Centrelink Customer Reference Number

Detects candidate Centrelink Customer Reference Numbers consisting of 9 digits followed by a letter. The bare shape is not unique and requires a CRN/Centrelink label for enforcement.

Type: regex
Engine: universal
Confidence: low
Confidence justification: Low confidence: the 9-digit-plus-letter pattern is generic and may match unrelated alphanumeric sequences. Corroborative evidence keywords such as Centrelink, CRN, or Services Australia are essential for reliable detection.
Jurisdictions: au
Regulations: AML/CTF Act (Cth), IPA 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
Frameworks: ISO 27001
Data categories: pii, government-id
Scope: wide
Risk rating: 4
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\b\d{9}[A-Za-z]\b

Corroborative evidence keywords

Centrelink, CRN, Customer Reference Number, [object Object], customer reference number, [object Object], Department of Veterans Affairs, pensioner concession, seniors card, healthcare card, DVA card, concession card, DVA gold card, DVA white card, Commonwealth Seniors Health Card, Services Australia

Proximity: 300 characters

Should match

123456789A — Low-tier probe - bare candidate shape
CRN: 987654321Z — Medium-tier probe - explicitly labelled CRN
Centrelink payment record - Customer Reference Number 111222333B — High-tier probe - labelled CRN with welfare-payment context

Should not match

12345678A — Only 8 digits instead of 9 before letter
1234567890A — 10 digits instead of 9 before letter
123456789 — Missing trailing letter
Training example: Centrelink payment CRN 123456789A — Structurally complete but explicitly framed training content

Known false positives

Common words and phrases related to centrelink customer reference number appearing in policy documents, training materials, HR templates, or compliance guidelines without actual personal data. Mitigation: Require corroborative evidence keywords within the proximity window to confirm sensitive data context rather than general discussion.
In Australian English, similar terminology used in formal or administrative contexts (education, professional documentation) that does not constitute sensitive data collection. Mitigation: Layer with additional contextual signals such as structured identifiers, form fields, or database column headers to distinguish sensitive records from general references.
High-frequency pattern matches in large document corpora due to broad regex anchors. Expected match rate is significantly higher than specific identifier patterns. Mitigation: Tune confidence thresholds for bulk scanning. Consider using this pattern primarily as a pre-filter with secondary validation.