Validate a US SSN

VerifNow validates a US Social Security Number against the numbers the Social Security Administration never issues, and tells you which rule a rejected number broke. It also recognises an ITIN — an IRS taxpayer number that looks like an SSN but is not one.

An SSN has no check digit. It “is still comprised of nine numeric digits”, in the SSA’s words — an area, a group and a serial number, none of them a checksum. So a typo that lands on another possible number cannot be caught, and no API can tell you from the number alone that it was issued, or to whom. Only the SSA can — see verifying a number.

Basic SSN validation


POST https://api.verifnow.io/api/v1/validate/ssn
X-API-KEY: your_api_key_here
Content-Type: application/json
 
{
  "value": "078-05-1120"
}

Example response


{
  "valid": false,
  "message": "That is a well-known sample number, not a real SSN",
  "originalValue": "078-05-1120",
  "validationLevel": "STANDARD",
  "ssnDetails": {
    "itin": false
  }
}

078-05-1120 was printed on a sample card slipped into wallets sold in 1938. It was a real person’s number; over 40,000 people adopted it, and the SSA voided it. It is used here because a voided number is the one kind of example that is safe to publish — see Testing.

A valid SSN comes back with normalizedValue in the 000-00-0000 form. Spaces and dashes are accepted; anything else is rejected.

What is checked

The SSA’s own rules, from its randomization FAQ: numbers are assigned “excluding area numbers 000, 666 and 900-999”, and “SSNs containing group number 00 or serial number 0000 will continue to be invalid”.

Input	`message`
Not 9 digits	An SSN is 9 digits, e.g. 000-00-0000
Starts with `000`, `666` or `9xx`	No SSN starts with …
Middle two digits `00`	No SSN has 00 as its middle two digits
Ends with `0000`	No SSN ends with 0000
`078-05-1120`, `219-09-9999`	That is a well-known sample number, not a real SSN
An ITIN	That is an ITIN, not an SSN
Otherwise	Valid SSN

There is no state. Before June 25, 2011 the first three digits reflected the state where the card was applied for. Since randomization, the SSA says, that structure “is no longer of any significance”, so VerifNow does not return one.

`ssnDetails.itin`

An ITIN — Individual Taxpayer Identification Number — is issued by the IRS to people who need a US taxpayer number but are not eligible for an SSN. It has the SSN’s format, starts with 9, and its fourth and fifth digits fall in 50–65, 70–88, 90–92 or 94–99 (IRS, IRM 3.21.263).

VerifNow reports it with itin: true and valid: false: it is not an SSN. Whether to accept it depends on why you asked. On a form that needs a taxpayer number — a W-9, for instance — an ITIN is an acceptable answer. On a form that needs an SSN — employment eligibility, for one — it is not: the IRS is explicit that an ITIN does not “authorize you to work legally in the U.S.”

Verifying that a number was issued

Validation rules out impossible numbers. Confirming that a number belongs to a person is a different service, and the SSA points to its own:

the Social Security Number Verification Service, for employers;
E-Verify, run by the Department of Homeland Security, for employment eligibility;
the Consent-Based SSN Verification Service, for enrolled companies, for a fee.

Testing

Use 078-05-1120 for the rejection path. Do not publish or commit a “valid” SSN, not even 123-45-6789: VerifNow accepts it, because nothing in the SSA’s rules excludes it, and with no check digit any number that passes may be a real person’s. If a test needs a possible SSN, assemble it from its three parts at run time and do not commit the result.

What VerifNow keeps

The usage log that meters your calls stores an SSN as *** — no digits at all.

Next steps

Validating a US SSN — what validation can and cannot tell you, and what to do instead
Validate SIN (NAS) — the Canadian equivalent