German tax ID (Steuer-ID): format, validation and detection

What it is

The Steuer-IdNr, also called Steuer-ID or IdNr, is the personal tax number of people in Germany. Maskflare keeps it in the Germany pack under tax IDs, and the GDPR (EU/EEA) compliance profile includes the pack. Payslips, HR exports and tax correspondence carry it.

In Maskflare this is the detector de_tax_id, labelled "Germany - Tax identification number (Steuer-IdNr)", category tax id, in the Germany pack.

Format and layout

• 11 digits, written as one block or grouped, such as 86 095 742 719.
• The first digit is not 0.
• In the first ten digits, one digit appears two or three times and every other digit appears at most once.
• The eleventh digit is the check digit.

How the check works

First the structure rule above. Then the ISO/IEC 7064 MOD 11,10 check: start with a running product of 10; for each of the first ten digits add the digit, take the remainder after dividing by 10 (a remainder of 0 counts as 10), double it and take the remainder after dividing by 11. The check digit is 11 minus the final product, with 10 becoming 0.

The repeated-digit rule and the check digit are applied together, which discards almost all random 11-digit numbers.

Worked example

1. Digits 8 6 0 9 5 7 4 2 7 1: the digit 7 appears twice and the other eight are distinct, so the structure rule holds.
2. Running the MOD 11,10 procedure over those ten digits gives the check digit 9, the last digit of the example.

Valid and invalid examples

In running text the valid example reads, for instance, Steuer-IdNr 86095742719. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.

Regex and validation caveats

• A bare 11-digit run is judged by its context. The detector treats a run of digits with no separators as a Steuer-ID unless a word such as order, invoice or phone is nearer to it than one of its own keywords (Steuer-ID, IdNr, tax id, TIN).
• Hyphenated and spaced forms are not subject to that bare-run test.
• The Steuer-ID is not the same as the tax number (Steuernummer) printed on tax notices, or the VAT ID. Those are different formats.

Words that confirm it

The formatted shape is masked without a keyword. For a run with no separators, these words count as the detector's own keywords when a word like order, invoice or phone is also close: identifikationsnummer, idnr, steuer id, steuer-id, steuer-identifikationsnummer, steuerid, steueridentifikationsnummer, tax id, tin. The nearer word wins.

How to detect it in LLM traffic

German tax ID (Steuer-ID) values reach an LLM inside ordinary work rather than as standalone data: a pasted block of HR or payroll rows, a customer-support thread, an onboarding or identity-check form, a spreadsheet someone wants summarised, or an email they want rewritten. The model needs none of the digits for any of those jobs, so the safest place to remove them is before the request leaves the company.

Maskflare reads the whole request body, including the system prompt, earlier messages and tool arguments, so a number buried in the fourth message of a long chat is found as readily as one in the latest message. Each match is replaced with a token such as mf_mask_d7e0 before the request goes out, and with response restoration turned on the real value is put back into the answer for the person who is allowed to see it.

If you build the detection yourself

1. Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
2. Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter German tax ID (Steuer-ID) candidates.
3. Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
4. Treat a run with no separators more carefully than a formatted one: reject it when a word such as order, invoice, phone or reference is nearer to it than one of the identifier's own keywords.
5. Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.

How Maskflare handles it

• Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when Germany is a primary country.
• Monitor first: alert (counted, forwarded unchanged) when Germany is a primary country.

The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.

Compliance profiles that include it

One compliance profile includes the Germany pack, and applying it turns this detector on: GDPR - EU/EEA. For the GDPR (EU/EEA) profile the Germany pack is one of the country packs the administrator can choose from; the profile turns on the ones chosen. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.