Can a mistyped IBAN still pass mod-97?

It is possible but rare — fewer than 1% of random corruptions survive the check, and country-specific length and structure rules eliminate most of those. Combined validation is what production systems rely on.

Do I need big-integer math to implement it?

Not necessarily: the standard trick processes the number in chunks, carrying the running remainder, so it fits ordinary integer arithmetic. Most languages also have vetted libraries — reuse one.

Does a valid checksum mean the payment will succeed?

No. It means the identifier is well-formed. The account could be closed, the bank unreachable for the chosen scheme, or the name mismatched — those are resolved by registry lookups and payee verification, not the checksum.

Guide · 5 min read

IBAN validation with mod-97: the checksum, step by step

Last updated 17 July 2026

Every IBAN carries two check digits computed with the ISO 7064 mod-97 algorithm. Validating them requires no network call and catches nearly every typo — which is why it should always run before any registry lookup or payment attempt.

The algorithm in four steps

Example with BE68 5390 0754 7034: rearranged to 539007547034BE68, letters expanded to 539007547034111468, and 539007547034111468 mod 97 = 1 — valid.

1. Move the first four characters (country code + check digits) to the end of the string.
2. Replace every letter with two digits: A=10, B=11 … Z=35.
3. Interpret the result as one large integer.
4. Compute the remainder modulo 97 — the IBAN is valid if and only if the remainder is 1.

Why mod 97 catches virtually all errors

97 is the largest prime below 100. Using it as the modulus means any single-character error, and almost every transposition of adjacent characters, changes the remainder — over 99% of realistic typos are detected. Simpler schemes (like mod 10 in card numbers) miss whole classes of transpositions that mod 97 catches.

What validation does not tell you

iban2bic runs structure and mod-97 checks in-process before anything else: an invalid IBAN is rejected with HTTP 400 and never reaches a provider or your bill. Only checksum-valid IBANs proceed to the billable BIC resolution.

That the account exists — the checksum only proves the string is well-formed.
That the account is open, or belongs to who you think it does (that is Verification of Payee territory).
Which bank holds it, its BIC, or its SEPA reachability — that needs registry resolution.