I realized after I posted this that account number is ambiguous in this context. It was my membership ID number at the credit union, not the bank account number itself. Their membership numbers were nine digits long and you would use them to identify yourself when you interacted with the a credit union representative over the phone. When I spoke to the support agent about that mystery car payment they said, “It looks like your member number is 649345121, and the real owner’s number is 649345122 so they must have mixed it up on the paperwork.” Which lead me to believe that the loan originated in house and the paperwork just asked for you membership number and which kind of account to use for the automatic payment. I guess the checksum was supposed to be the human who entered the number verifying that the account holder information matched the information on the form, but that didn’t happen in my case.

A significant part of the world - all of the EU, but also a lot outside it- uses the IBAN standard [0]. The checksum algorithm is mod97, two digits indeed. Very often, there are two checksums though!

Also, in my native Belgium, bank payments have had automated payment processing structured messages attached to almost all {b,c}2b payments. That one contains a similar mod97 check.

[0] https://en.wikipedia.org/wiki/International_Bank_Account_Num...

Given that even credit card numbers have a security number, aka checksum, it's a little silly that they just enter any id number without one, esp for things like loans.

Credit card numbers, bank account numbers and suchlike often only dedicate a single decimal digit to the checksum which severely limits their ability to detect errors.

And if numbers are getting keyed in tens of thousands of times per day across a large business, and mistakes happen hundreds of times a week, a checksum that catches 95% of errors will still let tens of errors go undetected every week.