An IBAN appears on a suspicious invoice, a bank statement, or an unexpected transfer. The natural reflex is to want to know who owns this bank account. The European legal framework strictly regulates this process: banking secrecy and the GDPR prevent any free consultation of a register linking an IBAN to an identity.
No public directory allows you to trace the account number back to the account holder’s name. The legal methods that exist do not all reveal the same information, and their reliability varies depending on the context.
Verification of Payee: the European mechanism that changes the game
Regulation (EU) 2024/886 requires payment service providers to offer a free verification of the payee (Verification of Payee) for euro transfers, whether they are instant or traditional. In practice, the bank compares the name entered by the payer with the one associated with the IBAN before authorizing the transfer.
The result is not binary. Four outcomes are possible: match, close match, no match, or verification impossible. In case of a mismatch, the bank alerts the payer, but the regulation does not prevent them from proceeding with the transaction if the user confirms. This detail is important: the alert provides protection, but it does not automatically block the transfer.
This mechanism only covers euro transfers between relevant providers within the European Union. Transactions outside the euro zone, transfers to unregulated jurisdictions, and certain foreign currencies are not subject to this name-IBAN comparison. For these cases, other approaches must be used.
Before taking further steps, you can consult Guide Banque to better understand the exploitable clues from the structure of an IBAN.
What the structure of an IBAN reveals without breaking the law
An IBAN is not a random string of characters. Its composition provides verifiable clues without violating banking secrecy.
- The first two letters identify the country of the account (FR for France, DE for Germany, ES for Spain).
- The following digits (check digit, bank code, branch code) allow for the identification of the banking institution and sometimes the associated branch.
- The BIC code, associated with the IBAN, confirms the name of the bank and its geographical location.
These elements do not disclose the name of the account holder. However, they allow for verification that the IBAN corresponds to the banking institution claimed by a supplier or service provider. An IBAN whose bank code does not match the declared institution is a warning signal that should be taken seriously.
Online validation tools (such as those offered by Wise or iban.com) check the technical validity of the IBAN: format, length, check digit. They confirm that the number exists in a correct format but do not access any personal data of the holder.
Verification of an IBAN holder in a professional context
Businesses are the first to be exposed to transfer fraud. A supplier whose banking details suddenly change, a new payee whose identity has not been verified: these situations fuel the so-called “fake bank account” fraud.
Request proof from the payee
The most direct method remains to request an official bank account statement from the payee, accompanied by an identity document or a Kbis extract for a company. Cross-referencing the bank account statement with an identity document remains the most reliable verification for individuals as well as for an accounting service. This approach does not depend on any third-party tools and poses no legal issues.
Go through your bank
Your bank can, in some cases, perform a verification with the payee’s bank. This procedure takes time and does not always succeed, especially if the account is held abroad. The bank is not obliged to disclose the identity of the holder, but it can confirm or deny a match between a name and an IBAN.
Specialized solutions for businesses
Several providers (Trustpair, IBANtrack, among others) offer automated verifications based on Open Banking or direct bank inquiries. These solutions compare a name-IBAN pair in real-time and return a match result. They do not disclose the identity of the holder to a third party: they confirm or deny a match that the company already possesses.
Field reports vary regarding the coverage of these services outside the SEPA zone. Some providers claim international reach, but response rates drop significantly for accounts located outside the European Union.
Suspected fraud: legal remedies to identify an IBAN holder
When a transfer has been made to a fraudulent IBAN, the approach changes in nature. It is no longer a preventive verification but a judicial procedure.
The first reflex is to contact your bank to initiate a fund recall. The issuing bank then contacts the payee’s bank to try to recover the funds. Success depends on the speed of the request and the availability of funds in the recipient’s account.
At the same time, filing a complaint allows judicial authorities to request the lifting of banking secrecy as part of the investigation. This is the only legal mechanism that allows obtaining the complete identity of an IBAN holder without their consent. An individual cannot obtain this information by their own means without a judicial mandate.
Websites claiming to sell the identity of an IBAN holder exploit a legal gray area, if they are not purely fraudulent. Transmitting personal banking data to an unauthorized third party constitutes a violation of the GDPR.
The Verification of Payee reduces the risk upstream, technical validation tools detect format inconsistencies, and professional solutions confirm a name-IBAN match that is already known. None of these methods turn an IBAN into an identity card. Only a judicial procedure allows this, which remains the fundamental limit of any action taken outside an investigation framework.
