The last character of a Singapore NRIC or FIN is a check letter, worked out from the prefix and seven digits so that a keying slip shows up. ICA said in 2003 it exists so the numerals "are not entered into a computer system in the wrong order". We tried every pair of positions. Swapping two different digits changes the letter in 20 of the 21 pairs, including all six pairs of neighbours. The exception is the pair furthest apart: swap the first and last digits and the letter stays as it was. Nor does a matching letter show that a number was ever issued.
The end digits leave no trace of a swap
ICA's sentence comes from its UIN/FIN page as archived on 6 April 2003. We ran the rule in common use over each pattern of error: positions, old digits, new digits. The first five rows are exhaustive; the last is a sample.
| Slip | Tested | Letter changes in |
|---|---|---|
| One digit wrong | 630 patterns | 630 |
| Two different digits swapped | 1,890 patterns | 1,800 |
| Doubled digit becomes another doubled digit | 1,890 patterns | 1,710 |
| Two digits wrong | 170,100 patterns | 153,090 |
| All seven moved along one place | 9,999,990 strings | 90.9% |
| All seven randomly reordered | 2 million sampled | about 91% |
All 90 swaps that escape sit at positions 1 and 7, so 1xxxxx7 and 7xxxxx1 always take the same letter. We did not find this gap stated elsewhere, in a limited search. These are shares of possible patterns, never real-world catch rates: we found no data on the mistakes people make.
Most double errors betray themselves in the letter
With two digits wrong, 17,010 of the 170,100 patterns leave the letter unchanged: exactly 1 in 10. Change an identical pair of digits into a different identical pair and 19 of the 21 position pairs always give it away. Two never do: positions 3 and 4, and positions 2 and 5, at 90 patterns each.
ICA's phrase was "the wrong order", which covers more than one swap. Beyond a single swap the protection is weaker. Moving all seven digits along one place escaped in 9.1% of the strings it alters, and a random reorder in about 9% of 2 million sampled. A mistyped prefix never survived, across all 20 mix-ups of S, T, F, G and M.
Outside tests corroborate a rule ICA offered under licence
We found no public ICA text of the rule. ICA's 2003 pages said the algorithms could be obtained through a request form, "open ONLY to Singapore-based organisations with the legitimate need for the UIN/FIN validation", under a licence described as "limited, non-exclusive, non-transferable". ICA's FAQ, as captured on 10 December 2003, said the check digit "can be used to validate the UIN/FIN during data entry". We quote that FAQ without a link because it prints complete numbers.
The public version traces largely to Ngiam Shih Tung's slides of 22 December 2003, also unlinked, because they print the rule. S was already "well-known". F came from 48 FINs out of 1,287 on a Ministry of Manpower list. T and G came from testing guesses against a National Library web form.
FormSG's code documents an M rule at least 80 days before the series opened
ICA announced the M series on 12 July 2021 because FINs "cannot be re-assigned", so each series depletes. Its illustration, M1234567B, fails the rule in common use: a placeholder, which says nothing either way about ICA's rule.
FormSG, the Open Government Products form builder, merged an M implementation into its public repository on 13 October 2021, 80 days ahead of a series "to be launched from 1 Jan 2022". So that statement of M cannot have come from M numbers then in circulation. It names no source, and we found no ICA specification. For the other four prefixes the code cites Ngiam's slides, so its full agreement with our kernel over 50,000,000 comparisons is a copy matching its original. Public code also differs on M: one open-source package from October 2026 uses a different letter at one position, which by our arithmetic changes the answer for about 9% of M numbers.
A pass proves the arithmetic and nothing about a person
Of the 1.3 billion strings shaped like a number, 50 million pass, so an invented number with a random last letter passes 1 in 26 times. A pass says the letter fits the digits, and never that ICA issued the number.
Our Singapore NRIC and FIN validator is a format check of that kind. In the version corrected on 2 November 2026, S1234567A, PDPC's placeholder, returns INVALID, and 567A is refused as masked. Before that correction the page said ICA had "never published" the rule, more than we could show, answered a flat "Yes" on masking, and omitted the blind spots above.
Partial numbers rule out too few people to settle identity
PDPC's 2018 guidelines say at §5.2 that organisations collecting up to "the last 3 numerical digits and checksum", when "other alternatives are not satisfactory", are not treated as collecting the full number. §5.3 adds that partial numbers are personal data "to the extent that an individual can be identified" from them, alone or with other information. The PDF now opens with a notice that the guidelines "will be updated" and "remain valid" meanwhile.
MDDI said on 13 December 2024 that "there is no need to mask the NRIC number, nor is there much value in doing so", since "one can make a good guess at the full NRIC number from the masked number". The Minister told Parliament on 8 January 2025 that such numbers give "a false sense of security", and that private organisations collecting partial numbers to identify people "can continue to do so" while the guidelines stood unchanged. On 3 February 2026 MDDI added that partial numbers "are not reliable for identifying individuals accurately". Our count illustrates that second reason only: any one ending of three digits and a letter on an S number is shared by more than 900 of 10 million digit strings.
PDPC sets end-2026 as the limit for NRIC authentication
PDPC's release of 2 February 2026 gives private organisations until 31 December 2026 to phase out NRIC numbers for authentication. From 1 January 2027 it will step up enforcement against those using "full or partial" numbers that way. Organisations using them "for authentication to access personal data" "may be found to have breached" the PDPA "for failing to make reasonable security arrangements". The PDPC and CSA joint advisory gives the reason: "a person may not be who he claims to be just because he is able to state that person's NRIC number". The guidelines extend to FINs at §1.4 and exclude public agencies at §1.7. This reports those statements and gives no legal advice.
As of 2 November 2026 the deadline stands, and we found no revised guidelines or consultation paper on partial numbers, and the only NRIC consultation on PDPC's sitemap and consultations page is the 2017 one. MDDI says the Government "will continue to hold consultations and review public feedback" before adjusting private-sector guidance, and that moving away from partial numbers "does not mean that full NRIC numbers will automatically be used in all cases".
View author profile → · Editorial policy
