Identifier detector
IBAN: format, validation and detection
Short answer
An IBAN is a two-letter country code, two check digits and a national account part. Its length is fixed per country, and the whole number passes the ISO 13616 test: move the first four characters to the end, turn letters into numbers, and the result modulo 97 must be 1.
What it is
The International Bank Account Number identifies a bank account. Maskflare has a global IBAN detector in the Global pack and one per country pack in addition. The Global pack is included by the HIPAA Safe Harbor, GDPR (EU/EEA), UK GDPR and US personal data profiles, and by the Swiss nDSG health profile.
In Maskflare this is the detector iban, labelled "IBAN (any country)", category bank account number (iban), in the Global pack.
Format and layout
- Two letters (country), two check digits, then letters and digits that vary by country. Maskflare's table carries the registered total length for each country: for example 22 for Germany and the UK, 21 for Switzerland, 27 for France, 18 for the Netherlands and 15 for Norway.
- Spaces, usually in groups of four, are ignored when checking.
- Lower-case letters are read as upper case.
How the check works
Remove spaces, check that the length matches the country, move the first four characters to the end, replace each letter by a number (A is 10, B is 11, up to Z at 35), and read the result as one large integer. Divide it by 97: the remainder must be 1.
Worked example
- Without spaces the length is 22, the registered length for GB.
- Moving GB82 to the end gives WEST12345698765432GB82, and with letters replaced by numbers: 3214282912345698765432161182.
- That number divided by 97 leaves 1, so the IBAN passes.
Valid and invalid examples
| Example | Result | Why |
|---|---|---|
GB82 WEST 1234 5698 7654 32 | Valid | Matches the layout and passes the validator. |
GB82 WEST 1234 5698 7654 30 | Invalid | The invalid example changes one character, the last character: 2 becomes 0. |
In running text the valid example reads, for instance, account GB82 WEST 1234 5698 7654 32. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.
Regex and validation caveats
- The check does not know whether the bank account exists. It proves that the country, length and check digits are consistent.
- The detector has no context words, so an IBAN is masked wherever it appears.
- In the Finance starter template, the last four characters of an IBAN stay readable (partial masking), so support staff can still identify an account.
- Countries missing from the length table are rejected, so an IBAN from a country outside the registry list is not matched by the checksum.
How to detect it in LLM traffic
IBAN details appear in supplier onboarding emails, remittance advice, expense exports and customer-service threads. People paste them into an assistant to draft a reply, reconcile a list or check a format, and the model does not need the real account to do any of that.
Maskflare finds bank identifiers in the full request body and replaces each with a token. In the Finance starter template the last four characters of an IBAN stay readable for support work, using the partial action; every other template masks the whole value.
If you build the detection yourself
- Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
- Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter IBAN candidates.
- Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
- Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.
How Maskflare handles it
- Protect now, Healthcare and Developer: mask (a reversible token).
- Finance - Protect now: partial (last four characters readable).
- Monitor first: alert (counted, forwarded unchanged).
The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.
Compliance profiles that include it
5 of the 6 compliance profiles include the Global pack, and applying them turns this detector on: HIPAA Safe Harbor, GDPR - EU/EEA, UK GDPR, US personal data and Switzerland - nDSG health data. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.
Frequently asked questions
How do I validate an IBAN with a regex?
A regex can check the shape, but not the check digits. Maskflare combines a pattern with the country length table and the modulus 97 test, because a regex alone accepts many invalid numbers.
Does Maskflare read IBANs with spaces?
Yes. Spaces are removed before the length and modulus 97 checks.
Why are there IBAN detectors for each country?
Country packs carry their own IBAN detector, so the IBAN is part of the pack when an organisation enables a country. The global detector catches IBANs from any country.
Is the IBAN detector on by default?
Yes. It belongs to the Global pack, which the default Protect now template turns on with the action mask.
Does a valid IBAN prove the person exists?
No. A check digit shows the value is well formed. Many valid-looking numbers have never been issued, and Maskflare masks them all the same.
Rules on this page describe what Maskflare's detectors and validators check. They are read from the detection catalogue and are not the specification of the body that issues the identifier. Examples are synthetic.