# Invalid IBAN checksum

> An IBAN that fails its checksum is almost always mistyped. How the check works, where to look for the error, and what it does not tell you.

Canonical: https://vetthisvendor.com/guide/invalid-iban-checksum
Published: 2026-08-02. Updated: 2026-08-02.
Author: Jose Pollman, VetThisVendor.

Every IBAN carries its own error-detecting code. When a check reports **"Checksum
failed"**, the number is internally inconsistent — which in practice means it was
mistyped somewhere.

## How the check works

The two digits after the country code are check digits. To verify them, the first four
characters are moved to the end, every letter is replaced by a number, and the whole
thing is divided by 97. A correct IBAN always leaves a remainder of exactly 1.

This is arithmetic, not a lookup. No bank is contacted, and your account number is not
sent anywhere to perform it.

## What it catches

The scheme was designed for exactly the errors people make when re-keying a long string:

- **Any single wrong character** — always caught.
- **Two adjacent characters swapped** — caught in the overwhelming majority of cases.
  This is the important one, because a transposition is nearly invisible when
  proofreading: every character you expect is present, just not in that order.
- **A missing or doubled character** — caught, and reported separately as a length
  problem, because the fix is different.

## Where to look

1. **The middle digits.** The start (country and bank code) tends to be familiar enough
   that errors stand out; the account portion in the middle does not.
2. **Characters that look alike** — `0`/`O`, `1`/`I`/`l`, `5`/`S`, `8`/`B`.
3. **A number read aloud over the phone.** Digit pairs get swapped constantly this way.
4. **A PDF copy-paste** that dropped or duplicated a character at a line break.

## What a valid checksum does *not* mean

A valid IBAN means the number is well-formed. It does not mean:

- the account exists,
- it belongs to the supplier named on the invoice, or
- it is the account they normally use.

That last point is where invoice fraud lives. A fraudster substituting their own account
number supplies a perfectly valid IBAN — theirs. The checksum passes, because it is a
real account. It is just not the right one.

This is why the result page tells you to confirm bank details by phone regardless of the
result, using a number you already had rather than one from the invoice or email. A
checksum cannot answer the question that matters.