Identifier detector
Italian codice fiscale: format, validation and detection
Short answer
An Italian codice fiscale has 16 characters. The last letter is a check character computed from the first 15 using two lookup tables, one for odd positions and one for even, then taking the sum modulo 26.
What it is
The codice fiscale is the Italian tax code of a person, also used as a social security identifier. Maskflare's Italy pack covers it as a national ID, and the GDPR (EU/EEA) profile includes the pack.
In Maskflare this is the detector it_codice_fiscale, labelled "Italy - Fiscal code (codice fiscale, also social security)", category national id number, in the Italy pack.
Format and layout
- 16 letters and digits, for example RSSMRA85T10A562S.
- The pattern fixes the layout: six letters, two number characters, a month letter from A, B, C, D, E, H, L, M, P, R or T, a further two number characters, a letter, three more number characters and the check letter. In the number positions the letters L, M, N, P, Q, R, S, T, U and V may stand in for digits.
- The validator checks the 16-character length, that every character is a letter or digit, and the final letter.
How the check works
For the first 15 characters, characters in odd positions (1st, 3rd and so on) are converted with a fixed table of values, and characters in even positions count as their digit value or their letter position starting at A = 0. Add all the values, divide by 26, and the remainder maps to a letter A to Z, which must equal the sixteenth character.
Valid and invalid examples
| Example | Result | Why |
|---|---|---|
RSSMRA85T10A562S | Valid | Matches the layout and passes the validator. |
RSSMRA85T10A562A | Invalid | The invalid example changes one character, the last character: S becomes A. |
In running text the valid example reads, for instance, codice fiscale RSSMRA85T10A562S. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.
Regex and validation caveats
- The validator does not decode the birth date or municipality, so a code whose date part is impossible can still pass if the check letter matches.
- About one in 26 random 16-character alphanumeric strings passes the check letter.
- The pattern is matched without context words, so a 16-character code that happens to pass is masked.
How to detect it in LLM traffic
Italian codice fiscale values reach an LLM inside ordinary work rather than as standalone data: a pasted block of HR or payroll rows, a customer-support thread, an onboarding or identity-check form, a spreadsheet someone wants summarised, or an email they want rewritten. The model needs none of the digits for any of those jobs, so the safest place to remove them is before the request leaves the company.
Maskflare reads the whole request body, including the system prompt, earlier messages and tool arguments, so a number buried in the fourth message of a long chat is found as readily as one in the latest message. Each match is replaced with a token such as mf_mask_d7e0 before the request goes out, and with response restoration turned on the real value is put back into the answer for the person who is allowed to see it.
If you build the detection yourself
- Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
- Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter Italian codice fiscale candidates.
- Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
- Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.
How Maskflare handles it
- Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when Italy is a primary country.
- Monitor first: alert (counted, forwarded unchanged) when Italy is a primary country.
The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.
Compliance profiles that include it
One compliance profile includes the Italy pack, and applying it turns this detector on: GDPR - EU/EEA. For the GDPR (EU/EEA) profile the Italy pack is one of the country packs the administrator can choose from; the profile turns on the ones chosen. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.
Frequently asked questions
Does the detector verify the birth date inside a codice fiscale?
No. It checks length, characters and the check letter. Date and municipality parts are not decoded.
Is the codice fiscale a social security number?
Maskflare's label calls it the fiscal code, also social security. It is filed under national IDs.
Is the Italian codice fiscale detector on by default?
It depends on the organisation's primary countries. It is part of the Italy pack, which the default Protect now template turns on with the action mask when Italy is a primary country.
Does a valid Italian codice fiscale prove the person exists?
No. A check digit shows the value is well formed. Many valid-looking numbers have never been issued, and Maskflare masks them all the same.
Rules on this page describe what Maskflare's detectors and validators check. They are read from the detection catalogue and are not the specification of the body that issues the identifier. Examples are synthetic.