Validating IBANs

Whenever a user types an IBAN — a vendor onboarding form, a payout settings page — validate it before you ever build a QR from it.

The Rule Object

use RealRashid\RaastQr\Rules\PakistaniIban;

$request->validate([
    'iban' => ['required', new PakistaniIban],
]);

The String Rule

Registered automatically, for rule strings and form request arrays:

$request->validate([
    'iban' => 'required|pakistani_iban',
]);

In a Form Request

class VendorPayoutRequest extends FormRequest
{
    public function rules(): array
    {
        return [
            'account_title' => ['required', 'string', 'max:255'],
            'iban' => ['required', new PakistaniIban],
        ];
    }

    public function messages(): array
    {
        return [
            'iban.*' => 'Please double-check that account number.',
        ];
    }
}

What Gets Checked

Both rules run the full ISO 13616 mod-97 checksum, not just a pattern match:

Value	Result
PK33ABCD0000000000000000	✅ passes
pk33 abcd 0000 0000 0000 0000	✅ passes — spaces and case are fine
PK00ABCD0000000000000000	❌ wrong check digits
PK33ABCD000000000000000	❌ too short
GB33ABCD0000000000000000	❌ not Pakistani
PK3312340000000000000000	❌ bank code must be letters

That checksum is what catches a single transposed digit — the exact mistake that would otherwise send someone's money to a stranger.

Customising the Message

Publish the translations:

php artisan vendor:publish --tag=raast-qr-lang

Then edit lang/vendor/raast-qr/en/validation.php:

return [
    'pakistani_iban' => 'The :attribute must be a valid Pakistani IBAN (24 characters, starting PK).',
];

Add an Urdu translation at lang/vendor/raast-qr/ur/validation.php if your app is localised.

Normalise Before Storing

Validation accepts spaces and lowercase. Normalise before persisting so your database holds one canonical form:

$vendor->update([
    'iban' => RaastQr::normalizeIban($request->iban),
]);

And format when displaying it back:

{{ RaastQr::formatIban($vendor->iban) }}
{{-- PK33 ABCD 0000 0000 0000 0000 --}}

Checking Outside Validation

if (! RaastQr::isValidIban($iban)) {
    // handle it
}

Made with ❤️ from Pakistan