IBANs (international bank account numbers)

How nullcipher recognises it

Country code, two check digits and the account part (spaces every four allowed), at the exact length that country uses, passing the ISO 13616 mod-97 check.

This is the rule text of the “IBAN” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

GB82 WEST 1234 5698 7654 32

nullcipher replaces it with [IBAN_1]. This is the textbook example IBAN used to show how the ISO 13616 check digits work; it is the same one the front page's example uses. Change any one digit and nullcipher no longer masks it, because the check fails.

Why it matters in an AI chat

An IBAN identifies one bank account. On its own it cannot move money out of that account, which is why people share it on invoices.

Together with the holder's name, though, it is what a direct-debit mandate asks for. A leaked name and IBAN can be used to set up debits the owner never agreed to, and it is up to the owner to notice them.

Payment logs and payroll or refund exports put IBANs next to names, amounts and e-mail addresses — exactly the combination that makes them useful to someone else.

If it already leaked

1. Watch the account's statements for direct debits and payments you did not authorise, and ask your bank to reverse any you find.
2. Ask your bank whether it can block direct debits on the account, or allow only the creditors you name.
3. An IBAN cannot be changed without opening a new account. That is only worth doing if misuse keeps happening.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 16 secret types and how to delete a chat you already sent.