It is customary for websites, messages, or other documents to sometimes display data (credit card numbers, phone numbers, ...) with some numbers blanked (e.g., replaced with asterisks) so that the legitimate reader can recognize what full number is behind it, but an adversary cannot.
My bank uses this in to obfuscate the bank account number of wire transfer recipients in mTAN confirmation messages. However, they hide only the three last digits of an IBAN.
Given that IBAN involves a modulo 97 checksum, this is in effect not much better that hiding a single digit of "real" data, thus allowing an adversary a significant chance of guessing right. Given the additional fact that certain banks have somewhat predictable local account numbers that form the right end of the IBAN (e.g., often ending in 00, or maybe there was already some kind of checksum in it), I find this practise not very comforting.
Should I be worried / ask the bank for clarification?
EDIT: I am aware of How to mask SEPA (IBAN and BIC) information correctly?, but that question and answer aim at a very different direction, namely: How much of an IBAN should be exposed in order to recognize it from a handful of "my" IBANs to use in a planned transaction? The answer states that typically the last 3-4 digits are enough. My question however is concerned with the opposite scenario, that an IBAN is transmitted with almost all digits visible. It makes sense to display many digits in this scenario so that I can be somewhat confident that the IBAN is indeed the arbitrary IBAN I typed in before (and not the account of someone intercepting the mTAN). While "IBAN numbers are not secret" may apply here as well (thus questioning the need to obfuscate at all), I am also more concerned with the implications that the strong checksum spoils the obfuscation almost completely.