Your IBAN alone is not enough to drain your account, but it is enough to cause real problems

An IBAN (International Bank Account Number) is designed to be shared. You give it to employers for direct deposit, to clients who owe you money, to utilities and subscription services. A hacker or scammer who has your IBAN cannot log into your account or transfer money out without additional information — your online banking password, your PIN, or access to your phone for two-factor authentication. But your IBAN is still a liability, because it opens the door to fraud that does not require a password.

The real risk is that someone uses your IBAN to set up unauthorized recurring payments, to file false tax documents, or to commit fraud in your name. These attacks are harder to reverse than a stolen credit card, and they can damage your credit or tie up your money for weeks while the bank investigates.

Key Takeaways

  • An IBAN by itself cannot be used to log in or withdraw money, but it can be used to set up unauthorized direct debits or standing orders.
  • Scammers can use your IBAN to file false tax returns, open accounts in your name, or pose as you to other financial institutions.
  • If you notice unauthorized transactions linked to your IBAN, contact your bank immediately and file a dispute within the timeframe your bank specifies (usually 8 to 13 weeks for SEPA transfers).
  • You cannot revoke an IBAN or change it retroactively, but you can monitor your account regularly and set up alerts for unusual activity.

What a scammer can actually do with your IBAN

The most common attack is a false direct debit or standing order. A scammer uses your IBAN to create a recurring payment to an account they control, often posing as a utility company, subscription service, or government agency. The payment goes through because your bank processes it based on the IBAN and the instruction, not because anyone logged into your account. You may not notice for weeks if the amount is small or if the payment is disguised as a legitimate bill.

A second risk is identity fraud. Someone with your IBAN, name, and address can open a bank account in your name, apply for credit, or file a tax return claiming refunds. Banks sometimes verify identity by IBAN alone, especially for online-only accounts or in countries with weaker verification standards. Once the account is open, the fraudster can take out loans or run up debt in your name.

A third risk is phishing and social engineering. A scammer contacts you claiming to be your bank and says there is suspicious activity on your IBAN. They ask you to "verify" your account by providing your password, PIN, or one-time code. Your IBAN in their message makes the scam look credible. If you comply, they now have the credentials they need to log in and steal your money.

How to respond if you see unauthorized transactions

Contact your bank immediately — do not wait. Call the number on the back of your card or on your bank's official website, not a number from an email or text message. Tell them you see transactions you did not authorize and ask them to freeze your account or block further debits.

For SEPA direct debits (common in Europe), you have the right to dispute the transaction within 8 weeks of the debit date. Your bank must investigate and return the money if the debit was unauthorized. For wire transfers or ACH payments (common in the US), the window is shorter — usually 60 days — and recovery is harder because the money may have already left the banking system.

File a written dispute with your bank. Include the date of the transaction, the amount, the receiving account, and a clear statement that you did not authorize it. Keep copies of everything. Your bank will contact the receiving bank and ask them to reverse the transaction or freeze the account. This process usually takes 2 to 4 weeks, though it can take longer if the receiving bank is uncooperative or if the money has been moved again.

Protecting your IBAN from misuse

You cannot change your IBAN or make it private — it is a permanent identifier tied to your account. But you can reduce risk by being selective about who you give it to. Do not post it on social media, do not include it in emails to people you do not know, and do not give it to anyone who contacts you unsolicited.

Set up account alerts through your bank's app or website. Most banks let you receive notifications for any transaction over a certain amount, or for any new payee added to your account. If your bank offers it, enable alerts for new direct debits or standing orders — these are often the first sign of fraud.

Review your bank statements weekly, not monthly. Look for small recurring charges you do not recognize, because scammers often test with small amounts before scaling up. If you spot something, dispute it immediately — the sooner you report it, the better your chances of recovery.

If you have given your IBAN to a service you no longer use, contact that service and ask them to delete your payment information. If they refuse or go out of business, monitor your account closely for a few months. Some fraudsters hold onto stolen IBANs and use them months or years later.

The difference between IBAN fraud and account takeover

IBAN fraud and account takeover are different threats. IBAN fraud uses your IBAN to pull money out without logging in. Account takeover means someone has your password and can log into your account directly. Account takeover is more dangerous because the attacker has full control, but it requires your password, security questions, or access to your phone.

If you suspect account takeover, change your password immediately from a different device (not your phone or computer, which may be compromised). Use a password you have never used before, make it at least 16 characters, and include numbers, symbols, and mixed case. Then call your bank and tell them your account may have been compromised. They can review recent logins and transactions and lock out any unauthorized sessions.

What your bank is required to do

Banks in most countries are required by law to investigate unauthorized transactions and return your money if the transaction was genuinely not authorized by you. In the European Union, the Payment Services Directive (PSD2) requires banks to refund unauthorized SEPA transfers within 8 weeks. In the United States, the Electronic Funds Transfer Act (EFTA) requires banks to investigate and respond within 10 business days, though the full investigation can take up to 45 days.

However, your bank may deny your claim if they can show that you authorized the transaction, even indirectly. For example, if you gave your IBAN to a service and that service charged you, your bank may say you authorized it by providing the IBAN. This is why it is critical to keep records of what you authorized and to dispute charges quickly if you change your mind.

If your bank refuses to refund you, you can file a complaint with your country's financial regulator. In the EU, this is usually the national banking authority. In the US, it is the Consumer Financial Protection Bureau (CFPB) or your state's attorney general. These agencies can pressure the bank to reconsider and may impose fines if the bank violated the law.

Frequently Asked Questions

Can someone withdraw money from my account if they only have my IBAN?

Not directly. They cannot log in or use an ATM with just your IBAN. But they can set up a direct debit or standing order to pull money out automatically, which is why monitoring your account for unauthorized recurring charges is important.

Is it safe to give my IBAN to someone I just met online?

No. Only give your IBAN to people or organizations you trust and have verified independently. If someone contacts you asking for your IBAN, verify their identity by calling them back at a number you find yourself, not a number they provide.

What should I do if I accidentally shared my IBAN on social media?

Delete the post immediately and monitor your account closely for the next few months. Watch for small recurring charges or new payees. If you see anything suspicious, contact your bank right away. You do not need to close your account or change your IBAN unless fraud actually occurs.

How long does it take to get my money back after I dispute a transaction?

For SEPA transfers in Europe, your bank must investigate within 8 weeks and return the money if it was unauthorized. For ACH transfers in the US, the investigation takes up to 45 days, but the bank may return the money provisionally within 10 days while they investigate further.

Can I change my IBAN if I am worried about fraud?

No. Your IBAN is permanent and tied to your account. If you close the account, you get a new IBAN with a new account, but you cannot change the IBAN of an existing account. The best protection is monitoring your account and disputing unauthorized charges quickly.