Dates of birth, driver's licenses and passports: why labels matter

A Social Security number has a recognizable shape: three digits, two digits, four digits. A driver's license number often does not. In some states it is a string of letters and digits, in others it is just a run of digits that looks like a hundred other things. A passport number is commonly nine characters. A date of birth looks exactly like any other date. If you tried to flag every nine-digit number or every date, you would flag half the spreadsheet and help nobody.

The label-gated approach

For these three kinds of data, MyVaultMate looks for the value only when it sits next to its label. Typical labels are what a person would write on a form: "DL no.", "driver's license", "passport", "DOB", "date of birth". The label tells the scanner that the number beside it is meant to be that kind of thing. Without the label, the scanner has nothing to go on.

Think of how a person would do it. If you glance at a page and see DOB: 04/12/1980, you know exactly what you are looking at. If you see a bare 04/12/1980 in a column of unlabeled dates, it could be an invoice date, a lease start, a birthday, or a due date. The label is the context.

Why a bare number is not flagged

Consider a bare nine-digit number in a spreadsheet cell. It might be a passport number. It might also be an order ID, a routing-style code, a phone number with the area code, a part number or the first piece of a longer identifier. The same goes for a bare eight-digit number and a driver's license. The shape is simply too common.

Flagging these would produce an enormous number of false alarms. People who see too many false alarms stop trusting the report, and then they miss the real ones. Requiring a label is a deliberate trade: fewer false alarms in exchange for a narrower catch.

What that means for recall, honestly

This is the part to understand clearly: a value with no nearby label can be missed. Some examples of how that happens:

• A spreadsheet where the column header says "ID" or "Number" rather than "DL no." or "Passport".
• A table where the label is several rows above the value, or sits in a different cell far from it.
• A scanned copy of a license saved as a picture or as a scanned PDF. The program does not read pictures or scanned pages: each is listed as “Not scanned” with a risk score of 70, so it stays on your list to check by hand.
• A filename like jones-passport.pdf where the document itself contains no text label near the number.
• Shorthand an office invented ("lic#", a coded column name) that the scanner does not recognize as a label.

So treat the absence of a date-of-birth, license or passport finding as "none found with a label", not "none exist". SSNs and ITINs written with dashes, and card numbers, are found without a label (a nine-digit number without dashes needs an “SSN” label next to it), which is one reason a report will usually turn up more of those. Detection is rule-based, and rules have edges.

Why these values still matter

On their own, a date of birth or a license number can look harmless. Together with a name they are the raw material for identity fraud, and several state breach-notification laws treat a name plus a driver's license number as personal information. In Nevada, NRS Chapter 603A describes personal information generally as a name plus an SSN, driver's license, account or card number with access code, a medical or health insurance ID number, or a username or email address with the password to an online account. Every state has its own law, so check the current text for the states where your clients live. This is general education, not legal advice; an attorney can tell you what applies to your office.

Making your own files easier to review

1. Use plain labels when you build templates. "Date of birth" and "Driver's license no." in an intake form are clearer to people and to scanners than a code like "DL1".
2. Keep the label next to the value. A header cell directly above or a label directly before the value is easier to read than one three rows away.
3. Do not lean on the scan alone. If you know a folder holds ID copies (an onboarding folder, a client-ID archive), review it by hand even if the report is quiet about it.
4. Check the redacted sample. A finding shows a short redacted sample so you can confirm what it is without a new copy of the value.

Fewer, more trustworthy findings are easier to act on, and knowing the blind spots lets you cover them with a quick human check. The full list of what is detected is on how it works.