How to validate IBANs in your checkout or payroll form (and stop failed SEPA transfers)

The problem: bad IBANs fail late and cost real money

An IBAN with a typo doesn't fail when the user types it. It fails days later, inside the SEPA clearing system, as an R-transaction — and by then it has already cost you a bank fee, a delayed payment, and a support ticket. If you run payroll, it's worse: an employee doesn't get paid on time and you re-run the batch manually. The fix is boring but effective: validate the IBAN at the moment of entry, before it ever reaches your payment provider.

Some teams try a regex. A regex can check that a German IBAN starts with DE and has 22 characters, but it cannot check the MOD-97 checksum, and it definitely cannot know that a Norwegian IBAN is 15 characters while a Maltese one is 31. Real validation needs three layers: the international checksum, the country-specific length, and the national BBAN structure. That's exactly what this API does in a single call.

Step 1: validate on form submit

When the user enters bank details, call the validate endpoint:

GET /validate?iban=DE89370400440532013000

The response tells you whether the IBAN is valid and, crucially, why it failed when it isn't. Instead of a bare false, you get reasons like checksum failed or wrong length for DE. Surface these directly in your form — a user who sees "this IBAN is one character short for a German account" fixes the typo immediately; a user who sees "invalid input" abandons the checkout.

Step 2: use the parsed fields, don't re-split the string

A valid response also decomposes the IBAN into the pieces payment systems ask for: country, check digits, bank code, branch/sort code, and account number. If your payout provider or accounting system wants the sort code and account number separately (common for UK-style flows), take them from the response rather than slicing the string yourself — the offsets differ per country and are a classic source of subtle bugs.

Step 3: auto-fill the BIC

For major banks, the API derives the BIC/SWIFT code from the bank code inside the IBAN. Use it to pre-fill the BIC field the moment the IBAN validates — one less field for the user to find on their banking app. You can also hit the dedicated /bic endpoint if you only need the lookup. Note that BIC derivation covers major banks, not every institution, so keep the field editable as a fallback.

Step 4: clean existing data in bulk

Validation at entry protects new records, but most databases already contain years of hand-typed supplier and customer IBANs. Run them through /validate-batch once, flag everything that comes back invalid, and chase corrections before the next payment run instead of after it bounces. Teams typically find a surprising number of IBANs with swapped digits that a length check alone would never catch — MOD-97 catches roughly 999 out of 1000 single-digit errors and transpositions.

Edge cases worth handling

Pasted formatting: users paste IBANs with spaces and lowercase letters straight from bank statements. Normalize before display, but the validator handles the checksum math regardless.
Checksum-valid ≠ account exists: validation proves the IBAN is structurally correct, not that the account is open. It eliminates typos, which are the overwhelming majority of failures, but it is not a bank-account verification service.
Country coverage: the API covers the 77 countries in the official SWIFT IBAN registry, including every SEPA member. Call /countries to list them, or /country/{code} to get the expected length, structure, and a sample IBAN — perfect for showing format hints in your UI.
Privacy: validation is pure computation on bundled registry data. No third-party calls are made, so your customers' bank details never leave the request — relevant if you're documenting data flows for GDPR.

FAQ

Does it verify the account balance or owner? No. It validates structure (checksum, length, BBAN format) and parses the components. Ownership checks require a separate verification-of-payee service.

Why did a syntactically plausible IBAN fail? Check the reasons array — most often the checksum failed, meaning a digit was mistyped or two characters were swapped.

Do I need an SDK? No. It's one GET request with JSON in and JSON out, callable from any language or even a spreadsheet script.

Copy-paste code

Calling iban-validator-bank-account-checker.p.rapidapi.com — replace YOUR_RAPIDAPI_KEY with your key.

cURL

curl --request GET \
  --url 'https://iban-validator-bank-account-checker.p.rapidapi.com/validate?iban=DE89370400440532013000' \
  --header 'X-RapidAPI-Key: YOUR_RAPIDAPI_KEY' \
  --header 'X-RapidAPI-Host: iban-validator-bank-account-checker.p.rapidapi.com'

Python

import requests

url = "https://iban-validator-bank-account-checker.p.rapidapi.com/validate"
querystring = {"iban": "DE89370400440532013000"}
headers = {
    "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
    "X-RapidAPI-Host": "iban-validator-bank-account-checker.p.rapidapi.com",
}

response = requests.get(url, headers=headers, params=querystring)
print(response.json())

JavaScript (fetch)

const url = 'https://iban-validator-bank-account-checker.p.rapidapi.com/validate?iban=DE89370400440532013000';
const options = {
  method: 'GET',
  headers: {
    'X-RapidAPI-Key': 'YOUR_RAPIDAPI_KEY',
    'X-RapidAPI-Host': 'iban-validator-bank-account-checker.p.rapidapi.com',
  },
};

const response = await fetch(url, options);
console.log(await response.json());

Node.js (axios)

import axios from 'axios';

const options = {
  method: 'GET',
  url: 'https://iban-validator-bank-account-checker.p.rapidapi.com/validate',
  params: {iban: 'DE89370400440532013000'},
  headers: {
    'X-RapidAPI-Key': 'YOUR_RAPIDAPI_KEY',
    'X-RapidAPI-Host': 'iban-validator-bank-account-checker.p.rapidapi.com',
  },
};

const { data } = await axios.request(options);
console.log(data);