Should You Redact the Whole Number, or Leave the Last Four?

Most redaction advice, including most of the advice on this site, answers a yes-or-no question: does this thing need to be covered, and did the black actually remove it? Account numbers, national insurance and social security numbers, card numbers, policy numbers and reference codes raise a different question, and it is a question of degree. Nobody is asking whether the number is sensitive. They are asking how many of its digits are allowed to stay on the page.

That sounds like a judgement call and often it is not one. For the common cases, somebody has already decided, and the decision is written down in a rule that applies to your specific filing or submission. Guessing when a rule exists is how documents come back rejected; assuming a rule exists when it does not is how four digits of a private number end up permanently published for no reason. Both failures are avoidable, and neither is really about drawing boxes.

Worth separating out before going further: partial masking has nothing to do with how thoroughly a redaction works. A box covering four digits removes those four digits exactly as completely as a box covering sixteen. The risk in partial redaction is not leakage from under the black. It is that the fragment you deliberately left visible turns out to be more revealing than you expected, or that your careful compromise breaks the rule you were trying to satisfy.

Three rulebooks, three different answers

The reason this question has no single answer is that the governing rules were written for different purposes and point in different directions.

Court filing rules often prescribe the fragment. In United States federal civil practice, Rule 5.2(a) of the Federal Rules of Civil Procedure provides that unless the court orders otherwise, in an electronic or paper filing with the court that contains an individual's social-security number, taxpayer-identification number or birth date, the name of an individual known to be a minor, or a financial-account number, a party or nonparty making the filing may include only: the last four digits of the social-security number and taxpayer-identification number; the year of the individual's birth; the minor's initials; and the last four digits of the financial-account number. That is unusually specific, and it tells you the shape of the redaction before you open the file: cover the first five digits of a social security number, cover the month and day of a date of birth, cover a minor's name and leave initials. State and local court rules address the same ground differently, and a particular judge's standing order can override the default, so the applicable rule is the one for the court you are filing in rather than the one you read about somewhere.

Payment-card rules cap the fragment. The PCI Security Standards Council's published guidance on acceptable truncation formats states that acceptable formats vary according to the length of the primary account number and the requirements of the participating payment brands, and that a maximum of the first six and last four digits of the number is the starting baseline for entities to retain after truncation, considering the business needs and purposes for which the number is used. Note the direction of travel: this is a maximum, not an entitlement, and it is aimed at organisations that handle card data rather than at anyone redacting a document on their own behalf. If you are preparing a bank or card statement for someone else to read, the practical takeaway is that a card number is a string where a long fragment is unsafe and conventions exist to limit it.

Everywhere else, no rule applies and minimisation should win. If you are sending a statement to a landlord, a document to an opposing party in a private dispute, a record to an employer or a file to a forum, nobody has specified a fragment. People leave the last four anyway, out of habit learned from receipts and bank apps. There is rarely a reason. Ask what the recipient does with those digits; if the answer is nothing, cover the whole string.

Why "last four" is not automatically a safe quantity

The strongest argument for caution here comes from the rulemakers themselves. The committee note to Rule 5.2 observes that while the rule provides for the public filing of some information, such as the last four digits of an account number, it does not intend to establish a presumption that this information never could or should be protected — and that it may well be necessary in individual cases to prevent remote access by nonparties to any part of an account number or social security number. A permitted disclosure is a ceiling, and the note explicitly declines to call it harmless.

Three mechanisms make a small fragment bigger than it looks.

It confirms rather than reveals. Four digits will not let a stranger reconstruct your account. They will let anyone who already has a candidate number verify a match — which is precisely the step that turns a database of stolen records into a confirmed identification of the person named at the top of your document.

Different fragments of the same number combine. The same PCI guidance warns that access to different truncation formats of the same account number greatly increases the ability to reconstruct the full number, and that the security value of an individual truncation format is reduced accordingly. The same arithmetic applies to the documents you produce: if one page shows the first six digits and another shows the last four, a recipient holding both has ten, and your two individually conservative redactions have combined into a careless one.

Structured numbers are partly predictable. Many reference numbers are not random. Card numbers carry an issuer prefix and a check digit; many institutional reference codes encode a branch, a product or a year. Covering the variable middle of a structured string while leaving the structural parts on display can narrow the possibilities a long way, and it is worth knowing which parts of the number you are working with are the informative ones.

Drawing a partial box in this tool, specifically

Partial redaction asks more of the drawing than full redaction does, and it is better to know the mechanics than to discover them in the export.

Boxes here are drawn by hand. Click and drag, and the rectangle covers what the rectangle covers — there is no text selection, no pattern matching for number-shaped strings and no snapping to character boundaries. The box edge lands where you release the pointer, which means a box intended to stop cleanly between the fifth and sixth digit depends entirely on how precisely you can place that edge.

On export, each page is re-rendered at twice the page's own dimensions, your boxes are painted onto that rendering as solid black, and the result is encoded as a JPEG image that becomes the new page. Three things follow from that pipeline. The covered pixels are overwritten in the rendering before the image is encoded, so a partial box is as final as a full one. The scaling is proportional, so a box edge drawn mid-digit stays mid-digit — but it is scaled, not re-snapped, so tiny misplacements are carried into the output rather than tidied up. And because every page becomes an image, the digits you left visible survive only as pixels: no one can copy them, and neither can you search for them.

Practical consequences, in order of how much they help:

1. Make the page big before you draw. The tool renders a page to fit the available width, up to a limit. More displayed pixels per digit means more accuracy per pointer movement, which is exactly what a sub-word box needs. A partial redaction on a narrow phone screen is the hardest version of this job.
2. Overlap inward, not outward. Aim the box edge slightly into the digit group you are covering rather than at the hairline between characters. Leaving half of a "3" showing is a legible 3; shaving a sliver off the edge of the digit you are covering costs nothing.
3. Find every occurrence first. Numbers repeat — a header, a footer, a payment stub, a summary table, a "re:" line. Before drawing anything, search the original document for the full string and note every page it appears on. Doing this on the original is the only chance you get; the export has no text to search.
4. Keep the fragment identical everywhere. If you are leaving the last four on page one, leave the last four on page nine too. Varying which part you keep from page to page is the self-inflicted version of the multiple-truncation problem.
5. Check the downloaded file by eye at full size. Open the export, not the preview, and look at every number you touched. This is a visual check because it cannot be anything else.

Common mistakes and misconceptions

"The rule says last four, so last four is required." Rule 5.2 limits what a filing may include; it does not oblige you to publish anything. Redacting the entire number is generally permitted and sometimes wise. The rules that genuinely require a fragment are the ones on the other side — forms and claims processes that need the digits to match your submission to a record.

Treating a compliant redaction as a private one. Compliance with a filing rule and protection of the person named are different goals, and the committee note to the rule says as much. Where the stakes for the individual are high, ask the court about sealing or further protection instead of assuming the default is sufficient.

Mixing fragment styles across a bundle. First six here, last four there, middle digits somewhere else. Each page looks careful; the set gives away more than any page does.

Believing a short fragment is anonymous. It is not identifying on its own and it is rarely on its own. A document that pairs it with a name, an address and a date of birth has supplied the context that makes it useful.

Relying on a text search of the exported PDF. The export has no text layer, so a search finds nothing regardless of what is on the page. A clean search result here means the file is an image, not that the number is gone.

Forgetting the number exists outside the page body. A reference number can sit in a filename, in document properties, in a header repeated on every page, or in an attached payment slip. A perfect partial box in the body does not help if the full string is also printed in the footer.

Leaving a fragment because the source document did. Bank apps and receipts print the last four for your convenience in identifying your own account. That convention was designed for a screen you alone are looking at, not for a document you are about to hand to someone else.

Related guides

Explore more ways to redact PDFs privately, or use the redaction tool above:

• Redact a social security number in a PDF
• Redacting numbers when the totals give them away

Frequently asked questions