Identity-document numbers vary by format and length

What it is

Identity document number validation requires the issuing country or territory, document type, and document version as context. Passports, national identity cards, residence permits, and other credentials can use different characters, lengths, check digits, and layouts; legacy and current versions may coexist within one jurisdiction. Passing a format check means only that a string is compatible with a known grammar. It does not prove authoritative issuance, current validity, non-revocation, or that the submitter is the holder.

Why it happens

A document number is an identifier inside a particular issuing regime, not one globally shared data type. Its structure can reflect historical series, credential classes, issuing-system migrations, and transition periods. Fixed-length numeric storage may strip leading zeroes, exclude letters, or truncate valid values. A regex derived from one country and one “current” format can reject legacy documents that remain valid. Conversely, treating a valid check digit as proof of authenticity confuses typo detection with an authority lookup. Robust systems separate syntax screening from issuance status, expiry, and holder verification.

Studying it

Build coverage around issuing jurisdiction, document type, version, and validity window. For every rule, record the authoritative source, publication date, retrieval date, and whether it has been superseded. Test with de-identified valid specimens or official examples, still-valid legacy forms, boundary lengths, leading zeroes, case, familiar separators, and fabricated values that are syntactically plausible. Report parseability, false rejection of legitimate formats, review rates, and authoritative verification outcomes separately. Do not collect real document numbers beyond the study purpose, and redact logs and screenshots.

Where it stops holding

There is no safe, immutable “global identity-number regex table.” Credential regimes and verification interfaces change and are constrained by authorization, privacy, data residency, availability, and cost. Mark a rule unknown when no authoritative source is available instead of inventing coverage. Machine-readable zones, check digits, OCR, and visual appearance each offer only partial consistency evidence. Whether a high-risk workflow requires an online authority check, who may perform it, and which evidence may be retained depends on current applicable requirements and authorization, not on the format result.

Applying it

• Ask people to select or confirm the issuing country or territory and document type. Request a version only where versions materially differ and the person can identify it; do not infer it invisibly from number shape.
• Store the number as a Unicode string. Keep accepted characters, length ranges, display grouping, checksum method, applicable versions, authoritative provenance, and update date in refreshable metadata, retaining the rule version for audit.
• Model distinct states such as unparsed, format-compatible, manual review required, and authority verification succeeded or failed. Never label a regex or checksum pass as “genuine document.”
• Provide a safe pending-verification path for unknown versions, offline operation, verifier outage, and mismatches. Collect and reveal only fields needed for the task in UI, logs, and analytics. Regress still-valid legacy and current specimens on every metadata update.

Related

• Same group: S2.09.1 Regular-expression validation usually embeds a single-region assumption · S2.09.3 Validation errors must explain the expected format · S2.09.4 Be permissive at input and strict at output
• Adjacent: O1.02 Data minimization · O1.03 Purpose limitation
• Search terms: identity document validation · issuing country metadata · document verification