IBAN Verification: How to Verify a Bank Account

An IBAN (International Bank Account Number) is a standardised account identifier used across the SEPA (Single Euro Payments Area) zone and beyond. IBAN verification is the broad term for any process that checks whether an IBAN is valid and, more importantly, whether it belongs to the person or entity who provided it.

Every IBAN follows the same logic, defined by the ISO 13616 standard and maintained in the official IBAN Registry:

• Country code – two letters identifying the country, based on ISO 3166-1 alpha-2 (for example, FR for France, DE for Germany)
• Check digits – two digits calculated using the ISO/IEC 7064 MOD-97-10 scheme, designed to catch keying and copying errors
• BBAN – the Basic Bank Account Number, a country-specific structure of up to 30 characters that includes the bank identifier

A syntactic check only confirms that an IBAN is correctly formatted. It cannot tell you whether the account is active, or whether it belongs to the person who submitted it. Genuine verification goes a step further: it checks the submitted details against the account-holding bank's own records.

Fraudsters increasingly target the exact moment a business collects or updates bank details: fake supplier invoices, compromised HR requests, or impersonated vendors asking to "update" their payment information.

This blind spot is structural rather than accidental. Under European payment law, a transfer executed in line with the unique identifier provided — the IBAN — is deemed correctly executed, and the payment service provider is not held liable for sending funds to an unintended payee on the basis of an incorrect identifier. Historically, the name attached to the account was simply not checked.

Even without any malicious intent, manual data entry errors in IBANs cause failed transfers, processing delays, and reconciliation headaches for finance and HR teams alike.

For regulated sectors, bank account verification also supports Know Your Customer (KYC) checks and broader anti-money laundering (AML) obligations, by confirming that financial flows match verified identities.

There is no single official taxonomy here, but in practice the checks available to businesses fall into three levels of assurance:

Only Level 3 gives a company real assurance before sending money or setting up a direct debit.

Verification of Payee is no longer a best practice: it is a legal obligation already in force. Regulation (EU) 2024/886 on instant credit transfers in euro, adopted on 13 March 2024, amends the SEPA Regulation and introduces a new Article 5c, which states that:

The requirement applies to both standard and instant credit transfers, and the service must be offered to payers free of charge. Crucially, it binds payment service providers established in the EU and the EEA, for credit transfers denominated in euro.

The common rules that make this work across borders are set by the European Payments Council's Verification Of Payee scheme, with the detailed operating conditions published in the VOP Scheme Rulebook.

The full implementation calendar is published by the European Central Bank:

This distinction matters for any business operating internationally. The SEPA zone includes several countries and territories outside the EU and the EEA — among them the United Kingdom, Switzerland, Monaco, Andorra and San Marino. For payment service providers based there, the EPC confirms that adherence to the VOP scheme is voluntary rather than mandatory, since the legal obligation covers euro payments between PSPs located in the EU or EEA.

Instead of asking the end user to prove ownership of their account (for example, through a micro-deposit or a document upload), VoP queries the banking network directly:

1. The payer's PSP (the Requesting PSP) sends the IBAN and the declared payee name to the payee's PSP (the Responding PSP).
2. The Responding PSP checks those details against its own customer records.
3. A response is returned in seconds, in one of four possible outcomes.

The result is not binary. The scheme defines four responses: match, close match, no match, and verification not possible. In the case of a close match, the payee's registered name is disclosed to the payer, so that an obvious spelling variation can be distinguished from a genuine mismatch. Beyond this, no underlying banking data is exchanged.

Manually checking bank details does not scale, and micro-deposits add friction that slows down onboarding. This is exactly the gap Youtrust's Bank Account Verification is built to close: confirming that an IBAN belongs to the right individual or company, directly with the financial institution, with no action required from your customer.

Here is how it works, step by step:

1. Submit the details: send the IBAN or bank account details together with the account holder's name, through the Youtrust API.
2. Automatic cross-reference: a verification request is sent to the account-holding financial institution via the VoP network to confirm the match.
3. Get an instant result: you receive a real-time response within seconds — Verified, Failed, or Inconclusive — with no extra step for your end user.
4. Act with confidence: approve the payment, flag it for manual review, or reject it, based on a verified result rather than a declared one.

Three benefits stand out for teams handling payments at volume:

• No added friction: the check runs silently, with no action required from your customer or supplier.
• Broad European coverage: 20 European countries within the SEPA zone, covering banks connected to the VoP network.
• One platform: because Verify and eSignature sit on the same platform, bank account checks can be combined with identity and company verification in a single workflow, before moving straight to a signed contract.

Any organisation that collects bank details or initiates payments is exposed to this risk, including:

• HR platforms, to prevent salary fraud when employees update their bank details
• Insurance companies, to secure claim reimbursements
• Lending and fintech players, to validate accounts before disbursing funds
• Marketplaces, to pay sellers or service providers safely
• Energy and utility companies, when setting up direct debits for new customers

Imagine an HR team processing a routine "change of bank details" request before payday. Without verification, a single convincing email could redirect an entire month's salary. With an automated IBAN check in place, that same request is validated in seconds, before the payment ever leaves the account.

Document analysis still has its place: AI-powered document fraud detection can flag a tampered bank statement or tax notice that no IBAN check would catch. But it cannot confirm that the underlying account exists or belongs to the declared person. For medium and high fraud-risk scenarios, the two checks are best combined.

• Trusting the format alone: a correctly formatted IBAN says nothing about who owns it.
• Reading "no match" as proof of fraud: a close match or a failed verification should trigger a review, not an automatic rejection.
• Assuming SEPA-wide obligation means SEPA-wide coverage: outside the EU and EEA, VoP adherence remains voluntary.
• Treating bank verification and identity verification as the same check: they answer different questions and should be combined, not substituted.

IBAN verification has moved from a nice-to-have to a regulatory baseline for any business handling payments in Europe. A correctly formatted account number is no guarantee of safety: only a real-time check against the account-holding bank, through Verification of Payee, confirms that money is going to the right person. With the obligation already in force across the euro area and extending to the rest of the EU by 2027, building this check into your payment and onboarding flows now means fewer failed transfers, less fraud exposure, and a smoother experience for everyone involved.