Is it safe to give out your IBAN?

Published October 23, 2026

Yes, for the most part. An IBAN is made to be shared: nobody can pay you without it. It does not let anyone log in to your account or move money out of it by transfer. The real risks are narrower: a direct debit you never agreed to, and a fake invoice that swaps someone else’s IBAN for the real one. Here is what each risk looks like and what the rules give you.

What someone can do with your IBAN

• Send you money. That is what it is for. Salary, refunds, rent and invoices all need it.
• Try to set up a direct debit. A direct debit pulls money from an account. It needs a mandate from the account holder. A dishonest company could still enter your IBAN with a fake or missing mandate. This is the main risk, and the rules below give you your money back.
• Put it on an invoice. Anyone can print an IBAN on a bill. If a fraudster gets their own IBAN onto an invoice you expect, the money goes to them. That is the risk for payers, not for the holder of the IBAN.
• See which country and bank you use. The country code is in the first two letters, and in many countries the bank code is readable too. In a German IBAN, characters 5 to 12 are the Bankleitzahl, which names the bank.

What someone cannot do with it

• Log in to your online banking. That needs your login details and, usually, a second factor such as your phone.
• Transfer money out of your account. A transfer is ordered by the account holder, through the bank. Knowing the IBAN does not let anyone order one.
• See your balance or your transactions. The IBAN is an address, not a key.
• Learn your name from it. The IBAN does not contain the holder’s name. Only the bank holds that link.

Treat your IBAN like your postal address. Give it to people who need to pay you or collect a bill you agreed to. Do not post it in public without a reason, and do not send it together with a copy of your passport, your card number or your login details. Those, not the IBAN, are what open accounts.

Direct debits you did not agree to

For SEPA direct debits in the EU, the payment services directive (PSD2, Directive (EU) 2015/2366) gives you two time limits. Note both:

The 8-week refund needs no reason. You ask your bank, and the money comes back. After 8 weeks the question becomes whether there was a valid mandate at all. If there was none, the payment was unauthorised, and you have up to 13 months to report it.

Both limits run from the day of the debit. So the single most useful habit is to read your account regularly. A debit you spot in week two costs you a phone call. A debit you spot after a year may cost you the money.

These are EU rules. If your account is in the UK, ask your bank which refund rules apply to you.

Fake invoices and changed bank details

The more common loss is not about your own IBAN at all. It happens when you pay someone else. A fraudster sends an invoice that looks like the real one, or an e-mail saying "our bank details have changed", with their own IBAN. You pay. The money goes to their account.

No checker can catch this by looking at the number. The fraudster’s IBAN is a real IBAN for a real account. It passes the IBAN checker like any other. Check digits catch typing errors; they cannot tell you whose account it is. Our article on IBAN check digits explains exactly what they detect.

What helps are the name checks that banks now run:

• Verification of Payee (EU). Before you confirm a euro transfer, your bank must compare the payee name you typed with the name on the account behind the IBAN, and tell you whether they match. Banks in the euro area have had to do this since 9 October 2025; banks in the other EU countries must do it by 9 July 2027. It is free (Regulation (EU) 2024/886, Art. 5c).
• Confirmation of Payee (UK). UK banks run a similar name check on payments. The principle is the same: a mismatch is a warning, not a formality.

If your bank says the name does not match, stop. Do not change the name until it fits. Call the company on a phone number you already know, from an older invoice, its website or a contract, not from the e-mail that asked you to pay. Ask them to read out their IBAN.

Signs that an IBAN on an invoice is wrong

• The bank details changed, and you hear about it only by e-mail.
• The country code does not fit the company. A supplier in Leeds asking to be paid into an account in another country is worth a call.
• The message is urgent: "pay today or the order is cancelled".
• The name check at your bank does not match.
• The sender asks you not to call, or to reply only by e-mail.

Our checker can help with the second point. Paste the IBAN and it shows the country, the bank code and, for German IBANs, the bank name from the Bundesbank list. It cannot tell you the holder.

If you have paid the wrong IBAN

Act the same day. Call your bank and ask it to recall the payment. Under PSD2, Art. 88, a bank that carried out a transfer to the IBAN you gave it is not liable for the loss, but it must make reasonable efforts to recover the money. The sooner it tries, the more likely the money is still there.

If the payment was the result of fraud, also report it to the police, and keep the invoice and the e-mails. If someone set up a direct debit on your account without a mandate, ask for the refund (within 8 weeks) or report it as unauthorised (within 13 months).

Is it safe to paste your IBAN into a website?

It depends on the site. Ours runs the check in your browser. What you type is not sent to us or anyone else and is not stored; the details are on the privacy page. You can load the page, switch off your internet connection and the checker keeps working.

Checks format and check digits only. It does not confirm that the account exists or who holds it. Based on the SWIFT IBAN Registry, updated September 17, 2026. · Disclaimer

Other sites may work differently. If a site asks for your IBAN together with your name, date of birth or card details, ask yourself why it needs them. Checking an IBAN never requires a name.

A short checklist

1. Give your IBAN to people who need to pay you or to collect a bill you agreed to.
2. Never send it together with ID documents, card numbers or passwords.
3. Read your account at least once a month and query any direct debit you do not recognise.
4. Before you pay a new or changed IBAN, confirm it by phone with a number you already know.
5. Take a name mismatch at your bank seriously.

If you want to know what each part of an IBAN means, start with what an IBAN is. If someone asks you for a BIC as well, IBAN vs SWIFT/BIC explains when that is still needed.