# What Is an ORI Number? Agency Identifiers | Kodex Source: https://www.kodexglobal.com/glossary/ori-number > An ORI number identifies a US criminal justice agency in FBI systems. Learn what it proves, what it does not, and its role in verification. Verification & Fraud ## ORI Number An ORI number is a nine-character Originating Agency Identifier assigned by the FBI to US criminal justice agencies authorised to access national systems. It identifies which agency an action came from, and it is a useful corroborating signal in verification, though it is not a credential. Also known as Originating Agency Identifier, ORI The ORI number is frequently over-trusted in verification workflows. It is genuinely useful and it is not a password, and the gap between those two things is where mistakes happen. ### What an ORI is The FBI’s Criminal Justice Information Services division assigns each authorised agency a nine-character Originating Agency Identifier. It exists so that actions in national systems (record queries, submissions, transactions) can be attributed to a specific agency. The structure carries meaning. The leading characters identify the state, the middle portion the county or jurisdiction, and the final character conventionally denotes the agency type. That internal structure is what makes ORIs partially self-checking: an identifier whose state code contradicts the agency’s claimed location is inconsistent on its face. ### What it proves, and what it does not What an ORI establishesWhat it does not establish The critical limitation: ORIs are not confidential. They appear in court filings, public records, and agency documentation. An attacker researching a target agency can find its ORI without difficulty and cite it accurately. ### How to use it properly An ORI is a consistency check, not an authentication factor. Useful applications: - Confirm the ORI’s encoded state matches the agency’s claimed location. - Confirm the agency type suffix matches the kind of agency the request purports to come from. - Compare against prior legitimate requests from the same agency. - Treat a malformed, inconsistent, or unassigned ORI as a strong negative signal. What it cannot do is stand in for verifying the individual. A request citing a correct ORI from a compromised agency mailbox is entirely consistent. Every element checks out, because every element is real except the person’s authority to send it. FAQ ### Frequently asked questions Does a valid ORI number prove a request is legitimate? No. An ORI identifies an agency, not a person, and ORIs are not secret. They appear in public documents and directories. A fraudulent request can cite a real agency’s real ORI. It is corroborating context, useful alongside verification of the individual, and not a substitute for it. What does an ORI number actually encode? The format encodes the state, county or jurisdiction, and agency type. The first two characters are the state code, and the trailing character conventionally indicates the type of agency. That structure makes an internally inconsistent ORI a detectable red flag. Do all agencies contacting a company have an ORI? No. ORIs are assigned to US criminal justice agencies with access to national systems. Foreign agencies, many regulatory bodies, and civil litigants have none, so the absence of an ORI is not itself suspicious. It depends entirely on who is supposed to be contacting you. Glossary ### Related terms #### Requester Verification Requester verification is the process of establishing that the person behind a data request is genuinely who they claim to be and holds authority to make it. It differs from validating the document, because a genuine-looking request sent from a real but compromised account will pass document checks. #### Law Enforcement Impersonation Law enforcement impersonation is a social engineering attack in which someone poses as a police officer or government official to obtain data, access, or compliance they have no authority to demand. Against companies it usually targets the data request process, where the appearance of authority substitutes for verified authority. See how Kodex corroborates agency identity as part of requester verification. Learn more