ACCOUNT_NUMBER detects 6–17 contiguous ASCII digits immediately after
account number, account no., acct number or acct no. (ASCII case
insensitive). The value span excludes the label. Supported spacing, delimiters,
boundaries and exclusions are defined in the rule contract.
This is lexical coverage, not bank validation or universal account detection.
account: labels,
intervening prose, split numeric values and alphanumeric accounts are excluded.
The masked-account contract also
accepts account-labelled four-digit endings and bounded X/asterisk masks. For
account ending in 1234, only 1234 is the value. For
account number: XXXX1234, the whole XXXX1234 token is the value. A visible
suffix is not a full account identity; workspace matching and recall use the
existing normalized literal value and cannot recover hidden digits. Structured
scanning uses the same text rule within each decoded string; field keys do not
supply the label.
Rust, Python, Node and browser WASM share Core semantics. Findings have no
confidence score and use datafog-core/account-number provenance, original byte
and codepoint ranges, and JavaScript UTF-16 ranges. Normal entity selection,
allowlists and transformation strategies apply. Other detectors may overlap;
select ACCOUNT_NUMBER when a transformation should use only that type.
This partial rule preserves a configured model’s broader ACCOUNT_NUMBER
coverage. A model session selected for this type still runs its model, combines
rule/model findings and retains evidence from both for equal-span duplicates.
Models can therefore still find unlabelled values that this rule cannot.