The IBAN code is a unique, one-time code that each bank account in the world has. It is used to identify accounts internationally, as long as the country where the account is located is part of SEPA (Single Euro Payments Area), made up of 36 countries (the 27 EU members, in addition to Iceland, Liechtenstein, Norway, Monaco, San Marino, Switzerland, Andorra, the United Kingdom and Vatican City). Created as an initiative of the European Committee for Banking Standards (ECBS), the IBAN code is intended to facilitate the automatic processing of international payments by ensuring that each transaction is fast and secure, regardless of the countries in which the parties involved reside.

The IBAN code appeared in Spain in 2014, when the SEPA zone was launched. It consists of 24 characters: 

• The first two identify the home country of the account (in the case of Spain, ES).
• The next two are the control digits, which prevent errors when making a transfer between banks. 
• Closing out the IBAN code is the so-called 'Customer Account Code,' with 20 characters. This code, in turn, consists of 4 digits, identifying the bank, 4 more specifying the branch, 2 new control digits and, finally, 10 digits for the account number.

The fact that each IBAN code is unique makes many people think it is dangerous to share it with others. However, you shouldn't be afraid to give it out (as long as it's justified). In fact, and often without realizing it, we readily give it to friends or relatives when we need them to make a transfer (for example, to pay for a birthday present), or when paying for an online purchase. 

But the thing is, knowing the IBAN code of someone else's bank account only lets you deposit money in it. Under no circumstances can money be taken out, regardless of the amount, and moved to another account without first proving that you own the account, either with an ID card (if the transfer is made in a branch) or, after the implementation of the new PSD2 regulation, by using 2 or 3 of the following authentication factors: something the user knows (a password), something they own (a smartphone) and something they are (their fingerprint).

The only danger, and one thing to look out for, is the possibility of having a bill, such as for light, water, gas or a content platform subscription, debited from your account. These things could happen and they have an easy solution, since the bill could be returned within 13 months after it is paid (estimated time for those direct debit payments that were not authorized by the account holder).