How the number is built and checked
A BSN is nine digits and carries no information about the person: no birth date, no sex, no place. [1]
It must pass a variant of the 11-proef: 9×1st + 8×2nd + 7×3rd + 6×4th + 5×5th + 4×6th + 3×7th + 2×8th − 1×9th must be divisible by 11. For 111222333: 9+8+7+12+10+8+9+6−3 = 66 = 6 × 11. [2]
About 1 in 11 random nine-digit numbers pass, so an order or invoice number can look exactly like a BSN — 123456782 passes. nullcipher therefore masks a nine-digit number (also written 1234.56.782) only when BSN, burgerservicenummer, sofinummer or citizen service number stands within 40 characters before it.
How nullcipher recognises it
Nine digits (also written 1234.56.782 or 123 456 782) passing the BSN 11-proef: 9×1st + 8×2nd + … + 2×8th − 1×9th is divisible by 11; all zeros is not a BSN. About 1 in 11 random nine-digit numbers pass, so it is only masked with a context word — BSN, burgerservicenummer, sofinummer, citizen service number — within 40 characters before it.
This is the rule text of the “Dutch BSN (burgerservicenummer)” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.
Example (fake)
BSN: 111222333nullcipher replaces it with [BSN_1]. Constructed for illustration: an easy-to-read number that passes the 11-proef (the sum is 66). RvIG does not publish a specimen BSN.
Why it matters in an AI chat
Dutch organisations may only use the BSN when the law gives them a task that allows or requires it, because it lets records about one person be linked across datasets with high certainty. That is also what makes a list of them valuable to someone else.
RvIG says you cannot get a new BSN. It also says the number alone is not enough to commit identity fraud, as it contains no personal information — the risk is the combination with a name, a birth date or a copy of an ID document, which is exactly what an HR file or a customer ticket holds.
Masked, the AI still sees that [BSN_1] is one person throughout the text.
If it already leaked
- If you suspect a crime, report it to the police (aangifte doen). Without a report there is no investigation, and damages cannot be recovered from the perpetrator or an insurer. [4]
- Collect as much evidence as you can, such as bank statements and letters from debt collectors. Do not pay a debt collector for costs that have nothing to do with you; tell them so. [4]
- Report the identity fraud to the Centraal Meldpunt Identiteitsfraude (CMI) with its form on rvig.nl; the CMI helps victims deal with the consequences, and Slachtofferhulp Nederland offers support. [4]
- The number stays: RvIG does not issue a new BSN. [1]
- If it only went into an AI chat and there is no sign of misuse, delete the conversation — how, for each major assistant, is on the page listing every type. The number itself stays the same, so the steps above are about noticing and blocking misuse, not about replacing it.
Sources
- Veelgestelde vragen Burgerservicenummer (BSN) — Rijksdienst voor Identiteitsgegevens (RvIG) — checked 2026-09-23.
- Logisch ontwerp BRPk, “Burgerservicenummer” and its 11-proef footnote — RvIG — checked 2026-09-23.
- Verwerken van het burgerservicenummer — developer.overheid.nl — checked 2026-09-23.
- Ik ben slachtoffer van identiteitsfraude. Wat kan ik doen? — Rijksoverheid — checked 2026-09-23.
Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 30 secret types and how to delete a chat you already sent.