ICCID
Detects ICCID patterns.
- Type
- regex
- Engine
- universal
- Confidence
- high
- Confidence justification
- High confidence: validated with Luhn algorithm and supported by corroborative keyword evidence.
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
- Data categories
- device-id
- Scope
- specific
- Risk rating
- 5
- Platform compatibility
- Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible
Pattern
\b89\d{17,18}\bCorroborative evidence keywords
device, identifier, serial number, hardware, fax, facsimile, toll free, hotline, helpline, [object Object], [object Object], country code, area code, extension, ext
Proximity: 300 characters
Should match
8961234567890123459— Exact 65 probe - Luhn-valid ICCID candidate without a labelICCID: 89610000000000000000— Exact 75 probe - Luhn-valid labelled ICCID without a subscriber recordSubscriber account SIM assignment - ICCID: 8901000000000000001; activated service and phone-number association confirmed.— Exact 85 probe - Luhn-valid ICCID plus subscriber-service record
Should not match
8861234567890124000— Wrong prefix (88 instead of 89)896123456789012400— Too few digits (18 instead of minimum 19)896123456789012300000— Too many digits (21 instead of maximum 20)8961234567890123456— Adversarial 19-digit candidate with an invalid Luhn check digitPublic carrier guide - ICCID: 8961234567890123459— Public guide contains a complete labelled candidateTemplate example: subscriber account SIM assignment ICCID 89610000000000000000 with activated service.— Template contains otherwise high-tier evidence
Known false positives
- Technical identifiers appearing in public documentation, network configuration guides, or example configurations without representing actual infrastructure. Mitigation: Cross-reference with known documentation patterns and reserved address ranges. Require proximity to infrastructure-specific context.
- Placeholder and example values commonly used in technical tutorials and vendor documentation. Mitigation: Maintain exclusion lists for well-known example values (RFC 5737 documentation addresses, example MAC addresses).