Guides

Sharing a bank statement safely

28 October 2026

A letting agent who asks for three months of statements is usually trying to check two things: that you are you, at an address, and that money arrives. They do not need the long number that can move money, and they do not need the name of every person you paid. Those are separate redactions. This page is the order to do them in. It is not advice about whether you should send a statement at all.

Write down the purpose before you export

Say the agent wants proof of address and proof that rent-sized money lands in the account. Then the pages they need show your name, the address the bank prints, a few credits, and maybe a closing balance. They do not need the full account number, the sort code, the IBAN, the card PAN printed on some statements, or the row that says you paid a clinic or a relative. If a lender has a form that says "unredacted statements only", believe the form. Redacting against a written instruction gets applications rejected, and this site will not argue with the lender. For the ordinary agent email, redaction is reasonable and often overdue.

Download the PDF from the bank. Do not photograph the screen unless the bank gave you no PDF. A photo is a scan, with all the OCR trouble in the scan guide, plus your room in the background. Prefer the official PDF. Put the original in a folder you do not attach from. Work on a copy.

What the detector will catch, and what it will not

Upload the copy on the playground. IBAN shapes that pass a checksum are listed. Card numbers that pass their checksum are listed. Emails and phones in the footer are listed. An account number is listed when it looks like one of those, not merely because it is eight digits. Sort codes are short. A sort code written as 20-00-00 may not match a phone or an IBAN. Look for it yourself. UK statements often print sort code and account number in the header in a layout that is obvious to you and only partly obvious to a pattern.

Amounts are listed and left unchecked. A closing balance of GBP 1,840.22 will appear as an amount if it is written with a currency mark or a normal money shape. Leave it checked only if you do not want the agent to see the balance. If the point of the PDF is to show that the balance, or the salary credit, exists, leave amounts unchecked. You can still hide the account number. That split is the useful one, and it is why amounts are opt-in. Tick Hide amounts and you will cover the salary credit too, which may make the PDF useless for the purpose you just wrote down. The fee on the India dummy and the gross pay on the US dummy behave the same way if you want a dry run with fake numbers before you touch a real statement.

Transaction descriptions are the hole. "Transfer to James Okonkwo" is another person's name in a sentence. The name label rule looks for lines like "Name:" and "Bill to:", not for a payee in a narrative. The tool will not list James. You have to see him. The same is true of a landlord you are not applying to, a child's savings pot, a political donation, or a pharmacy. If the page is a diary, hiding the IBAN and sending the diary is a weak privacy win. Consider sending a bank letter that states the balance, or a statement with whole description columns covered, even if that means a coarser edit than this tool's list.

Cover the number, then prove the cover

Leave the IBAN, the card, and any phone or email checked. Uncheck your own name and address if the agent must see them and they were detected from a label. Many bank PDFs print the name with no "Name:" prefix, so it may never have been in the list. That is fine when you want it visible. It is not fine when you wanted it gone and assumed the tool would notice a human name. Read the header of the preview.

Hide selected. The pages become pictures with dark blocks on the checked fields. The account number, if it was covered, should not be selectable. The balance, if you left it, should still be readable by eye and should not be selectable either, because the whole page was flattened. Tell the agent the PDF is an image if they complain they cannot copy the balance into a form. They can type it. You can also paste the balance into the email yourself, which is one number, instead of giving them a text-layer statement.

Then run the checks. Search the download for the last four digits of the account and for the IBAN fragment you remember. Copy from the header. Open properties in case the bank put your name in the title, which a burn drops by building a new file, but confirm it. Rename statement-january.pdf if the original name included an account number. Banks do that more often than people notice.

What not to send alongside

Do not attach the original "as well, in case the redaction is too strong". The original is the leak. Do not attach three months if they asked for one, out of politeness. Extra months are extra payees. Do not forward the bank's notification email, which often repeats the account tail and your address, underneath a carefully burned PDF. Do not upload the statement to a random group chat to ask if the blocks look straight. Ask with the fake US dummy if you want a second pair of eyes, or describe the layout.

This site processes the upload in memory and does not keep a statement library. That is not a reason to be casual. Your email provider will store the message you send the agent. The agent will store it in a lettings system you do not control. Redact before that hop, not after.

A black rectangle drawn in Preview around the account number feels faster. It leaves the number extractable, which on a statement is the entire risk. The black-box guide is the demonstration. Use it once, on the dummy, if you do not believe it yet. Then burn the real statement, check the last four digits, and send one file.

If the statement is a scan from a branch printer, OCR has to read the header before anything can be blocked. Zoom the preview until you can see whether the block covers every digit or only the word "Account". A block on the label is a common OCR miss and it leaves the number in the clear. Fix the crop or cover that spot before you send. A letting agent does not need to be malicious for this to matter. They need a mailbox that later gets copied, which is an ordinary Tuesday.