Identifier detector
EU VAT identification number: format, validation and detection
Short answer
An EU VAT number is a country prefix and a national number with its own check digits. Maskflare supports 22 prefixes and checks each country's own rule, and it masks the number only after a VAT keyword such as VAT, USt-IdNr, TVA, IVA or BTW.
What it is
The VAT identification number of a sole trader identifies a person, which is why the detector exists. It is in the Global pack, which the HIPAA Safe Harbor, GDPR (EU/EEA), UK GDPR, US personal data and Swiss nDSG health profiles include.
In Maskflare this is the detector eu_vat_id, labelled "EU VAT identification number", category tax id, in the Global pack.
Format and layout
- A country code followed by a national body: for example DE plus 9 digits, ATU plus 8 digits, NL plus 9 digits, B and 2 digits, and FR plus two characters and 9 digits. Greece uses EL.
- Spaces between the prefix and the number are allowed.
- The catalogue covers AT, BE, CZ, DE, DK, EE, EL, ES, FI, FR, HR, HU, IE, IT, LU, NL, PL, PT, RO, SE, SI and SK.
How the check works
Each country's own check digit rule is applied, as implemented in core's eu_vat module (the German rule, for instance, is ISO 7064 MOD 11,10). Prefixes whose algorithm is not implemented (BG, CY, LT, LV, MT) are never matched.
Valid and invalid examples
| Example | Result | Why |
|---|---|---|
DE123456788 | Valid | Matches the layout and passes the validator. |
DE123456780 | Invalid | The invalid example changes one character, the last character: 8 becomes 0. |
In running text the valid example reads, for instance, VAT DE123456788. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.
Regex and validation caveats
- The detector is keyword-gated and the catalogue lists about fifty trigger words in several languages, including USt-IdNr, mwst, tva, iva and btw.
- A VAT number identifies a business; for sole traders that is also a person.
- Numbers for the five countries without an implemented algorithm are not detected at all, which is a gap to know about.
Words that confirm it
The detector masks a match only when one of its keywords appears within 48 characters before the value. The catalogue lists 50: afm, alv, alv-numero, btw, btw nr, btw-id, btw-nummer, cif, cvr, ddv, dic, dič, iva, ič dph, kmkr, moms, momsnummer, momsreg nr, mwst, mwst-nr, nif, nif iva, nif-iva, nip, nip ue, numéro de tva, n° tva, oib, p. iva, p.iva, partita iva, pvm, tva, tva intracommunautaire, uid, uid-nr, umsatzsteuer-identifikationsnummer, ust id, ust idnr, ust-id, ust-idnr, ustid, ustidnr, vat, vat id, vat no, vat number, vat reg no, vat registration number, αφμ.
How to detect it in LLM traffic
EU VAT identification number values reach an LLM inside ordinary work rather than as standalone data: a pasted block of HR or payroll rows, a customer-support thread, an onboarding or identity-check form, a spreadsheet someone wants summarised, or an email they want rewritten. The model needs none of the digits for any of those jobs, so the safest place to remove them is before the request leaves the company.
Maskflare reads the whole request body, including the system prompt, earlier messages and tool arguments, so a number buried in the fourth message of a long chat is found as readily as one in the latest message. Each match is replaced with a token such as mf_mask_d7e0 before the request goes out, and with response restoration turned on the real value is put back into the answer for the person who is allowed to see it.
If you build the detection yourself
- Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
- Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter EU VAT identification number candidates.
- Apply the layout rules from the section above. This identifier has no check digit to recompute, so expect more look-alikes than with a checksum-based format.
- Require one of the words listed above shortly before the value. Maskflare looks back 48 characters.
- Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.
How Maskflare handles it
- Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token).
- Monitor first: alert (counted, forwarded unchanged).
The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.
Compliance profiles that include it
5 of the 6 compliance profiles include the Global pack, and applying them turns this detector on: HIPAA Safe Harbor, GDPR - EU/EEA, UK GDPR, US personal data and Switzerland - nDSG health data. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.
Frequently asked questions
Which VAT numbers does Maskflare not detect?
Those with prefixes BG, CY, LT, LV and MT, because their check algorithms are not implemented in the validator. The Swiss UID has its own detector.
Does the VAT number need the word VAT before it?
One of the trigger words must precede it. Many are language specific, such as USt-IdNr for German or TVA for French.
Is the EU VAT identification number detector on by default?
Yes. It belongs to the Global pack, which the default Protect now template turns on with the action mask.
Does a valid EU VAT identification number prove the person exists?
No. This identifier is validated on its layout alone, so a passing value is only well formed, not known to be real.
Rules on this page describe what Maskflare's detectors and validators check. They are read from the detection catalogue and are not the specification of the body that issues the identifier. Examples are synthetic.