Detection reference · Financial data · Updated 2026-11-03

International Bank Account Numbers (IBAN)

IBANs show up in invoices and payment reminders that people paste to have a reply drafted. Every IBAN carries two check digits, so Redaxa verifies them instead of guessing.

At a glance

Reported as	IBAN
Category	Financial data
Severity	high: direct financial exposure or a strong identifier, such as a card or national number
Replaced with	`[IBAN]`
Where it runs	The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks.
Engine rule	scanner.ts, line 231

What it looks like

A two-letter country code, two check digits and 11 to 30 letters or digits (spaces allowed), 15 to 34 characters in total, passing the ISO 13616 mod-97 check. Trailing words such as a BIC are trimmed until the checksum holds.

Example 1

You paste

Please pay to IBAN GB82 WEST 1234 5698 7654 32 by Friday.

Redaxa returns

Please pay to IBAN [IBAN] by Friday.

Reported as	IBAN
Severity	high: direct financial exposure or a strong identifier, such as a card or national number
Replaced with	`[IBAN]`

Example 2

You paste

Beneficiary IBAN: GB82WEST12345698765432

Redaxa returns

Beneficiary IBAN: [IBAN]

Reported as	IBAN
Severity	high: direct financial exposure or a strong identifier, such as a card or national number
Replaced with	`[IBAN]`

All values on this page are synthetic or published specimens; none is a working credential or a real person's data.

In a repository check

The same example, committed to a public repository and run through the free repository check:

invoices/2026-10.txt: IBAN, listed for review (severity high). Potential sensitive data. Context and authorization must be reviewed; this is not a confirmed vulnerability.
Same value in tests/fixtures/2026-10.txt: Test or example value, counted but not listed. Real-looking keys in test files are still reported.

Values are always shown masked in repository reports. No key is ever tested against its provider.

What it does not flag

IBAN GB82 WEST 1234 5698 7654 32 BIC WESTGB2L: not flagged as IBAN; flagged as Phone number. Limit: when a BIC that contains a digit follows on the same line, the IBAN is not recognised, because only letter-only trailing words are trimmed. Put the BIC on its own line.

Known false positives

Text that is harmless but still flagged today. Listed so you can recognise it, not hidden.

IBAN GB82 WEST 1234 5698 7654 33: flagged as Phone number. Wrong check digits, so not an IBAN; a digit run inside it still matches the phone rule.

What to do

An IBAN on its own does not let anyone withdraw money, but it enables invoice fraud and direct-debit misuse. Remove it from prompts; check bank statements for unexpected direct debits if it was published.

Check before you paste

The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.

Add the Chrome extension Try a free web check

Sources

Redaxa engine: scanner.ts line 231. Every output on this page was produced by that code when the page was built.
SWIFT: IBAN (ISO 13616) and the IBAN Registry
Wikipedia: International Bank Account Number