pii.iban
An IBAN — valid mod-97 checksum and matching the issuing country's fixed length — appears in the free text.
What it looks at#
Candidates matching an IBAN’s shape (two letters, two check digits, then more alphanumerics) are checked two ways: the ISO 7064 MOD 97-10 checksum every real IBAN satisfies, and the exact length the issuing country’s central bank publishes for its own IBANs (ISO 13616) — ambiguous or unrecognised country prefixes are never matched. The length table covers every country in the IBAN registry, about 90 of them.
Both the compact form (DE89370400440532013000) and the bank-printed grouped form —
4 characters, single space, repeat, e.g. DE89 3704 0044 0532 0130 00 — are matched, and
the finding’s location covers the whole grouped value so redaction masks all of it.
Why it matters#
An IBAN is enough on its own to initiate a transfer to, or attempt one from, the account it names. It’s meaningfully more sensitive than a bare account number precisely because it’s standardised and immediately usable across borders.
What to do#
Medium severity. This is the kind of value that shouldn’t sit in a support ticket, a log, or free-text storage at all — treat a hit as a signal to redact and to check whether the value needs to exist in that system in the first place.