FA-72496 / Check-digit algorithms / Open access

IBAN accepts check digits 00 and 01 · case 01

An IBAN whose check digits are the out-of-range aliases 00 or 01 is accepted.

Verified by executionVariant 1 · 8 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The 02..98 range test is missing; 01 is congruent to 98 and 00 to 97 modulo 97.

VERIFIED REPAIR

Reject check digits outside 02..98 as malformed.

Unsuccessful approach: Rejecting only 00 still accepts the 01 alias of 98.

Case contract

IBAN validation for the countries DE 22, GB 22, FR 27, NL 18, BE 16, NO 15, MT 31 (other countries: "malformed"). Spaces (print format) are removed and letters are upper-cased. The check digits must be 02..98. Move the first four characters to the end, replace letters with 10..35, and the IBAN is "valid" when the number is 1 mod 97.

Why this case matters

Payment initiation rejects mistyped account identifiers before submitting transfers.

1 / The failure

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(s):
    LENGTHS = {'DE': 22, 'GB': 22, 'FR': 27, 'NL': 18, 'BE': 16, 'NO': 15, 'MT': 31}
    t = s.replace(' ', '').upper()
    if len(t) < 5 or not t.isascii() or not t.isalnum():
        return 'malformed'
    if not t[:2].isalpha() or not t[2:4].isdigit():
        return 'malformed'
    if LENGTHS.get(t[:2]) != len(t):
        return 'malformed'
    r = t[4:] + t[:4]
    n = ''.join(str(int(ch, 36)) for ch in r)
    return 'valid' if int(n) % 97 == 1 else 'invalid'
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
fixtures = [[['regression ["DE00050434738327048798"]', ['DE00050434738327048798'], 'malformed'], ['regression ["DE01819403115748858673"]', ['DE01819403115748858673'], 'malformed'], ['partial-repair ["DE01435241396484727591"]', ['DE01435241396484727591'], 'malformed'], ['control ["DE59811903138375291124"]', ['DE59811903138375291124'], 'valid'], ['control ["DE50296496123032354476"]', ['DE50296496123032354476'], 'valid'], ['control ["DE58862288567935243525"]', ['DE58862288567935243525'], 'valid'], ['control ["GB12YUBO17171961366336"]', ['GB12YUBO17171961366336'], 'valid'], ['control ["GB30TWRL09177880233695"]', ['GB30TWRL09177880233695'], 'valid']], [['regression ["DE00470841292401747110"]', ['DE00470841292401747110'], 'malformed'], ['regression ["DE00370400440532013000"]', ['DE00370400440532013000'], 'malformed'], ['partial-repair ["DE01435241396484727591"]', ['DE01435241396484727591'], 'malformed'], ['partial-repair ["DE01819403115748858673"]', ['DE01819403115748858673'], 'malformed'], ['control ["GB23HJGZ79203524065161"]', ['GB23HJGZ79203524065161'], 'valid'], ['control ["FR88HIO0QY01NRB0VCRB14QO450"]', ['FR88HIO0QY01NRB0VCRB14QO450'], 'valid'], ['control ["FR38Q7OJKEPW4X8D3YP3O6RO9CF"]', ['FR38Q7OJKEPW4X8D3YP3O6RO9CF'], 'valid'], ['control ["FR87B5LPN0GWM8FRHG96JYM18V0"]', ['FR87B5LPN0GWM8FRHG96JYM18V0'], 'valid']], [['regression ["DE01819403115748858673"]', ['DE01819403115748858673'], 'malformed'], ['regression ["DE01435241396484727591"]', ['DE01435241396484727591'], 'malformed'], ['control ["NL15KCEZ0926524218"]', ['NL15KCEZ0926524218'], 'valid'], ['control ["NL97OZQU5858488442"]', ['NL97OZQU5858488442'], 'valid'], ['control ["BE73177155519075"]', ['BE73177155519075'], 'valid'], ['control ["BE31287393626938"]', ['BE31287393626938'], 'valid'], ['control ["BE87587165649240"]', ['BE87587165649240'], 'valid'], ['control ["NO5861733992430"]', ['NO5861733992430'], 'valid']], [['regression ["DE00370400440532013000"]', ['DE00370400440532013000'], 'malformed'], ['regression ["DE00050434738327048798"]', ['DE00050434738327048798'], 'malformed'], ['partial-repair ["DE01435241396484727591"]', ['DE01435241396484727591'], 'malformed'], ['partial-repair ["DE01819403115748858673"]', ['DE01819403115748858673'], 'malformed'], ['control ["NO5861733992430"]', ['NO5861733992430'], 'valid'], ['control ["NO7438063392154"]', ['NO7438063392154'], 'valid'], ['control ["NO8414946034784"]', ['NO8414946034784'], 'valid'], ['control ["MT48QBGB31246251447244909393188"]', ['MT48QBGB31246251447244909393188'], 'valid']], [['regression ["DE01435241396484727591"]', ['DE01435241396484727591'], 'malformed'], ['regression ["DE00470841292401747110"]', ['DE00470841292401747110'], 'malformed'], ['partial-repair ["DE01819403115748858673"]', ['DE01819403115748858673'], 'malformed'], ['control ["MT98JHCG63199638448964680432116"]', ['MT98JHCG63199638448964680432116'], 'valid'], ['control ["DE59811903138375291127"]', ['DE59811903138375291127'], 'invalid'], ['control ["DE50296496123032354477"]', ['DE50296496123032354477'], 'invalid'], ['control ["DE58862288567935243527"]', ['DE58862288567935243527'], 'invalid'], ['control ["GB12YUBO17171961366337"]', ['GB12YUBO17171961366337'], 'invalid']]]
for label, args, expected in fixtures[N - 1]:
    check(label, solve(*args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
regression ["DE00050434738327048798"]	`valid`	`malformed`	Failed
regression ["DE01819403115748858673"]	`valid`	`malformed`	Failed
partial-repair ["DE01435241396484727591"]	`valid`	`malformed`	Failed
control ["DE59811903138375291124"]	`valid`	`valid`	Passed
control ["DE50296496123032354476"]	`valid`	`valid`	Passed
control ["DE58862288567935243525"]	`valid`	`valid`	Passed
control ["GB12YUBO17171961366336"]	`valid`	`valid`	Passed
control ["GB30TWRL09177880233695"]	`valid`	`valid`	Passed

SHA-256 / 0e0da12e4364c8e236b3d68af7e2d234b5b333fcd2e5cd7c17bcf275b7339a79

2 / The unsuccessful fix

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(s):
    LENGTHS = {'DE': 22, 'GB': 22, 'FR': 27, 'NL': 18, 'BE': 16, 'NO': 15, 'MT': 31}
    t = s.replace(' ', '').upper()
    if len(t) < 5 or not t.isascii() or not t.isalnum():
        return 'malformed'
    if not t[:2].isalpha() or not t[2:4].isdigit() or t[2:4] == '00':
        return 'malformed'
    if LENGTHS.get(t[:2]) != len(t):
        return 'malformed'
    r = t[4:] + t[:4]
    n = ''.join(str(int(ch, 36)) for ch in r)
    return 'valid' if int(n) % 97 == 1 else 'invalid'
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
fixtures = [[['regression ["DE00050434738327048798"]', ['DE00050434738327048798'], 'malformed'], ['regression ["DE01819403115748858673"]', ['DE01819403115748858673'], 'malformed'], ['partial-repair ["DE01435241396484727591"]', ['DE01435241396484727591'], 'malformed'], ['control ["DE59811903138375291124"]', ['DE59811903138375291124'], 'valid'], ['control ["DE50296496123032354476"]', ['DE50296496123032354476'], 'valid'], ['control ["DE58862288567935243525"]', ['DE58862288567935243525'], 'valid'], ['control ["GB12YUBO17171961366336"]', ['GB12YUBO17171961366336'], 'valid'], ['control ["GB30TWRL09177880233695"]', ['GB30TWRL09177880233695'], 'valid']], [['regression ["DE00470841292401747110"]', ['DE00470841292401747110'], 'malformed'], ['regression ["DE00370400440532013000"]', ['DE00370400440532013000'], 'malformed'], ['partial-repair ["DE01435241396484727591"]', ['DE01435241396484727591'], 'malformed'], ['partial-repair ["DE01819403115748858673"]', ['DE01819403115748858673'], 'malformed'], ['control ["GB23HJGZ79203524065161"]', ['GB23HJGZ79203524065161'], 'valid'], ['control ["FR88HIO0QY01NRB0VCRB14QO450"]', ['FR88HIO0QY01NRB0VCRB14QO450'], 'valid'], ['control ["FR38Q7OJKEPW4X8D3YP3O6RO9CF"]', ['FR38Q7OJKEPW4X8D3YP3O6RO9CF'], 'valid'], ['control ["FR87B5LPN0GWM8FRHG96JYM18V0"]', ['FR87B5LPN0GWM8FRHG96JYM18V0'], 'valid']], [['regression ["DE01819403115748858673"]', ['DE01819403115748858673'], 'malformed'], ['regression ["DE01435241396484727591"]', ['DE01435241396484727591'], 'malformed'], ['control ["NL15KCEZ0926524218"]', ['NL15KCEZ0926524218'], 'valid'], ['control ["NL97OZQU5858488442"]', ['NL97OZQU5858488442'], 'valid'], ['control ["BE73177155519075"]', ['BE73177155519075'], 'valid'], ['control ["BE31287393626938"]', ['BE31287393626938'], 'valid'], ['control ["BE87587165649240"]', ['BE87587165649240'], 'valid'], ['control ["NO5861733992430"]', ['NO5861733992430'], 'valid']], [['regression ["DE00370400440532013000"]', ['DE00370400440532013000'], 'malformed'], ['regression ["DE00050434738327048798"]', ['DE00050434738327048798'], 'malformed'], ['partial-repair ["DE01435241396484727591"]', ['DE01435241396484727591'], 'malformed'], ['partial-repair ["DE01819403115748858673"]', ['DE01819403115748858673'], 'malformed'], ['control ["NO5861733992430"]', ['NO5861733992430'], 'valid'], ['control ["NO7438063392154"]', ['NO7438063392154'], 'valid'], ['control ["NO8414946034784"]', ['NO8414946034784'], 'valid'], ['control ["MT48QBGB31246251447244909393188"]', ['MT48QBGB31246251447244909393188'], 'valid']], [['regression ["DE01435241396484727591"]', ['DE01435241396484727591'], 'malformed'], ['regression ["DE00470841292401747110"]', ['DE00470841292401747110'], 'malformed'], ['partial-repair ["DE01819403115748858673"]', ['DE01819403115748858673'], 'malformed'], ['control ["MT98JHCG63199638448964680432116"]', ['MT98JHCG63199638448964680432116'], 'valid'], ['control ["DE59811903138375291127"]', ['DE59811903138375291127'], 'invalid'], ['control ["DE50296496123032354477"]', ['DE50296496123032354477'], 'invalid'], ['control ["DE58862288567935243527"]', ['DE58862288567935243527'], 'invalid'], ['control ["GB12YUBO17171961366337"]', ['GB12YUBO17171961366337'], 'invalid']]]
for label, args, expected in fixtures[N - 1]:
    check(label, solve(*args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
regression ["DE00050434738327048798"]	`malformed`	`malformed`	Passed
regression ["DE01819403115748858673"]	`valid`	`malformed`	Failed
partial-repair ["DE01435241396484727591"]	`valid`	`malformed`	Failed
control ["DE59811903138375291124"]	`valid`	`valid`	Passed
control ["DE50296496123032354476"]	`valid`	`valid`	Passed
control ["DE58862288567935243525"]	`valid`	`valid`	Passed
control ["GB12YUBO17171961366336"]	`valid`	`valid`	Passed
control ["GB30TWRL09177880233695"]	`valid`	`valid`	Passed

SHA-256 / 1def68e7a9453aea1198a760440bec2ee8053bac4a2a8d93d419af05107dd8a1

3 / The verified repair

Exit 0

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(s):
    LENGTHS = {'DE': 22, 'GB': 22, 'FR': 27, 'NL': 18, 'BE': 16, 'NO': 15, 'MT': 31}
    t = s.replace(' ', '').upper()
    if len(t) < 5 or not t.isascii() or not t.isalnum():
        return 'malformed'
    if not t[:2].isalpha() or not t[2:4].isdigit() or not 2 <= int(t[2:4]) <= 98:
        return 'malformed'
    if LENGTHS.get(t[:2]) != len(t):
        return 'malformed'
    r = t[4:] + t[:4]
    n = ''.join(str(int(ch, 36)) for ch in r)
    return 'valid' if int(n) % 97 == 1 else 'invalid'
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
fixtures = [[['regression ["DE00050434738327048798"]', ['DE00050434738327048798'], 'malformed'], ['regression ["DE01819403115748858673"]', ['DE01819403115748858673'], 'malformed'], ['partial-repair ["DE01435241396484727591"]', ['DE01435241396484727591'], 'malformed'], ['control ["DE59811903138375291124"]', ['DE59811903138375291124'], 'valid'], ['control ["DE50296496123032354476"]', ['DE50296496123032354476'], 'valid'], ['control ["DE58862288567935243525"]', ['DE58862288567935243525'], 'valid'], ['control ["GB12YUBO17171961366336"]', ['GB12YUBO17171961366336'], 'valid'], ['control ["GB30TWRL09177880233695"]', ['GB30TWRL09177880233695'], 'valid']], [['regression ["DE00470841292401747110"]', ['DE00470841292401747110'], 'malformed'], ['regression ["DE00370400440532013000"]', ['DE00370400440532013000'], 'malformed'], ['partial-repair ["DE01435241396484727591"]', ['DE01435241396484727591'], 'malformed'], ['partial-repair ["DE01819403115748858673"]', ['DE01819403115748858673'], 'malformed'], ['control ["GB23HJGZ79203524065161"]', ['GB23HJGZ79203524065161'], 'valid'], ['control ["FR88HIO0QY01NRB0VCRB14QO450"]', ['FR88HIO0QY01NRB0VCRB14QO450'], 'valid'], ['control ["FR38Q7OJKEPW4X8D3YP3O6RO9CF"]', ['FR38Q7OJKEPW4X8D3YP3O6RO9CF'], 'valid'], ['control ["FR87B5LPN0GWM8FRHG96JYM18V0"]', ['FR87B5LPN0GWM8FRHG96JYM18V0'], 'valid']], [['regression ["DE01819403115748858673"]', ['DE01819403115748858673'], 'malformed'], ['regression ["DE01435241396484727591"]', ['DE01435241396484727591'], 'malformed'], ['control ["NL15KCEZ0926524218"]', ['NL15KCEZ0926524218'], 'valid'], ['control ["NL97OZQU5858488442"]', ['NL97OZQU5858488442'], 'valid'], ['control ["BE73177155519075"]', ['BE73177155519075'], 'valid'], ['control ["BE31287393626938"]', ['BE31287393626938'], 'valid'], ['control ["BE87587165649240"]', ['BE87587165649240'], 'valid'], ['control ["NO5861733992430"]', ['NO5861733992430'], 'valid']], [['regression ["DE00370400440532013000"]', ['DE00370400440532013000'], 'malformed'], ['regression ["DE00050434738327048798"]', ['DE00050434738327048798'], 'malformed'], ['partial-repair ["DE01435241396484727591"]', ['DE01435241396484727591'], 'malformed'], ['partial-repair ["DE01819403115748858673"]', ['DE01819403115748858673'], 'malformed'], ['control ["NO5861733992430"]', ['NO5861733992430'], 'valid'], ['control ["NO7438063392154"]', ['NO7438063392154'], 'valid'], ['control ["NO8414946034784"]', ['NO8414946034784'], 'valid'], ['control ["MT48QBGB31246251447244909393188"]', ['MT48QBGB31246251447244909393188'], 'valid']], [['regression ["DE01435241396484727591"]', ['DE01435241396484727591'], 'malformed'], ['regression ["DE00470841292401747110"]', ['DE00470841292401747110'], 'malformed'], ['partial-repair ["DE01819403115748858673"]', ['DE01819403115748858673'], 'malformed'], ['control ["MT98JHCG63199638448964680432116"]', ['MT98JHCG63199638448964680432116'], 'valid'], ['control ["DE59811903138375291127"]', ['DE59811903138375291127'], 'invalid'], ['control ["DE50296496123032354477"]', ['DE50296496123032354477'], 'invalid'], ['control ["DE58862288567935243527"]', ['DE58862288567935243527'], 'invalid'], ['control ["GB12YUBO17171961366337"]', ['GB12YUBO17171961366337'], 'invalid']]]
for label, args, expected in fixtures[N - 1]:
    check(label, solve(*args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
regression ["DE00050434738327048798"]	`malformed`	`malformed`	Passed
regression ["DE01819403115748858673"]	`malformed`	`malformed`	Passed
partial-repair ["DE01435241396484727591"]	`malformed`	`malformed`	Passed
control ["DE59811903138375291124"]	`valid`	`valid`	Passed
control ["DE50296496123032354476"]	`valid`	`valid`	Passed
control ["DE58862288567935243525"]	`valid`	`valid`	Passed
control ["GB12YUBO17171961366336"]	`valid`	`valid`	Passed
control ["GB30TWRL09177880233695"]	`valid`	`valid`	Passed

SHA-256 / da17a4ca10f55e824bf3b52a0370a41f0291fd1e54bbc0204f844a748e5f3e48

Verification & scope

A deterministic, bounded teaching model of the named scheme under the stated contract; not a certified validator. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:48:39.038076+00:00.

Case digest / cdb6ee106b9904f45ba7ce628f76c0f5fe244c8aadcfc57b000c5a4110f05425