US ITIN: format, validation and detection

What it is

The ITIN is issued for tax filing to people who cannot get an SSN. Maskflare places it in the United States pack as a tax ID, and the HIPAA Safe Harbor and US personal data profiles include the pack.

In Maskflare this is the detector us_itin, labelled "United States - Individual taxpayer ID (ITIN)", category tax id, in the United States pack.

Format and layout

• Nine digits, printed 9XX-XX-XXXX.
• The first digit is 9.
• The fourth and fifth digits (the group) must be 50 to 65, 70 to 88, 90 to 92 or 94 to 99.

How the check works

There is no checksum. The validator tests only the leading 9 and the group ranges. In the invalid example on this page the group is changed to 00, which no ITIN has.

Valid and invalid examples

In running text the valid example reads, for instance, ITIN 912-70-1234. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.

Regex and validation caveats

• Because the SSN detector rejects any number starting with 9, the two do not overlap.
• A nine-digit run with no separators is masked unless a word like order, invoice or phone sits closer to it than one of the detector's keywords (ITIN, tax id, taxpayer id).

Words that confirm it

The formatted shape is masked without a keyword. For a run with no separators, these words count as the detector's own keywords when a word like order, invoice or phone is also close: itin, tax id, taxpayer id, taxpayer identification, tin. The nearer word wins.

How to detect it in LLM traffic

US ITIN values reach an LLM inside ordinary work rather than as standalone data: a pasted block of HR or payroll rows, a customer-support thread, an onboarding or identity-check form, a spreadsheet someone wants summarised, or an email they want rewritten. The model needs none of the digits for any of those jobs, so the safest place to remove them is before the request leaves the company.

Maskflare reads the whole request body, including the system prompt, earlier messages and tool arguments, so a number buried in the fourth message of a long chat is found as readily as one in the latest message. Each match is replaced with a token such as mf_mask_d7e0 before the request goes out, and with response restoration turned on the real value is put back into the answer for the person who is allowed to see it.

If you build the detection yourself

1. Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
2. Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter US ITIN candidates.
3. Apply the layout rules from the section above. This identifier has no check digit to recompute, so expect more look-alikes than with a checksum-based format.
4. Treat a run with no separators more carefully than a formatted one: reject it when a word such as order, invoice, phone or reference is nearer to it than one of the identifier's own keywords.
5. Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.

How Maskflare handles it

• Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when United States is a primary country.
• Monitor first: alert (counted, forwarded unchanged) when United States is a primary country.

The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.

Compliance profiles that include it

2 of the 6 compliance profiles include the United States pack, and applying them turns this detector on: HIPAA Safe Harbor and US personal data. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.