The ORI number is frequently over-trusted in verification workflows. It is genuinely useful and it is not a password, and the gap between those two things is where mistakes happen.
What an ORI is
The FBI’s Criminal Justice Information Services division assigns each authorised agency a nine-character Originating Agency Identifier. It exists so that actions in national systems (record queries, submissions, transactions) can be attributed to a specific agency.
The structure carries meaning. The leading characters identify the state, the middle portion the county or jurisdiction, and the final character conventionally denotes the agency type. That internal structure is what makes ORIs partially self-checking: an identifier whose state code contradicts the agency’s claimed location is inconsistent on its face.
What it proves, and what it does not
| What an ORI establishes | What it does not establish |
|---|
The critical limitation: ORIs are not confidential. They appear in court filings, public records, and agency documentation. An attacker researching a target agency can find its ORI without difficulty and cite it accurately.
How to use it properly
An ORI is a consistency check, not an authentication factor. Useful applications:
- Confirm the ORI’s encoded state matches the agency’s claimed location.
- Confirm the agency type suffix matches the kind of agency the request purports to come from.
- Compare against prior legitimate requests from the same agency.
- Treat a malformed, inconsistent, or unassigned ORI as a strong negative signal.
What it cannot do is stand in for verifying the individual. A request citing a correct ORI from a compromised agency mailbox is entirely consistent. Every element checks out, because every element is real except the person’s authority to send it.