BASALT · JOURNAL
Redacting credit card numbers from PDFs
Card numbers are often masked by the system that created a receipt, but older statements, chargeback packets, and scanned authorization forms may contain the full primary account number. A PDF can also hold the value in a form field or attachment even when the page shows only the last four digits.
Find candidates without trusting one pattern
Search the known number in grouped, ungrouped, and masked forms. Search labels such as card number, PAN, Visa, Mastercard, Amex, and account ending. Pattern detection and checksum tests can find likely card numbers, but they produce false positives and should create a review queue, not automatic deletion.
Inspect receipts and charge slips visually. Thermal scans are poor OCR inputs, and embossed cards photographed inside an evidence packet are images rather than text. Review expiration dates and cardholder names according to the approved scope.
Remove stored values, not just appearances
A form field can display bullets or a shortened number while retaining a complete value. Clear the field dictionary before flattening. If the number is in a scan, destroy the relevant pixels and matching OCR text; if it is born-digital text, remove the glyphs from the content stream.
Inspect attachments and annotations. A reviewer comment such as “full card is 4111…” defeats an otherwise correct page redaction, and an attached original receipt remains untouched.
Verify and minimize the copy
Reopen the release candidate with a different parser and search every known format plus the label words. Inspect the marked pixels and file structures. Keep only the information needed for the disclosure, but do not assume that a redacted PDF changes retention duties for the original.
Frequently asked questions
Can software automatically find every card number?
It can suggest number-like patterns and validate common lengths, but OCR errors, images, and unusual formatting require human review.
Is masking all but the last four digits the same as redaction?
No. A page may display a masked appearance while the full value remains stored in a form field or underlying object. Inspect the file structure.
Should I upload a card statement to an online redaction site?
Uploading exposes the unredacted file to that service before any edit. Use a service approved for the data or process it locally.
Doing it in Basalt
Basalt detects likely payment-card patterns on-device, lets a reviewer approve each mark, removes text, pixels, form values, and attachments, then verifies the result independently. The document engine cannot access the network. Learn more.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.