IBAN & BIC

The IBAN (International Bank Account Number) is the Europe-wide standardised account number; the BIC (Bank Identifier Code, formerly SWIFT code) additionally identifies the account-holding institution. Together they are required for SEPA transfers within Europe – for example when a shop demands advance payment by bank transfer.

The structure is the same everywhere: two letters for the country, two check digits, then the national account identifier. The total length is fixed per country – a German IBAN has 22 characters, an Austrian one 20 and a Swiss one 21. The two check digits are calculated using the internationally standardised modulo-97 procedure; that is why transposed digits are detected arithmetically straight away, before a transfer is even sent.

That arithmetic test, however, only shows that the sequence of digits is internally consistent – not that the account exists or who owns it. Whether a formally correct IBAN has a live account behind it is known only to the bank in question. And in the SEPA procedure the IBAN is traditionally treated as decisive, not the recipient name entered: if the two do not match, the money goes to whoever holds the IBAN. That is why the comparison is worth making before the payment, not after.

Important for consumers: a SEPA transfer executed via IBAN is, contrary to common belief, not an anonymous payment – it is fundamentally traceable and can be reported to your own bank. In practice, however, the money is barely recoverable once it has been credited to the recipient’s account – a recall is only possible within very short time windows and only with the cooperation of the recipient’s bank, and there is practically no entitlement to it.

Several things can be checked in seconds before paying. Is the account holder the company from the legal notice, or a private individual? Does the IBAN’s country code fit the stated company seat? A German shop with an account in another EU country is unremarkable in itself – payment service providers with Europe-wide accounts are common – but a private name as recipient for a supposed limited company is not. It is equally striking if the same company names different accounts depending on the order.

There is also a point that is often overlooked: not every recipient account belongs to the perpetrators themselves. Frequently the accounts of well-meaning third parties are used, recruited via a supposed job offer as “payment processors” who pass money on. For those involved this is an additional problem, because such accounts are quickly frozen and their holders themselves become the subject of investigations. A reported IBAN therefore evidences a flow of money – not who planned the fraud.

The BIC has lost importance within the SEPA area. For transfers inside Europe the IBAN alone is generally sufficient; the BIC is only strictly required for payments outside the SEPA area. So if a shop emphasises its BIC or presents it as additional proof of legitimacy, that says nothing – it is simply one more detail that can be written down at will.

What is revealing is where the IBAN turns up in the ordering process. If it appears transparently on the payment page and is held by the company from the legal notice, that is unremarkable. If it only arrives in a confirmation email sent from a free webmail address, or if it changes between two orders at the same shop, both are clear indications that accounts are being swapped through quickly here.

For later evidence the payment reference matters. Always enter the order number there and, if there is room, the shop name. That allows the payment to be linked unambiguously to a transaction, both at the bank and in any subsequent police report. An empty or meaningless reference makes that matching needlessly difficult, especially when several payments are involved.

When you report the case to your bank, have the date, amount, recipient IBAN, recipient name and payment reference ready. Explicitly ask for a payment recall and have the answer given in writing – even a refusal is a record that helps later. In parallel the case belongs with the police; the recipient IBAN is one of the few leads that still exist once the website has been taken down.

And finally: an IBAN can be checked against already known fraud reports before you pay. A hit settles the question immediately. No hit merely means that nothing is on file for this account – the vast majority of accounts are simply unknown. As a free extra step before a transfer, the check is nonetheless one of the few actions that can prevent the loss entirely.

If fraud is suspected, your own bank should be informed as quickly as possible, even if recovery is not guaranteed – in addition, filing a report with the police, using the recipient’s IBAN as evidence, is advisable. It also makes sense to check the number against already known fraud reports beforehand: if it shows up there, the matter is settled before any money moves.