Public explainers
What an IBAN leak lets someone do
An IBAN in a stolen file is not a PIN. It is still dangerous, because it lets a stranger talk about your bank account as if they already belong in the conversation.
What an IBAN is
An IBAN, and the French RIB, identifies an account so that payments can be sent to it. Banks, employers and tax services use it every day. That is why it appears in customer files and in national account directories.
Knowing an IBAN does not, by itself, let someone log into your bank or take money out. Your bank still needs authentication you control: a password, an app approval, a card reader, a passkey.
Why criminals still want it
They want the conversation. A caller who can recite your IBAN, your name and your address can pretend to be the bank, the tax office, an operator collecting a bill, or a company updating a mandate.
Typical asks: approve a SEPA mandate you did not create, send a “refund” the other way, install remote-access software, or read a code from your banking app to cancel a transfer. The IBAN is just the prop. You complete the fraud if you follow the instructions.
Directories of accounts
When a file of account holders leaks, or when a national directory of bank accounts is reached without authorisation, the same details appear together: who holds the account, where they live, and the identifier of the account. That combination is enough to run targeted bank and tax impersonation at scale.
If you are told your details were in such an incident, watch your statements and bank alerts. Treat any unexpected call about a transfer, a mandate or a tax refund as a scam until you have checked in the official app you opened yourself.
Check what these guides taught you. Take the quiz