RFC

Detects Mexican RFC (Registro Federal de Contribuyentes) taxpayer identifiers in both official formats: the 13-character natural-person form (4-letter name stem + 6-digit date + 3-character homoclave) and the 12-character legal-entity form (3-character name stem, which may include Ñ or &, + 6-digit date + 3-character homoclave).

Type

regex

Engine

universal

Confidence

low

Confidence justification

Low confidence: generic pattern format that may match unrelated data. Corroborative evidence keywords are essential for reliable detection. Added context gating and exclusion rules improve precision and reduce incidental matches.

Detection quality

Verified

Jurisdictions

mx

Regulations

LFPDPPP (MX)

Frameworks

ISO 27001, ISO 27701

Data categories

pii, government-id

Scope

wide

Risk rating

5

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\b(?:[A-Z]{4}|[A-Z&Ñ]{3})\d{6}[A-Z0-9]{3}\b

Corroborative evidence keywords

identifier, number, ID, ID number, identification, ID card, license, permit, registration, certificate, transaction, transfer, payment, deposit, withdrawal, debit, credit, data record, database record, record set (+20 more)

Proximity: 300 characters

Should match

• GARS920101ABC — Individual RFC (4 letters)
• AAAA000101XY1 — Alternate individual RFC
• ABCD123456Z01 — Standard individual RFC format
• ABC9201011A2 — Legal-entity RFC (3-character name stem + 6-digit date + 3-character homoclave)

Should not match

• GA920101ABC — Only 2 initial letters, below both the 3-character legal-entity and 4-letter natural-person stems
• GARS92010ABC — Only 5 date digits instead of 6
• GARS920101AB — Only 2 homoclave characters instead of 3
• ABC9201011A — Legal-entity shape with only 2 homoclave characters instead of 3
• template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present

Known false positives

• Common words and phrases related to rfc appearing in policy documents, training materials, HR templates, or compliance guidelines without actual personal data. Mitigation: Require corroborative evidence keywords within the proximity window to confirm sensitive data context rather than general discussion.
• In Spanish (Mexico), similar terminology used in formal or administrative contexts (education, professional documentation) that does not constitute sensitive data collection. Mitigation: Layer with additional contextual signals such as structured identifiers, form fields, or database column headers to distinguish sensitive records from general references.
• High-frequency pattern matches in large document corpora due to broad regex anchors. Expected match rate is significantly higher than specific identifier patterns. Mitigation: Tune confidence thresholds for bulk scanning. Consider using this pattern primarily as a pre-filter with secondary validation.

Collections

• Americas Government IDs