Invalid IBAN checksum

Every IBAN carries its own error-detecting code. When a check reports “Checksum failed”, the number is internally inconsistent — which in practice means it was mistyped somewhere.

How the check works

The two digits after the country code are check digits. To verify them, the first four characters are moved to the end, every letter is replaced by a number, and the whole thing is divided by 97. A correct IBAN always leaves a remainder of exactly 1.

This is arithmetic, not a lookup. No bank is contacted, and your account number is not sent anywhere to perform it.

What it catches

The scheme was designed for exactly the errors people make when re-keying a long string:

• Any single wrong character — always caught.
• Two adjacent characters swapped — caught in the overwhelming majority of cases. This is the important one, because a transposition is nearly invisible when proofreading: every character you expect is present, just not in that order.
• A missing or doubled character — caught, and reported separately as a length problem, because the fix is different.

Where to look

1. The middle digits. The start (country and bank code) tends to be familiar enough that errors stand out; the account portion in the middle does not.
2. Characters that look alike — 0/O, 1/I/l, 5/S, 8/B.
3. A number read aloud over the phone. Digit pairs get swapped constantly this way.
4. A PDF copy-paste that dropped or duplicated a character at a line break.

What a valid checksum does not mean

A valid IBAN means the number is well-formed. It does not mean:

• the account exists,
• it belongs to the supplier named on the invoice, or
• it is the account they normally use.

That last point is where invoice fraud lives. A fraudster substituting their own account number supplies a perfectly valid IBAN — theirs. The checksum passes, because it is a real account. It is just not the right one.

This is why the result page tells you to confirm bank details by phone regardless of the result, using a number you already had rather than one from the invoice or email. A checksum cannot answer the question that matters.