Card expiration dates

Detects references to card expiration dates in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation. Phrase-level concept detection anchored on card-specific expiry vocabulary; it does not parse MM/YY or month-year values.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: identifier/document-structure anchored regex with constrained context replaces phrase-only detection.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth), GDPR
Frameworks: ISO 27001, ISO 27701, PCI-DSS, SOC 2
Data categories: financial
Scope: wide
Risk rating: 4
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?is)\b(?:card\s+expiration\s+date|valid\s+thru|card\s+expires|card\s+validity)\b

Corroborative evidence keywords

card expiration dates, card, expiration, dates, financial, accounts, payments, fiscal, monetary, accounting, treasury, audit, revenue, expenditure, budget, ledger, accounts payable, accounts receivable, balance sheet, profit and loss (+1 more)

Proximity: 300 characters

Should match

card expiration date — Primary topic phrase match
valid thru — Alternative topic phrase match
card expires — Additional topic phrase match
card validity — Card-specific validity phrase match
Card expiration date: Recorded Payee: Avery Teston Account number: 12345678 — Populated attribute field with a linked record field (85 tier)

Should not match

unrelated generic text without domain phrases — No relevant topic phrases present
placeholder value 12345 — Random text should not match topic-specific regex
payroll reimbursement — Generic word pair from old broad template should not match
Software licence expiry date. — Generic expiry-date wording demoted out of the primary - non-card expiries must not anchor
PCI DSS cardholder data policy — PCI and payment wording demoted out of the primary - corroborative evidence only
Card expiration date: Payee: Account name: Account number: — Empty form: the heading and field labels without values must not corroborate themselves (discovery only)
Policy guidance: this procedure explains how records about card expiration date are handled, who may access them and how long they are kept. It contains no records about any person or system. — Policy guidance naming the topic without any record (discovery only)
Card expiration date: Payee: Avery Teston — Record with the attribute label but no value: the label must not corroborate itself (discovery only)

Known false positives

Financial terminology appearing in published reports, accounting textbooks, regulatory guidance, or template documents without actual transaction data. Mitigation: Require corroborative evidence keywords within the proximity window. Cross-reference with structured financial identifiers to confirm actual sensitive data.
In Australian English, standard business terminology overlapping with financial detection keywords in routine correspondence and documentation. Mitigation: Increase confidence threshold when scanning business correspondence. Layer with transaction-specific patterns for higher precision.