Identifier detector
SWIFT / BIC code: format, validation and detection
Short answer
A SWIFT/BIC code has 8 or 11 characters: 4 letters for the institution, a 2-letter country, a 2-character location and an optional 3-character branch. Maskflare requires the country to be a valid ISO 3166 code and masks it only after a keyword.
What it is
SWIFT/BIC codes identify banks. Maskflare files them under bank account numbers in the Global pack, which the HIPAA Safe Harbor, GDPR (EU/EEA), UK GDPR, US personal data and Swiss nDSG health profiles include.
In Maskflare this is the detector swift_bic, labelled "SWIFT / BIC code", category bank account number (iban), in the Global pack.
Format and layout
- 8 characters (head office) or 11 (with branch), all upper case: COBADEFFXXX.
- Characters 1 to 4 are letters; 5 and 6 are an ISO country code; 7 and 8 are letters or digits.
- A branch code starting with X is accepted only as XXX.
How the check works
There is no check digit. The validator checks length, case, that the country code is a real ISO 3166 code, and the branch rule.
Valid and invalid examples
| Example | Result | Why |
|---|---|---|
COBADEFFXXX | Valid | Matches the layout and passes the validator. |
COBADEFFXXA | Invalid | The invalid example changes one character, the last character: X becomes A. |
In running text the valid example reads, for instance, BIC: COBADEFFXXX. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.
Regex and validation caveats
- Eight capital letters are an ordinary word shape, for example in headings. The detector needs one of six keywords such as BIC, SWIFT code or bank identifier code before the code.
- A BIC identifies an institution rather than an account holder, so by itself it is a low-risk value.
Words that confirm it
The detector masks a match only when one of its keywords appears within 48 characters before the value. The catalogue lists 6: bank identification code, bank identifier code, bic, bic code, swift bic, swift code.
How to detect it in LLM traffic
SWIFT / BIC code details appear in supplier onboarding emails, remittance advice, expense exports and customer-service threads. People paste them into an assistant to draft a reply, reconcile a list or check a format, and the model does not need the real account to do any of that.
Maskflare finds bank identifiers in the full request body and replaces each with a token. In the Finance starter template the last four characters of an IBAN stay readable for support work, using the partial action; every other template masks the whole value.
If you build the detection yourself
- Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
- Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter SWIFT / BIC code candidates.
- Apply the layout rules from the section above. This identifier has no check digit to recompute, so expect more look-alikes than with a checksum-based format.
- Require one of the words listed above shortly before the value. Maskflare looks back 48 characters.
- Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.
How Maskflare handles it
- Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token).
- Monitor first: alert (counted, forwarded unchanged).
The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.
Compliance profiles that include it
5 of the 6 compliance profiles include the Global pack, and applying them turns this detector on: HIPAA Safe Harbor, GDPR - EU/EEA, UK GDPR, US personal data and Switzerland - nDSG health data. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.
Frequently asked questions
Why is the BIC detector keyword-gated?
Eight or eleven capital letters look like any acronym or title. A keyword like BIC or SWIFT before the code keeps ordinary text from being masked.
Does Maskflare accept lower-case BICs?
No. The validator requires upper case.
Is the SWIFT / BIC code detector on by default?
Yes. It belongs to the Global pack, which the default Protect now template turns on with the action mask.
Does a valid SWIFT / BIC code prove the person exists?
No. This identifier is validated on its layout alone, so a passing value is only well formed, not known to be real.
Rules on this page describe what Maskflare's detectors and validators check. They are read from the detection catalogue and are not the specification of the body that issues the identifier. Examples are synthetic.