A bank statement is the most revealing document most people are routinely asked to hand over. Not because of the balance — because of the list underneath it.
Ninety days of transactions is a description of your life: where you shop, where you travel, when you are away from home, who you send money to, what you are treating, what you believe, and what you are worried about. Someone asked whether you can afford the rent.
First, and most importantly: who is asking?
This is the question that determines everything, and getting it wrong in the other direction carries real consequences.
| Requester | What they legitimately need | Can you redact? |
|---|---|---|
| Landlord or letting agent | Name on the account, regular income arriving, closing balance | Yes — transaction detail is not their business |
| Visa or immigration application | Balance held, and often that it has been held for a set period | Usually yes, but follow the published rules exactly |
| Employment tribunal or small claims | Only the transactions in dispute | Yes — and you should, to protect unrelated third parties |
| Benefit or grant application | Income and, sometimes, specific outgoings | Partly — check what the scheme requires |
| Mortgage lender or regulated credit | Your actual spending, in full | Normally no |
That last row matters. A regulated lender assesses affordability from real spending patterns; that is what the assessment is. A redacted statement is usually rejected outright, and depending on what was removed and why, withholding material information from a credit application can be treated as concealment rather than privacy. If you are uncomfortable with a lender seeing something, the answer is a conversation with a broker, not a black box.
Redaction is for the landlord, the letting agent, the tribunal bundle and the visa file. It is not a tool for managing a credit assessment.
What the transaction list actually discloses
For the cases where redaction is appropriate, this is what you are protecting.
Merchant names are not neutral strings. Each one supports an inference:
- A pharmacy, clinic, or hospital — health, and sometimes a specific condition
- A place of worship, or a religious charity — religious belief
- A political party or campaign — political opinion
- A fertility clinic, a family lawyer, a counselling service — circumstances you have told nobody
- A gambling operator, an off-licence, an addiction service — inferences that are frequently used against people
- Subscriptions and venues — relationships and sexuality
Under Article 9 of the GDPR, health data, religious beliefs, political opinions, trade union membership, and data concerning sex life are special category personal data, subject to a materially higher standard of protection than an ordinary name and address. A letting agent has asked for none of it.
Three further leaks people miss:
Other people’s names. Every transfer in or out carries a counterparty. Your friend who lent you money, your ex, your childminder — none of them consented to appear in your rental application.
Location and absence. Card transactions trace where you were and when. A statement showing two weeks of foreign spending tells a reader exactly when your home was empty.
The account and routing or sort code, printed at the top of every page and used directly in fraud.
The better move: ask for a different document
Before you redact anything, check whether the bank will simply give you the right document.
Most banks issue proof-of-balance letters, certificates of income, or statements filtered to a date range on request, often instantly in the app. Some produce a dedicated landlord reference or proof of funds letter. These contain what a requester needs and nothing else, they arrive on bank letterhead, and they are accepted more readily than a page covered in black rectangles.
An unredacted document that only ever contained the right information beats a redacted one every time.
If you do redact: what to remove
Account number and sort or routing code, on every page. These repeat in headers and footers and are the most commonly missed item.
The transaction detail, keeping the salary credits that prove income. The usual approach is to leave the incoming lines that demonstrate regular pay and remove the outgoing detail.
Counterparty names on any transfer you keep.
Your address, if the requester already has it or does not need it.
The full card number, if printed anywhere.
Running balances beside removed rows, if the arithmetic would let someone reconstruct the amounts you took out. This is the subtle one — leaving a running balance column while removing the transactions beside it means the deltas reveal every hidden amount.
Leave the bank name, statement period, page numbers, and your name, or the document stops looking like a statement and gets rejected.
The mistakes that undo it
A black box in a PDF viewer is not a deletion. Most viewers add the rectangle as a shape on top, and the text stays in the file where it can be selected and copied. This is the failure covered in redaction vs whiteout, and on a bank statement the recovered text is your account number.
Cropping hides a region without removing what is outside it.
A phone highlighter is deliberately semi-transparent to imitate ink. Pushing brightness and contrast in any basic photo editor reveals what is beneath. If you are working from a screenshot, use a solid shape at full opacity — or better, redact the PDF itself.
Leaving the metadata. Bank statement PDFs frequently carry an account reference or customer number in the document properties, which no amount of redaction on the page will touch.
The width of the black box
A redaction box that is exactly as wide as the text it replaced is a measurement of that text.
At the Privacy Enhancing Technologies Symposium in 2023, researchers demonstrated recovering redacted names from real published documents — government investigation reports and freedom-of-information responses — by matching candidate strings against the character positioning that survived. They found the leak in all eleven redaction tools they tested.
On a statement this matters where the hidden value is drawn from a small set: a merchant name, a counterparty, a city. Quantising the box width removes the measurement.
Check before you send
- Select all, copy, paste into a plain text editor. Search that text for your account number and for any merchant you removed.
- Search the PDF for the last four digits of your account. Nothing should be found.
- Read the document properties for a customer reference in the title, subject, or author fields.
- Check the running balance column reconciles only with what is still visible.
Doing it
Redact PDF removes the selected content from the file and rewrites the document, rather than drawing over it. Metadata, attachments and comments are cleared in the same operation, and a second engine re-reads the exported file to confirm no text is still extractable from the redacted regions — which on this document is the check that matters most.
Everything runs in your browser. The alternative — uploading ninety days of your financial life to a free web converter so that it can help you hide ninety days of your financial life — is the version of this task that goes wrong before it starts.
Sources and further reading
- Regulation (EU) 2016/679 (GDPR), Article 9 — health, religious belief, political opinion, trade union membership and data concerning sex life as special category personal data.
- Regulation (EU) 2016/679 (GDPR), Article 5 — data minimisation.
- Bland, M., Iyer, A. and Levchenko, K., Story Beyond the Eye: Glyph Positions Break PDF Text Redaction, PoPETs 2023(3):43–61 — recovering redacted text from character positioning, across eleven tools.
- NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information — identifying PII and assessing the harm from disclosure.
- ISO 32000-2:2017, the PDF 2.0 specification — why covering, cropping and removing are three different operations on a PDF.