FOPE policy rules - using regular expressions to match a credit card number

  • Article

A question came through one of our internal distribution lists this week. A consultant was trying to create a policy rule in Forefront Online Protection for Exchange (FOPE) that would trigger on a message containing a credit card number. FOPE supports basic regex, so some possible variations are the following:

  • \d\d\d\d\-\d\d\d\d\-\d\d\d\d\-\d\d\d\d - Four-digit numbers delimited by hyphens, such as 1234-5678-9012-3456 
  • \d\d\d\d\s\d\d\d\d\s\d\d\d\d\s\d\d\d\d - Four-digit numbers delimited by spaces, such as 1234 5678 9012 3456

Tip: These regular expressions can match any numbers in the format specified (not just credit card numbers), so be aware that false-positive matches can occur. Be sure to test your policy rules by using the Test policy rule action. For more information, see What is a test rule? under Policy Rules FAQ.

The Policy Rules help topic on TechNet is a good place to start if you are creating policy rules in FOPE, and Understanding Policy Rule Syntax specifically discusses regular expression syntax you can use to create policy rules in the FOPE administration center.

Tony

(Thanks to Stan A. for his expertise.)