Verify Bank Account Numbers: IBAN and Sort Code Guide

Authorised push payment (APP) fraud cost UK victims GBP 451 million in 2024 — and GBP 257.5 million in the first half of 2025 alone, a 12% year-on-year increase — according to the UK Finance Annual Fraud Report 2025. A significant share of those losses stemmed from payments sent to bank accounts where the account holder did not match the intended recipient. Verifying bank account details before executing a payment is no longer optional. It is a core component of fraud prevention, supplier onboarding, and regulatory compliance across financial services, procurement, and accounts payable functions.

To validate an IBAN number, verify the country code (2 letters), check digits (2 digits), and bank-specific account number using the ISO 13616 standard and the MOD 97-1 algorithm defined in ISO 7064. A UK sort code is validated by checking its 6-digit format (XX-XX-XX) against the Extended Industry Sort Code Directory (EISCD), which confirms the sort code is active and identifies the bank branch. Format validation alone catches transcription errors but does not confirm the account exists or belongs to the expected party — full verification requires Confirmation of Payee (CoP) or an account verification API.

This guide covers the structure of UK and international bank account identifiers, the verification methods available, the regulatory requirements under FCA and Pay.UK rules, and the practical steps to automate bank account validation in your workflows.

This article is provided for informational purposes and does not constitute legal advice. Consult a qualified professional for situation-specific guidance.

UK Bank Account Identifiers: Sort Code and Account Number

The United Kingdom uses a dual-identifier system for domestic payments. The sort code (6 digits, formatted as XX-XX-XX) identifies the bank branch, while the account number (8 digits) identifies the individual account. Together, they route payments through the BACS, Faster Payments, and CHAPS networks.

For international payments and SEPA transactions, UK accounts are represented as IBANs. The UK IBAN is 22 characters long and follows a defined structure.

UK IBAN Structure

IBAN Structures Across Major European Countries

IBAN length and composition vary by country. Any validation system must account for these national differences.

The IBAN Check Digit Algorithm (MOD 97-1)

The IBAN check digits at positions 3-4 are calculated using the MOD 97-1 algorithm defined in ISO 7064. This mathematical validation detects over 98% of transcription errors, including single-character substitutions and adjacent-digit transpositions.

The validation process follows four steps. First, move the first four characters (country code and check digits) to the end of the string. Second, convert all letters to numbers using the mapping A=10, B=11 through Z=35. Third, compute the remainder when dividing the resulting number by 97. Fourth, if the remainder equals 1, the check digits are valid.

This verification catches data entry mistakes but provides no assurance about whether the account exists, is active, or belongs to the expected party.

CheckFile's automated document verification platform extracts IBANs, sort codes, and account numbers from invoices, bank statements, and supplier documents, then validates them against format rules and bank registries in an average of 4.2 seconds (CheckFile platform data, March 2026). Across 2.4 million documents verified, the platform achieves a 98.7% OCR accuracy rate and a 94.3% field extraction rate, reducing manual bank detail verification time by 83%.

Confirmation of Payee: The UK Standard for Name Matching

Confirmation of Payee (CoP) is a name-checking service operated by Pay.UK. It verifies whether the name provided by the payer matches the name registered on the receiving account. CoP has been mandatory for the six largest UK banking groups since 2020 and was extended to all payment service providers directed by the Payment Systems Regulator (PSR) from October 2024.

How CoP Works

When a payer initiates a payment through online or mobile banking, the sending bank transmits the payee's name, sort code, and account number to the receiving bank. The receiving bank compares the name against its records and returns one of four responses: exact match, close match (minor discrepancy such as a nickname), no match, or account not found.

If the response is "no match" or "close match," the payer receives a warning and must actively choose to proceed with the payment. This friction point reduces APP fraud by giving the payer an opportunity to reconsider before funds leave their account.

CoP Limitations

CoP verifies the name on the account but does not confirm the identity of the account holder. A fraudster who opens an account under a stolen identity will pass CoP checks if the name on the account matches the name the victim expects. CoP also does not cover all UK accounts; business accounts at smaller institutions may not yet participate in the network.

APP Fraud and the Regulatory Landscape

The FCA and the PSR have progressively tightened requirements around payment verification in response to rising APP fraud. From 7 October 2024, a mandatory reimbursement requirement obliges sending payment service providers to reimburse APP fraud victims up to GBP 85,000 within five business days, with costs shared between sending and receiving firms.

This reimbursement mandate creates a direct financial incentive for banks and payment firms to invest in pre-payment verification. In the first three months of operation, the PSR reported that 86% of in-scope APP fraud losses were returned to victims — demonstrating the scheme's effectiveness but also the scale of liability exposure for sending firms. In H1 2025, banks returned GBP 159.2 million of APP losses, representing 62% of total stolen funds. Firms that fail to implement CoP and other fraud detection measures face both regulatory sanctions and growing reimbursement liabilities.

CHAPS and BACS Controls

For high-value CHAPS payments, the Bank of England requires enhanced due diligence on beneficiary details. BACS Direct Debit originators must validate sort code and account number combinations through the Extended Industry Sort Code Directory (EISCD) before submitting instructions. These controls reduce rejected payments and provide a first layer of account validation.

Bank account verification methods compared

Common Bank Account Fraud Patterns

Bank account fraud takes several forms, each exploiting different gaps in verification processes.

Invoice Redirection Fraud

A fraudster intercepts or impersonates a legitimate supplier and sends updated bank details, typically attached to a genuine-looking invoice. The paying company updates its records and sends the next payment to the fraudster's account. This is the most common form of APP fraud targeting businesses. Investment scams saw the sharpest rise in H1 2025 — GBP 97.7 million stolen, a 55% increase year-on-year — but invoice and payment redirection fraud remains the primary vector for business victims, accounting for a substantial share of the GBP 451 million lost to APP fraud across 2024.

Account Takeover

The fraudster gains access to a legitimate business email account and sends payment instructions from a trusted address. Because the email is authentic, the request bypasses social engineering defences.

Mule Accounts

Fraudsters recruit or coerce individuals to open bank accounts in their own names, then use these accounts to receive fraudulent payments. The account passes CoP name checks if the payer has been given the mule's name as the expected payee.

Practical Verification Workflow

An effective bank account verification process operates at three levels, each adding assurance.

Level 1: Format Validation

Validate the sort code against the EISCD to confirm it is a valid, active sort code assigned to a participating bank. Validate the account number length (8 digits for UK accounts). For IBANs, run the MOD 97-1 check digit calculation. This level catches data entry errors.

Level 2: Account Existence Check

Query the receiving bank's systems to confirm the account exists and is capable of receiving payments. For UK domestic payments, this is achieved through CoP or through sort code and account number validation services. For international IBANs, dedicated API services query the correspondent banking network.

Level 3: Name Matching and Identity Verification

CoP provides name matching for UK accounts. For international payments or higher-risk transactions, supplement CoP with identity verification and KYC checks. Cross-reference the account holder's name with corporate registry data, proof of address documentation, and existing supplier records.

Automating Bank Account Verification

Manual verification of bank details does not scale. A procurement team processing hundreds of supplier invoices monthly cannot realistically call each supplier's bank to confirm account ownership. Automation addresses this gap by integrating bank account validation directly into accounts payable and onboarding workflows.

Automated document validation systems extract IBANs and sort codes from invoices, contracts, and supplier registration forms. The extracted data is validated against format rules, checked for existence, and matched against the declared beneficiary name. Any change in bank details for an existing supplier triggers an alert and a secondary confirmation workflow.

This automated approach eliminates the delay between receiving bank details and verifying them. It also creates a complete audit trail of every verification performed, supporting compliance with internal controls and regulatory expectations.

The integration with broader customer due diligence processes ensures that bank account verification is not treated as an isolated check but as part of a comprehensive onboarding and monitoring programme.

For a comprehensive overview, see our industry document verification guide. Our platform processes over 180,000 documents per month with a 94.8% fraud detection rate and a false positive rate of 2.8%, delivering results in an average of 4.2 seconds.

Take action

CheckFile verifies 180,000 documents per month with 98.7% OCR accuracy. Test the platform with your own documents — results within 48h.

Request a free pilot

---

Frequently Asked Questions

Does passing the IBAN check digit validation mean the account is legitimate?

No. The MOD 97-1 algorithm verifies the mathematical consistency of the IBAN structure. It confirms the check digits are correct for the given account number, but it does not confirm the account exists, is active, or belongs to the expected party. A fraudster can provide a syntactically valid IBAN for an account they control.

Is Confirmation of Payee mandatory for all UK payments?

CoP is mandatory for all payment service providers that are directed participants or have been directed by the PSR. Since October 2024, this covers virtually all major UK banks and building societies. However, some smaller institutions and certain account types may not yet be fully covered. Payers should treat a "not available" CoP response as a risk indicator.

What should a business do when a supplier requests a change of bank details?

Never update bank details based solely on an email or letter. Contact the supplier using a previously verified phone number (not a number provided in the change request). Verify the new bank details through CoP or an IBAN verification API. Require dual authorisation for any bank detail change in your accounts payable system. Document the verification in your audit trail.

How do IBAN verification APIs work?

IBAN verification APIs accept an IBAN as input and perform multi-level checks: format validation, check digit computation, bank code lookup (confirming the bank exists and participates in the relevant payment network), and in some cases name matching against the account holder. Response times are typically under two seconds. These APIs can be integrated into ERP systems, payment platforms, and onboarding workflows.

What is the difference between IBAN validation and bank account verification?

IBAN validation checks the format and check digits of the IBAN string. Bank account verification goes further by confirming the account exists, is active, and belongs to the declared party. Validation catches typos; verification catches fraud. Both are necessary for a secure payment process.