IBAN Validation ≠ Account Ownership

When you enter an IBAN and see the "valid" result, you may naturally want to assume that the money will go to the right account. Yet these two things are independent of each other. An IBAN's structural (format) validity and the account behind that IBAN actually existing, being active and belonging to the stated person are entirely different things. Understanding this distinction is the first step in preventing both misdirected transfers and fraud.

What does the MOD-97 check digit check?

It is not the last digit of the IBAN but the first two digits that are a check digit. IBAN validation tools apply the MOD-97 algorithm from the ISO 13616 standard: the country code and check digits are moved to the end, the letters are converted into numbers, and the remainder of dividing the resulting large number by 97 must be 1. This check catches accidental typing errors (a digit being skipped, two digits being swapped) to a large extent.

MOD-97 validation checks only the following:

• Format: Is the IBAN's character structure in line with the standard (country code + check digits + BBAN).
• Country length: Each country's IBAN is a fixed length (e.g. Germany 22, Turkey 26 characters). Does the length match that country.
• Check digits: Is the MOD-97 remainder correct — that is, is the code internally consistent.

By contrast, MOD-97 validation checks none of the following:

• Whether the account is actually open, or closed / never opened;
• Who the account's owner is — does it match the name you entered;
• Whether there is a balance in the account, whether it is blocked, whether it is reachable for an incoming transfer.

In short, MOD-97 answers the question "is this code correctly constructed?"; not "is this account real and the right person's?". For the working logic of the tool itself, you can see the How to validate an IBAN page.

The three-layer verification difference

To be sure that a payment will reach the right place, there are three separate questions. Each is answered by a different method, and one does not replace the other:

Layer	The question it answers	How is it checked?
1. Structural validity	Is the code formally correct?	The IBAN validation tool (MOD-97, country length). Entirely in the browser, instantly.
2. Account owner verification	Does this IBAN belong to the name I entered?	Verification of Payee (VoP). It became mandatory in the EU with the instant payments regulation (IPR); it checks the name–IBAN match before the payment.
3. The account being active / reachable	Is the account open and can the money arrive?	Only a transfer attempt or the bank's confirmation shows this. No offline tool can guarantee it.

The first layer is checked within seconds with the IBAN validation tool. For the second layer you can use our Verification of Payee (VoP) simulator, and in a real payment you can look at your bank's VoP result. The third layer becomes clear only with an actual transfer; that is why the assumption "the IBAN came back valid, so the money will definitely go" is mistaken.

From a fraud perspective: it can look valid and be fake

The IBAN's check digit is not tied to a known account; it is based only on a mathematical rule. Therefore a string that follows the rule but in reality corresponds to no account can also look "valid". More important from a fraud perspective is this: an IBAN in a valid format can belong to someone else. When a fraudster gives you the details of a real account under their own control, the IBAN is both structurally valid and matches the name in VoP — but the money still goes to the fraudster.

That is why Verification of Payee (VoP) does not prevent fraud on its own; it only reduces sending to the wrong account and some redirection (invoice-change) scenarios. To be sure who you are paying, verify the recipient and the payment request through a separate channel (phone, a previously known contact). Be especially careful of "send it right now" pressure and IBANs that change at the last minute. For the VoP warning types, see the payee name – IBAN mismatch guide.

What should you do in practice?

1. First check the structure. Verify the code's format validity with the IBAN validation tool — you catch typing errors at this step.
2. Match the name. See the name–IBAN match with the Verification of Payee (VoP) simulator; in a real payment, trust your bank's VoP result.
3. Verify the recipient separately. Especially for a party you are paying for the first time or whose IBAN changed later, confirm the details through a trusted channel.
4. Do not expect certainty. No offline tool can guarantee that the account is active; this becomes clear only with a transfer.

Summary

"A valid IBAN" and "a real, active account belonging to the right person" are three independent layers. MOD-97 only checks the format and internal consistency of the code; not whether the account exists, its owner or its balance. To verify the name, Verification of Payee (VoP) is used, but it too does not prevent fraud on its own — verify the recipient separately. Whether the account is actually reachable is shown only by the transfer itself. Not confusing these three layers is the cheapest way to reduce both misdirected transfers and the risk of fraud.