Identifier Validator: IBAN, BIC, IMEI, ICCID, Card BIN, ABA Routing, VAT

Which identifiers can be checked, at a glance?

Each of these numbers is built so that a single wrong digit, and most swapped pairs, break a calculation anyone can repeat. That makes a check digit a fast first filter for typos and invented numbers in screenshots, invoices and reports — but never proof that the account, phone, card or company is real.

How does each check work?

IBAN

An IBAN is a two-letter ISO country code, two check digits and a country-specific Basic Bank Account Number (BBAN). The check digits are validated by moving the first four characters to the end, converting letters to numbers (A = 10 … Z = 35) and confirming that the result divided by 97 leaves 1 Wikipedia: International Bank Account Number (ECBS example, mod-97 method; read 8 Oct 2026). The SWIFT registry fixes each country’s length and BBAN pattern: the validator embeds the table that python-stdnum generated from SWIFT IBAN Registry release 101 — 89 countries, refreshed on 4 January 2026 python-stdnum 2.2: iban.dat “generated from iban-registry-v101.txt”, plus BIC, IMEI, routing-number and VAT modules (read 8 Oct 2026). SWIFT’s own site refused automated access from our build environment on 8 October 2026, so we could not read the registry file directly or confirm whether a newer release exists; we did confirm that all 89 lengths agree with an independent transcription, php-iban, whose bank and branch positions we use to extract bank codes php-iban registry.txt: bank/branch positions and example IBANs transcribed from the SWIFT registry (read 8 Oct 2026).

For six countries the BBAN carries its own national check, which the validator also runs: Belgium (first ten digits mod 97), Spain (the two CCC control digits), Norway (mod 11, or Luhn for old seven-digit postgiro accounts), Montenegro (BBAN mod 97 = 1) — all cross-checked against python-stdnum — and France and Monaco, whose RIB key is 97 − ((89 × bank + 15 × branch + 3 × account) mod 97) with letters in the account converted A/J = 1, B/K/S = 2 and so on Wikipédia (fr): Clé RIB — formula and letter table (read 8 Oct 2026). A mismatch there while the IBAN check digits pass usually means the IBAN was generated from a mistyped account number.

BIC / SWIFT code

ISO 9362 codes are 8 or 11 characters: 4 for the institution, an ISO 3166-1 country code (SWIFT also uses XK for Kosovo), 2 for the location and an optional 3-character branch, with XXX or an 8-character code meaning the primary office. By convention a “0” as the second location character marks a test BIC, “1” a passive participant not connected to the SWIFT network and “2” usually reverse billing Wikipedia: ISO 9362 (BIC structure, location-code conventions; read 8 Oct 2026). BICs have no check digit, so the validator can only confirm format and country.

IMEI and IMEISV

GSMA’s allocation rules split an IMEI into an 8-digit Type Allocation Code (TAC), a 6-digit serial number and a Luhn check digit computed over the other 14 digits; the IMEISV replaces the check digit with a 2-digit software version number. The first two TAC digits are the Reporting Body Identifier: 01 CTIA, 35 TÜV SÜD (BABT), 86 TAF in China, 00 for test IMEIs, plus legacy codes such as 44 and 49 that no longer allocate GSMA TS.06 v27.0 IMEI Allocation and Approval Process (6 Jan 2025). Which model a TAC belongs to is held in the GSMA IMEI Database, in which GSMA retains all rights GSMA Terms and Conditions for TAC Allocation, clause 7.3 (rev. 1 Apr 2018); the page therefore links to third-party lookups rather than embedding a model list.

ICCID

The number printed on a SIM follows ITU-T E.118: 89 (telecommunications), a country calling code of 2–3 digits, a 1–4 digit issuer identifier and the account number, closed by a Luhn check digit; 19- and 20-digit ICCIDs are both in use. Countries sharing +1 use 01 (Canada uses 302), Russia 701 and Kazakhstan 997 Wikipedia: SIM card — ICCID and ITU-T E.118 layout (read 8 Oct 2026). Country codes are matched against Google’s libphonenumber table phonenumbers 9.0.40 (port of Google libphonenumber): E.164 country-calling-code table (read 8 Oct 2026). Because the issuer identifier length varies and the ITU’s issuer list is not embedded, the issuer split is shown as structure only.

Payment card numbers

A card number (PAN) starts with a six- or eight-digit issuer identification number and ends with a Luhn check digit. Network ranges used here: Visa 4; Mastercard 51–55 and 2221–2720; American Express 34 and 37; Discover 6011, 644–649, 65 and 622126–622925; JCB 3528–3589; UnionPay 62; Diners Club 30, 36, 38 and 39; Maestro 5018, 5020, 5038, 5893, 6304, 6759 and 6761–6763; Mir 2200–2204 Wikipedia: Payment card number — IIN ranges table (read 8 Oct 2026). Ranges overlap where cards are co-branded, so every matching network is listed. The issuing bank’s name is in the networks’ licensed BIN tables, not in the number.

US ABA routing numbers

The American Bankers Association’s policy defines the routing number as a 4-digit Federal Reserve routing symbol, a 4-digit institution identifier and a check digit, and allocates the first two digits by series: 00 U.S. Government, 01–12 regular, 21–32 thrifts (assigned until 1985), 61–72 electronic transaction identifiers and 80 traveler’s checks American Bankers Association: Routing Number Policy and Procedures — structure and prefix series (read 8 Oct 2026). The check digit makes 3(d1 + d4 + d7) + 7(d2 + d5 + d8) + (d3 + d6 + d9) a multiple of 10, and 01–12 map to the twelve districts from Boston to San Francisco Wikipedia: ABA routing transit number — 3-7-1 checksum and district table (read 8 Oct 2026).

EU VAT numbers

The European Commission publishes each member state’s VAT number structure in the VIES FAQ — for example ATU99999999, DE999999999, FRXX 999999999 and NL followed by 12 characters with B in the 10th position — but says it cannot divulge the check-digit algorithms European Commission VIES: FAQ “VAT identification number structure” table and FAQ answers (read 8 Oct 2026). The validator applies those structures to all 27 member states and Northern Ireland (XI), and runs the publicly documented algorithms for 12 countries using python-stdnum’s implementations as the reference python-stdnum 2.2: iban.dat “generated from iban-registry-v101.txt”, plus BIC, IMEI, routing-number and VAT modules (read 8 Oct 2026). Greece uses EL, not GR.

How do investigators use these checks?

• Fraud and scam reports. Victims often submit screenshots of “payment details”. A failed IBAN or routing checksum flags an OCR or transcription error before you send a request to a bank; a pass tells you which country and bank code to ask about.
• Phishing and invoice fraud. When an email changes the beneficiary account, compare the new IBAN’s country and bank code with the supplier’s known bank, and the BIC’s country with the IBAN’s. A mismatch is a red flag; a match proves nothing.
• Seized-phone and device reports. Extraction reports list IMEI, ICCID and IMSI values. Checking the Luhn digits catches transcription errors, and the TAC and ICCID country code show which device family and which SIM issuer country to pursue. See our Cellebrite phone forensics guide for how those reports are produced.
• Company due diligence. A VAT number that fails its checksum on an invoice or website is worth a second look; one that passes still needs a VIES check and a company-register search on our business OSINT page.
• Documentation. Export the results as CSV or JSON and record them alongside your other findings in the Evidence Logger.

What can’t a valid number tell you?

• That it exists. About one random number in ten passes a Luhn check, and one in 97 passes a mod-97 check. Scammers can generate valid-looking numbers.
• Who holds it. No identifier here contains a name. Account-holder confirmation needs the bank, a confirmation-of-payee service or legal process.
• The current bank or model. Routing numbers survive mergers, and TAC-to-model data sits in the GSMA database.
• Registration status. VAT numbers can be deregistered; only VIES or the tax authority knows.

Is it legal to check these numbers?

Running a check-digit calculation on a number you already hold is ordinary arithmetic, and this page neither looks anything up nor stores what you paste. What matters is where the number came from and what you do next: card numbers, bank details and device identifiers of real people can be personal or payment data, and using someone else’s card or account details without authorisation can be a crime. Only handle numbers you are entitled to process, prefer the published test numbers when learning, keep exported files secure, and take advice on your local data-protection and payment-card rules before building a workflow around real data. This page is information, not legal advice.

How was the validator tested?

The engine file that runs this page (identifier-validator.js) was run in Node.js against published examples, and the page itself in headless Chromium at 375 px and 1280 px:

• IBAN: the ECBS example GB82 WEST 1234 5698 7654 32 (bank WEST, sort code 123456), DE89 3704 0044 0532 0130 00 (BLZ 37040044), the SWIFT registry example for every country that php-iban records (85 of 89), plus national checks on FR14 2004 1010 0505 0001 3M02 606, MC58…, ES91 2100 0418 4502 0005 1332, BE68 5390 0754 7034, NO93 8601 1117 947 and ME25 5050 0001 2345 6789 51; invalid variants (changed check digits, swapped digits, one character short) fail.
• BIC: DEUTDEFF, DEUTDEFF500, NEDSZAJJXXX; test (…10) and passive (…A1) location codes; bad country and wrong length fail.
• IMEI: the worked example 49 015420 323751 8 Wikipedia: IMEI (worked Luhn example 49015420323751-8; read 8 Oct 2026) passes with TAC 49015420 and serial 323751, …517 fails, and IMEISV 4901542032375186 yields SVN 86 and the full IMEI.
• Cards: processor test numbers 4111 1111 1111 1111 Braintree (PayPal) docs: Testing — test card numbers incl. 4111111111111111 (vendor documentation, read 8 Oct 2026), 4242 4242 4242 4242, 5555 5555 5555 4444, 2223 0031 2200 3222, 3782 822463 10005, 6011 1111 1111 1117, 3056 9300 0902 0004, 3566 0020 2036 0505 and 6200 0000 0000 0005 Stripe docs: Testing — test card numbers (vendor documentation, read 8 Oct 2026) are detected as the right network; a changed last digit fails.
• ABA: 011000015, listed for the Federal Reserve Bank of Boston XE routing-number lookup: 011000015 = Federal Reserve Bank of Boston (third-party directory, read 8 Oct 2026), passes in district 1 (Boston); 011000016 fails and the tool names 5 as the correct check digit; 111000025 passes in Dallas.
• VAT: VIES publishes structures, not example numbers, so the valid and invalid examples from python-stdnum’s documentation were used (for example ATU13585627, DE136695976, FR23334175221, IT00743110157, NL004495445B01, NL002455799B11, PL8567346215, SE123456789701).
• 6,670 randomly generated IBANs, BICs, IMEIs, routing numbers, Luhn strings and VAT numbers for the 12 checksum countries gave the same valid/invalid verdict as python-stdnum 2.2, with no mismatches.
• In the browser: auto-detection of a mixed batch, CSV formula escaping, JSON export, card masking, card numbers stripped from ?v= links, hostile input rendered as text, and no horizontal scrolling at 375 px.

Sources

• python-stdnum 2.2: iban.dat “generated from iban-registry-v101.txt”, plus BIC, IMEI, routing-number and VAT modules (read 8 Oct 2026)
• php-iban registry.txt: bank/branch positions and example IBANs transcribed from the SWIFT registry (read 8 Oct 2026)
• Wikipedia: International Bank Account Number (ECBS example, mod-97 method; read 8 Oct 2026)
• Wikipédia (fr): Clé RIB — formula and letter table (read 8 Oct 2026)
• Wikipedia: ISO 9362 (BIC structure, location-code conventions; read 8 Oct 2026)
• GSMA TS.06 v27.0 IMEI Allocation and Approval Process (6 Jan 2025)
• GSMA Terms and Conditions for TAC Allocation, clause 7.3 (rev. 1 Apr 2018)
• Wikipedia: IMEI (worked Luhn example 49015420323751-8; read 8 Oct 2026)
• Wikipedia: SIM card — ICCID and ITU-T E.118 layout (read 8 Oct 2026)
• phonenumbers 9.0.40 (port of Google libphonenumber): E.164 country-calling-code table (read 8 Oct 2026)
• Wikipedia: Payment card number — IIN ranges table (read 8 Oct 2026)
• Stripe docs: Testing — test card numbers (vendor documentation, read 8 Oct 2026)
• Braintree (PayPal) docs: Testing — test card numbers incl. 4111111111111111 (vendor documentation, read 8 Oct 2026)
• American Bankers Association: Routing Number Policy and Procedures — structure and prefix series (read 8 Oct 2026)
• Wikipedia: ABA routing transit number — 3-7-1 checksum and district table (read 8 Oct 2026)
• XE routing-number lookup: 011000015 = Federal Reserve Bank of Boston (third-party directory, read 8 Oct 2026)
• European Commission VIES: FAQ “VAT identification number structure” table and FAQ answers (read 8 Oct 2026)

Stripe and Braintree test numbers and XE’s directory entry are vendor or third-party statements, reported as published. External lookup links on result cards go to third-party sites, which receive whatever you type there.