Vehicle Identification Number

Detects Vehicle Identification Number patterns. Excludes I, O, Q characters

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: structural VIN format (17 chars, excludes I/O/Q) supported by corroborative keyword evidence. The position-9 check digit is documented but NOT enforced in this regex-only pattern. Added context gating and exclusion rules improve precision and reduce incidental matches.
Detection quality: Verified
Jurisdictions: global
Regulations: GDPR
Frameworks: CIS Controls, ISO 27001, NIST CSF, SOC 2
Data categories: device-id
Scope: specific
Risk rating: 5
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\b[A-HJ-NPR-Z0-9]{17}\b

Corroborative evidence keywords

device, identifier, serial number, hardware, ID number, identification, ID card, license, permit, registration, certificate, data record, database record, record set, data extract, data export, database table, spreadsheet, data registry, registry entry (+13 more)

Proximity: 300 characters

Should match

1HGBH41JXMN109186 — Low-tier probe - VIN shape without a label
VIN: WVWZZZ3CZWE123456 — Medium-tier probe - explicitly labelled VIN without a vehicle record
Vehicle registration record - VIN: 5YJSA1E26MF123456; registered owner and make and model verified. — High-tier probe - VIN label plus vehicle-record context

Should not match

1HGBH41JXMN10918 — Only 16 characters instead of 17
1HGBH41JXMN1091861 — 18 characters instead of 17
1HGBH4IJXMN109186 — Contains letter I (excluded from VIN)
template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present
Public VIN decoder: VIN 1HGBH41JXMN109186 — Public decoder contains a complete labelled VIN
Template example: vehicle registration record VIN 5YJSA1E26MF123456 with registered owner and make and model. — Template contains otherwise high-tier evidence

Known false positives

Technical identifiers appearing in public documentation, network configuration guides, or example configurations without representing actual infrastructure. Mitigation: Cross-reference with known documentation patterns and reserved address ranges. Require proximity to infrastructure-specific context.
Placeholder and example values commonly used in technical tutorials and vendor documentation. Mitigation: Maintain exclusion lists for well-known example values (RFC 5737 documentation addresses, example MAC addresses).

Collections

Network & Device Identifiers