Addressing a Payment: Sort Codes, IBANs, and Aliases

Every payment needs an answer to one deceptively simple question: where should the money go? The answer is an account identifier — the address of a payment. Different countries and rails have evolved different addressing schemes, from national sort codes to the international IBAN to modern aliases like a phone number. Getting addressing right is fundamental, because a single wrong digit can send funds to the wrong account or bounce the payment entirely. This post walks through the main addressing systems and how they route money.

National account numbers and bank codes

Most domestic payment systems combine two things: a code that identifies the bank (and often the branch), and a number that identifies the account within it. In the United Kingdom this is the six-digit sort code plus an eight-digit account number. In the United States it is the nine-digit ABA routing number plus an account number. Other countries have their own equivalents, but the pattern is consistent: bank identifier plus account identifier.

The bank code is what routes the payment. When you send a domestic transfer, the rail reads the sort code or routing number to decide which institution should receive the funds; that institution then uses the account number to credit the right customer. The routing number often carries a built-in check digit so obvious typos can be caught before the payment is submitted.

The IBAN: a standard for crossing borders

Domestic formats do not travel well. To make cross-border payments reliable, the International Bank Account Number (IBAN) standardises account addressing under ISO 13616. An IBAN starts with a two-letter country code, then two check digits, then a country-specific Basic Bank Account Number that embeds the local bank code and account number. For example, a UK IBAN packs the sort code and account number inside a longer string prefixed with GB and check digits.

The two check digits are the IBAN's best feature. They are computed with a mod-97 algorithm: a validator can rearrange the IBAN, convert letters to numbers, and confirm the whole thing is congruent to 1 mod 97. This catches the vast majority of transposed or mistyped digits before a payment ever leaves. IBAN length varies by country, from 15 to 34 characters, which is why validation should always be country-aware.

IBAN is not the same as BIC

People often conflate the IBAN with the BIC (Bank Identifier Code, also called a SWIFT code). The IBAN addresses the account; the BIC identifies the institution in the SWIFT network. Many modern schemes support IBAN-only routing, deriving the bank from the IBAN itself, but some cross-border flows still ask for both.

Aliases: addressing for humans

Account numbers are precise but hostile to humans. The modern trend is alias addressing, where a memorable identifier maps to the real account behind the scenes. A phone number, email address, national ID, or handle becomes a proxy that a directory resolves to account details at payment time.

Brazil's Pix keys are a leading example: a key can be a phone number, email, tax registration number, or a random UUID, and the central DICT directory resolves it to the underlying account. India's UPI uses a Virtual Payment Address like name@bank. The UK's Paym linked phone numbers to accounts. In each case the alias is convenience sugar; the payment still routes over account-level identifiers once resolved.

Aliases introduce new responsibilities. The directory must be kept current, protected against enumeration and scraping, and secured so an attacker cannot repoint an alias to their own account. Resolution should also be paired with a name-check step so the payer can confirm they are paying the person they intended.

Practical guidance for builders

• Validate structurally before submitting. Run the IBAN mod-97 check and any national check digits client-side to catch typos early.
• Be country-aware. IBAN length and BBAN structure differ per country; never hard-code one format.
• Resolve aliases at payment time. Directory entries change; do not cache a resolved account indefinitely.
• Pair resolution with name checking. Confirmation of Payee reduces misdirected and fraudulent payments.
• Store the canonical identifier. Keep the resolved account details for audit even when the user typed an alias.

Key takeaways

• A payment address combines a bank identifier (sort code, routing number, or BIC) with an account identifier.
• The IBAN standardises cross-border addressing and embeds mod-97 check digits that catch most typos.
• The IBAN addresses the account; the BIC identifies the institution — they are complementary, not interchangeable.
• Aliases like phone numbers and Pix keys map human-friendly identifiers to real accounts via a directory.
• Always validate identifiers structurally, resolve aliases fresh, and pair resolution with name checking.