US Individual Taxpayer Identification Number (ITIN)

Detects US Individual Taxpayer Identification Numbers (ITINs) issued by the IRS to individuals who are required to have a US taxpayer identification number but are not eligible for a Social Security Number. ITINs always begin with the digit 9, and the fourth and fifth digits fall in the range 70-99, distinguishing them from SSNs. The pattern matches both formatted (9XX-7X-XXXX) and unformatted (9XX7XXXXX) variants.

Type: regex
Engine: boost_regex
Confidence: high
Confidence justification: The ITIN format is well-defined by the IRS with a unique structure starting with 9 and having fourth-fifth digits in the 70-99 range. This specificity, combined with corroborative keyword proximity, provides high-confidence identification with low false positive rates.
Detection quality: Mixed
Jurisdictions: us
Regulations: CCPA/CPRA, FTC Act s5, GLBA, HIPAA, SOX, State Breach Laws (US)
Frameworks: ISO 27001, ISO 27701, PCI-DSS, SOC 2
Data categories: pii, financial, government-id
Scope: narrow
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\b9\d{2}[-\s]?[7-9]\d[-\s]?\d{4}\b

Corroborative evidence keywords

ITIN, individual taxpayer, taxpayer identification, tax ID, ID number, identification, ID card, license, permit, registration, certificate, transaction, transfer, payment, deposit, withdrawal, debit, credit

Proximity: 300 characters

Should match

912-78-1234 — Standard hyphen-delimited ITIN with valid 9xx prefix and 7x group
912 78 1234 — Space-delimited ITIN format
912781234 — Unformatted nine-digit ITIN

Should not match

912-12-1234 — Fourth-fifth digits 12 fall outside the valid ITIN group range of 70-99
812-78-1234 — First digit is not 9; this is not an ITIN
912-68-1234 — Fourth-fifth digits 68 fall outside the valid ITIN group range of 70-99

Known false positives

SSN range overlap for 9xx area numbers that coincidentally have group digits in the 70-99 range Mitigation: Use corroborative keyword proximity (e.g., 'ITIN', 'taxpayer identification') to distinguish ITINs from SSNs, and cross-reference against SSN detection patterns