a more thorough one, which suits a bank transfer where a mistake sends money to the wrong account.

Two limits are worth naming. First, mod-97 confirms the number is shaped correctly, not that the account exists or has money in it. Second, it can't stop deliberate fraud, since anyone can compute a valid checksum. Like every check digit system, it's built to catch honest mistakes, not bad actors.

Generate and validate test IBANs

If you're building or testing anything that accepts bank details, a payment form, an onboarding flow, an accounting import, you need IBANs that pass validation but belong to no real account. Random characters won't do, because a proper validator will reject them for failing the mod-97 check.

That's what a generator handles. It builds each number against the right country template and computes correct check digits, so the result is structurally valid and safe to use as test data.

• To create sample numbers, the IBAN generator produces valid-format IBANs for a range of countries, each with a proper mod-97 checksum and a country-appropriate BBAN.

• To check a number you already have, paste it into the validator to confirm its structure and see which country it maps to.

Keep the usual caveat in mind: a valid format is not a real account. These numbers are for filling test databases and exercising validation code, not for moving money. They pass the math, and that's all. For other placeholder details to go with them, the site has matching tools for things like fake addresses and sample emails.

Everything is generated locally in your browser, so no account data is created or sent anywhere.

Conclusion

An IBAN looks like a random wall of characters, but now you can read it. The first two letters name the country, the next two are a checksum, and the rest is your familiar bank and account number in a country-specific layout. Nothing in it is filler.

The clever part is the mod-97 check. By reserving two digits and tying them to everything else through a prime-number formula, the format can flag almost any typo on its own, with no lookup and no bank involved. It's a small piece of math doing quiet work behind every cross-border transfer.

If you need IBANs for testing rather than transfers, let the tools do the arithmetic. You can spin up format-valid IBANs for several countries, or drop a number into the validator to see whether it holds up. Either way, you're working with the same structure banks rely on, minus the risk of touching a real account.