Most of the friction in an international transfer comes down to one field being wrong. The IBAN — International Bank Account Number — is a standardised way of writing an account identifier so that institutions in different countries can route money to it without guessing.
It is worth being precise about what it does, because the single most common mistake is treating it as interchangeable with a SWIFT/BIC code. They answer different questions. The BIC says which institution. The IBAN says which account at that institution. A payment usually needs both answered, and outside the SEPA area it usually needs both stated explicitly.
The format, and why it is shaped that way
An IBAN is up to 34 characters and has three parts:
- a two-letter country code (
DE,GB,FR) - two check digits, computed from the rest of the string
- the BBAN — the domestic account number, including whatever bank and branch identifiers that country's scheme uses
Length and internal structure vary by country: a German IBAN is 22 characters, a British one 22, a Maltese one 31. There is no universal layout beyond the first four characters, which is why validation has to be country-aware rather than a length check.
The check digits are the useful part. They are derived from the rest of the string using a mod-97 calculation, so a single mistyped character almost always produces a string that fails validation before the payment is ever submitted.
That is a real saving, but it has a limit worth internalising: check digits catch typos, not wrong accounts. A string can be perfectly valid and still belong to somebody else. Format validation tells you the number is well-formed. It tells you nothing about whose it is.
IBAN vs SWIFT/BIC
| IBAN | SWIFT/BIC | |
|---|---|---|
| Identifies | A specific account | The institution holding it |
| Length | Up to 34 characters | 8 or 11 characters |
| Self-validating | Yes, via check digits | No |
| Required for SEPA euro transfers | Yes | Usually not |
| Required for most non-SEPA wires | Often | Yes |
Inside SEPA, an IBAN alone is normally sufficient for a euro credit transfer — the scheme derives the institution from the IBAN itself. Outside it, you are generally on the SWIFT network, where the BIC is what routes the message and the IBAN (or a local account number) is what the receiving institution applies it to.
Where businesses actually lose money
Three failure modes account for most of it.
Rejected and returned payments. A payment that fails validation at the receiving end gets returned, often days later, sometimes minus fees taken along the way. The sender has lost the time and occasionally some of the principal.
Misapplied receipts. The payment arrives but the reference is missing or malformed, so nobody can match it to an invoice. The money is in the account and the invoice still shows unpaid. At volume this is a reconciliation problem, not an accounting curiosity.
Name/IBAN mismatches. European schemes increasingly check the payee name against the account holder before releasing funds. If your invoices carry a trading name and your account details carry a registered legal name, payers get a warning at the moment of payment — and some of them stop.
None of these are exotic. They are what happens when account details are maintained in a document somebody edited eighteen months ago.
A short operational checklist
- Publish account details from one source, and make invoices read from it rather than from a copy.
- State the exact legal name the account is held under, not the trading name.
- Give payers a payment reference format and validate against it on receipt.
- For non-SEPA payments, state both IBAN and BIC, plus any local requirement (a routing number, a purpose code) the destination country expects.
- Re-verify details through a second channel when a supplier tells you they have changed. Invoice-redirection fraud is the single most effective payment fraud there is, and it works precisely because a changed IBAN looks routine.
Dedicated details versus shared details
Not every set of account details is the same kind of thing. Some arrangements give a business its own account details; others assign a reference within a larger pooled structure, where incoming funds are allocated on the reference rather than the account number.
The distinction matters for reconciliation and for what your auditor will ask about, so it is worth asking a provider directly which of the two you are getting, and getting the answer in writing. A virtual IBAN does not necessarily constitute a separate bank account, and the difference is not visible from the string itself.
How this works with 2PayApp
A 2PayApp business payment account can support EUR, GBP and USD, with access to payment rails including SEPA, SEPA Instant, Faster Payments, SWIFT and ACH. A dedicated GB IBAN may be available depending on eligibility, compliance approval and the approved account configuration.
2PAYAPP LIMITED is registered with FINTRAC as a Canadian Money Services Business. FINTRAC registration is a legal registration requirement; it is not a banking licence and does not constitute an endorsement by FINTRAC. 2PayApp is not a bank. Accounts, currencies, payment rails, account details and virtual IBANs are subject to onboarding, compliance approval, provider availability and the customer's approved account configuration.
FAQ
Is an IBAN the same as an account number? It contains one. The BBAN portion is the domestic account number; the IBAN wraps it with a country code and check digits so it can be validated internationally.
Can I receive money with only an IBAN? For euro transfers inside SEPA, usually yes. For most other routes the sender also needs a BIC, and some destinations require additional local fields.
Does a valid IBAN mean the account exists? No. Check digits confirm the string is internally consistent. They do not confirm the account is open, or that it belongs to the party you intend to pay.
Why did my transfer arrive short? On SWIFT routes, intermediary institutions in the chain may deduct charges in transit. Agreeing the charge option with the payer up front is what prevents it.