The public method is not named IBAN because maybe someday classes from other locale will get such method too and it won't be an IBAN.
As IBAN is very specific to a country so it doesn't make sense to provide it in the generic Payment class, that's why it is protected. Still, it's shared among many classes extending Payment so it's useful to keep it in the base class.


The prefix param in bankAccountNumber should be first because it is most likely to be specified while leaving rest as default. For example, when generating an IBAN from a specific bank.
In the iban() method the $countryCode param is required so it must be first.
Anyway, they are not the same methods, so the order of param shouldn't be so much of an issue.