How to redact a bank statement before sharing it (landlords, visas, loans)

Landlord wants three months of statements. The visa officer wants six. The lender wants everything. Statements get shared constantly — and most people either overshare (full account numbers to a stranger on a rental platform) or redact so aggressively the document gets rejected. Both problems have the same fix: know what each recipient actually needs, and remove the rest properly.

What each recipient actually needs

• Landlords & letting agents — your name, the statement period, and income deposits landing regularly. They do not need your card number, your account number in full, or your therapy payments.
• Visa applications — name, dates, balances and often the bank's branding intact (consulates distrust heavily-altered documents). Redact identifiers, keep the document recognisably official — and check the specific embassy's guidance, since a few insist on unredacted originals.
• Lenders — the most access-justified: expect to show real activity. Even then, full card PANs aren't needed; last-four identifies the account.
• Merchant/support disputes — one transaction line plus your name. A single-line crop with identifiers masked beats sending the month.

The black-rectangle trap

Here's the failure that keeps producing horror stories: drawing a black box over text in a PDF annotation tool covers the text without removing it. The characters are still in the file — selectable, searchable, copy-pasteable by anyone who receives it. Highlighting-in-black in a viewer, stamping shapes in a signing app, even some "redact" buttons that are really rectangle tools: all cosmetic. If you've already shared a statement redacted this way, treat those numbers as exposed. The same applies to screenshots that crop visually but ship location and account metadata in the file.

Proper redaction replaces or strips the underlying data: the characters cease to exist in the output file, not merely cease to be visible.

What to redact, specifically

• Full card numbers (PANs) — always; last-four suffices for identification.
• Account numbers and IBANs — mask to final digits; keep the country prefix on IBANs so the document stays plausible.
• Sort codes / routing numbers — unless the recipient needs to verify the account itself (lenders sometimes do).
• Transactions irrelevant to the purpose — medical, legal, personal transfers. Redact lines, not amounts-in-lines, so running balances still make sense.
• Reference numbers that encode other accounts (loan refs, linked-account fragments).

A browser-only way to do it

Our statement redactor was built for exactly this and runs entirely in your browser: the file is parsed locally, card/account/IBAN/ sort-code patterns are detected and masked to their last digits, and you download the cleaned file. Nothing uploads — the correct default for a document whose entire point is that others shouldn't see parts of it. The same masking rules run server-side before storage when you use the full analyzer, which is why full numbers are never persisted here at all.

Alternatives to sharing statements at all

Sometimes the better answer is a different document: banks issue balance confirmation letters and official transaction summaries on request, many employers' payslips satisfy income checks, and open-banking verification services let a lender confirm income without you emailing files anywhere. When a recipient will accept one of those, the redaction question disappears entirely — the least shared document is the safest one.