How to Check a (Canadian) SIN is a genuine SIN?

Question

A Canadian SIN is equivalent to American SSN.

I am not asking for the algorithm to check if any given 9-digit number passes the validation of the Luhn validation.

The problem I have is some users are smart enough to generate a fake SIN that can pass the above validation, but the SIN would not exist in the government database.

Therefore, what I am asking is how I can check the given SIN number is genuine and actually issued by the Canadian Government. Is there any database/services you can get or is there any special algorithm you use to verify this?

Thank you very much in advance.

Answer 1

That seems like data that's extremely unlikely to be made public. You will probably need to be a government agency to see a list of SINs.

Also, as Paul noted above, any algorithm which verifies whether a SIN is a possible candidate can also be used to manufacture SINs that aren't legitimate through brute force.

Answer 2

As an added note to John and Paul's answers. If there is an algorithm to generate SIN's and a database of assigned SIN's you could combine the two to search through and find a real SIN in fairly short order allowing you to gather a list of all active SIN's. In a pseudo code manner you could use ...

foreach(SIN in SINGenerator)
{
    if(govtdatabase.verify(SIN) == true)
    { store into file as valid SIN }
}

Answer 3

I don't know about Canada, but here in the Netherlands such webservices are only available to government related organisations, insurance companies, healthcare providers, etc.

I'm actually working with such a service at the moment. It's not just number validation. It allows retrieval of name, address, date of birth and so on based on the number.

It's unlikely something like that will be public. See also this privacy FAQ. Read it. It also contains information on valid uses for SINs.

Answer 4

Having worked with SINs before I do know that there's some correlation to the beginning 3 numbers of the SIN and the person's age. As well, there are some validation rules much like credit card numbers (which you've noted.)

With that said Why are you using SIN numbers? It is an extremely vital piece of information - If you have someone's SIN number you effectively are them - and should under no circumstances be used by anyone except for government related purposes!

Secondly if you have a legitimate usage of SIN numbers, are you familiar with PIPEDA? If not you should be!