Your IBAN alone is not enough to drain your account, but it does expose you to real risks

An IBAN (International Bank Account Number) is designed to be shared. You give it to employers for payroll, to utilities for bill payments, to anyone who needs to send you money. A hacker or scammer who has your IBAN can initiate a payment from your account, but they cannot complete it without additional information or access that most people do not realise they are protecting.

The actual danger depends on what else they know about you, what your bank's security setup requires, and whether you notice the attempt before it clears. Understanding the difference between what is theoretically possible and what is practically likely will help you decide what to do if your IBAN has been compromised.

Key Takeaways

  • Someone with only your IBAN cannot transfer money out of your account without either your login credentials or your approval of a specific payment instruction.
  • The real risk is a fraudulent standing order or direct debit — a recurring payment you did not authorise — because these often clear without real-time verification.
  • If you spot an unauthorised payment, contact your bank when ready; most banks in Europe and the UK will reverse it if you report it within a set timeframe, usually 8 weeks.
  • Your IBAN is safe to share with legitimate payors, but never share it alongside your name, address, and date of birth all at once, as that combination can be used to open accounts in your name.

What a scammer can actually do with your IBAN

The most common attack is a fraudulent direct debit or standing order. A scammer uses your IBAN to set up a recurring payment to their own account, often disguised as a subscription, utility bill, or loan repayment. Unlike a one-time bank transfer, which usually requires you to authorise it through your online banking, a direct debit can sometimes clear on the first attempt without your bank asking for confirmation.

The second route is account takeover. If the scammer has your IBAN and has also obtained your login credentials — through phishing, malware, or a data breach — they can log into your account and move money themselves. This is not about the IBAN; it is about the credentials. But scammers often collect both pieces together.

A third, less common scenario is identity fraud. If someone has your IBAN, name, address, and date of birth, they may be able to open a new account in your name at a different bank, or explore for credit using your identity. Again, the IBAN alone is not the problem — it is the IBAN plus other personal data.

Why your bank cannot straightforward reverse every unauthorised payment

When you report an unauthorised payment, your bank has a legal obligation to investigate and, in most cases, refund you. In the UK and EU, you are protected under the Payment Services Regulations and the Consumer Rights Act. However, the bank's response depends on how the payment was made and how quickly you reported it.

If the payment was a one-time transfer that you authorised (even if you were tricked into doing so), the bank may not reverse it — you authorised it, even if under false pretences. If it was a direct debit or standing order you did not set up, the bank should cancel it and refund the money, provided you report it within 8 weeks of the transaction date. If you report it after 8 weeks, the bank may still help, but they are not legally required to.

The key is speed. The moment you notice a payment you did not make, contact your bank. Most banks have a fraud line that operates 24/7, and they can freeze the account or block further payments while they investigate.

How to tell if your IBAN has been misused

Check your bank statements regularly — weekly if possible, or set up transaction alerts through your online banking. Most banks allow you to receive a notification by email or SMS whenever a payment over a certain amount leaves your account. If you see a payment you do not recognise, note the date, the amount, and the recipient's name or account number.

Common signs of a fraudulent direct debit include small, recurring charges that look like subscriptions (streaming services, gym memberships, insurance) that you did not sign up for. Scammers often start with small amounts to avoid triggering your attention, then increase them later. If you see a charge from a company you have never heard of, or from a company you use but the amount is wrong, investigate when ready.

If you find an unauthorised payment, do not wait. Call your bank's fraud line, not the general customer service number. Have your statement in front of you and be ready to describe the transaction in detail. The bank will ask whether you authorised it, and you will say no. They will then begin the dispute process.

Steps to take if you believe your IBAN has been compromised

First: Contact your bank when ready by phone. Use the number on the back of your card or your bank statement, not a number from a search result or an email. Tell them you believe your IBAN has been used fraudulently and ask them to flag your account for monitoring.

Second: Ask your bank to cancel any standing orders or direct debits you do not recognise. Do not wait for the next payment to go out. The bank can cancel them on the spot.

Third: If you have given your IBAN to someone and later realised they were not legitimate, tell your bank that too. They may be able to block payments to that specific recipient account.

Fourth: Check your credit file with the three UK credit reference agencies (Equifax, Experian, TransUnion) or the equivalent in your country. If someone is trying to open accounts in your name, it will show up here. You can check for free once a year through Clearscore, Checkmyfile, or the agencies' own websites.

Fifth: If your IBAN was compromised as part of a larger data breach, consider changing your passwords for any online accounts that use the same email address or password. A scammer with your IBAN and your email address can sometimes reset your bank password.

What you should never do with your IBAN

Do not share your IBAN in response to an unsolicited email, text, or phone call, even if the sender claims to be from your bank. Your bank will never ask you for your IBAN by email or phone — they already have it. If someone contacts you asking for it, it is a scam.

Do not post your IBAN on social media or in public forums. Do not include it in an email signature. Do not write it on a cheque and then photograph the cheque for social media. These are all ways your IBAN can end up in the hands of someone who should not have it.

Do not give your IBAN to someone unless you have a specific reason to do so — payroll, a bill payment, a refund. If you are unsure whether a request is legitimate, contact the organisation directly using a phone number or website you know is theirs, not one provided in the message asking for your IBAN.

How to protect your account beyond your IBAN

Use two-factor authentication (2FA) on your online banking. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Most banks now offer this; if yours does not, ask why.

Set up transaction alerts for any payment over a certain amount — £50, £100, whatever makes sense for your spending. You will receive a notification when ready, and you can contact your bank to block it if it is fraudulent.

Use a strong, unique password for your online banking — one you do not use anywhere else. If a scammer breaches a retailer or social media site and obtains your password, they will try that same password on your bank account. A unique password stops them.

Do not use public Wi-Fi to access your online banking. Use your mobile data or a home network. Public Wi-Fi is easier for scammers to intercept.

Frequently Asked Questions

Can someone open a bank account in my name using just my IBAN?

Not with the IBAN alone. They would need your name, address, date of birth, and usually a form of ID or a utility bill. However, if they have all of these pieces, they may be able to open an account or explore for credit in your name. This is why you should never share your IBAN alongside other personal details in a single message or document.

If I report an unauthorised payment, will my bank definitely refund me?

In most cases, yes — if you report it within 8 weeks and you did not authorise it. However, if you were tricked into authorising the payment yourself (for example, a scammer convinced you to transfer money to them), the bank may not refund you. The distinction is whether you gave the instruction, even if you were deceived.

How long does it take for a bank to investigate a fraudulent payment?

Most banks will refund you provisionally within 5 to 10 working days while they investigate. The full investigation can take up to 8 weeks. During that time, the money is usually back in your account, but the bank may reverse the refund if they determine the payment was actually authorised.

Should I change my IBAN if I think it has been compromised?

No. Your IBAN is tied to your account and cannot be changed. What you should do is monitor your account closely, set up alerts, and contact your bank to flag any suspicious activity. If your account is severely compromised, your bank may close it and open a new one for you, which will generate a new IBAN, but this is rare and only done in extreme cases.

Is it safe to give my IBAN to my employer or a utility company?

Yes. Your employer and utility companies need your IBAN to pay you or collect payments. This is a normal, safe use of your IBAN. The risk comes when you share it with someone you do not know or in response to an unsolicited request.