An IBAN looks like a row of characters thrown together. It is not: every part has a job, and two minutes of reading avoids the most expensive mistake there is — a transfer sent to the wrong account.
The first two characters: the country
Two letters, giving the country of the account under the international standard: IT for Italy, ES for Spain, CZ for the Czech Republic, DE for Germany. Note the wording: the country of the account, not the nationality of whoever owns it, nor where they live.
The next two digits: the check
These are check digits calculated from the rest of the IBAN. They let the system reject a wrong code before it even tries: mistype one character and the check almost always fails, so the transfer is refused on the spot. It is a net against typos, not against fraud.
The rest: institution, branch, account number
From there the format changes country by country, and so does the length: an Italian IBAN runs to 27 characters, a Spanish one 24, a Czech one 24, a German one 22. Inside sit the institution identifier and the account number itself. That is why an IBAN has no single length that holds everywhere.
An IBAN does not carry the holder's name
This is the misunderstanding that costs the most. Historically many European transfers were executed on the IBAN alone, with the beneficiary's name unchecked: if the IBAN was valid, the money left. European rules have introduced verification of payee, which compares name against IBAN and warns you when they do not match — but the final confirmation is still yours. If someone sends you a "new" IBAN for an invoice you were expecting, a phone call to a number you already had beats any automatic check.
BIC, SEPA and transfers outside Europe
Inside the SEPA area the IBAN is usually enough. Outside it, or for currencies other than the euro, you may also need the BIC, the code identifying the bank. If the form asks for one, ask the beneficiary rather than guessing: a wrong BIC bounces the transfer back, costing days and fees.