Identifier detector
US ABA routing number: format, validation and detection
Short answer
A US ABA routing number has nine digits. The weights 3, 7, 1 repeated three times must give a sum divisible by 10, and the first two digits must fall in the ranges the validator allows.
What it is
ABA routing transit numbers identify US financial institutions on checks and transfers. Maskflare's United States pack includes the detector, and it is listed under bank account numbers. The HIPAA Safe Harbor and US personal data profiles include the pack.
In Maskflare this is the detector us_bank_routing, labelled "United States - Bank routing number (ABA)", category bank account number (iban), in the United States pack.
Format and layout
- Nine digits, for example 021000021.
- The first two digits must be 00 to 12, 21 to 32, 61 to 72 or 80.
- All nine digits cannot be the same.
How the check works
Multiply the digits by 3, 7, 1, 3, 7, 1, 3, 7, 1 and add the products. The total must be a multiple of 10.
Worked example
- Digits 0 2 1 0 0 0 0 2 1 with weights 3 7 1 3 7 1 3 7 1 give 0, 14, 1, 0, 0, 0, 0, 14, 1.
- The total is 30, a multiple of 10, so the number passes.
Valid and invalid examples
| Example | Result | Why |
|---|---|---|
021000021 | Valid | Matches the layout and passes the validator. |
021000020 | Invalid | The invalid example changes one character, the last character: 1 becomes 0. |
In running text the valid example reads, for instance, routing 021000021. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.
Regex and validation caveats
- A routing number identifies a bank, not a person, so it is low in risk on its own. It matters when it appears with an account number.
- Nine-digit numbers are common. The detector therefore asks for a keyword before the number: ABA, routing, RTN, wire, bank account or account number.
- About one in ten random nine-digit numbers passes the weighted test, which is why the keyword and the prefix range are both required.
Words that confirm it
The detector masks a match only when one of its keywords appears within 48 characters before the value. The catalogue lists 6: aba, account number, bank account, routing, rtn, wire.
How to detect it in LLM traffic
US ABA routing number details appear in supplier onboarding emails, remittance advice, expense exports and customer-service threads. People paste them into an assistant to draft a reply, reconcile a list or check a format, and the model does not need the real account to do any of that.
Maskflare finds bank identifiers in the full request body and replaces each with a token. In the Finance starter template the last four characters of an IBAN stay readable for support work, using the partial action; every other template masks the whole value.
If you build the detection yourself
- Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
- Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter US ABA routing number candidates.
- Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
- Require one of the words listed above shortly before the value. Maskflare looks back 48 characters.
- Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.
How Maskflare handles it
- Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when United States is a primary country.
- Monitor first: alert (counted, forwarded unchanged) when United States is a primary country.
The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.
Compliance profiles that include it
2 of the 6 compliance profiles include the United States pack, and applying them turns this detector on: HIPAA Safe Harbor and US personal data. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.
Frequently asked questions
Is a routing number personal data?
Not by itself. Maskflare detects it because it is a bank identifier that often travels with account numbers. Teams can set the rule to alert if they do not want it masked.
Why does the label say IBAN?
Maskflare groups routing numbers with IBANs under one category called bank account numbers, which is the category label shown in the catalogue.
Is the US ABA routing number detector on by default?
It depends on the organisation's primary countries. It is part of the United States pack, which the default Protect now template turns on with the action mask when United States is a primary country.
Does a valid US ABA routing number prove the person exists?
No. A check digit shows the value is well formed. Many valid-looking numbers have never been issued, and Maskflare masks them all the same.
Rules on this page describe what Maskflare's detectors and validators check. They are read from the detection catalogue and are not the specification of the body that issues the identifier. Examples are synthetic.