Bank statement password: the PDF format for each bank

Use the name exactly as it is printed on the statement, not as you usually write it, and the date of birth registered with that bank, which is not always the one on your other documents. DDMM means two digits of the day followed by two digits of the month, so 7 May is 0705. The example column applies each rule to one illustrative person.

Every format in the table is assembled from a small set of parts. Knowing the parts turns a failed attempt into a diagnosis: you can see which part is off instead of starting again.

The length is no clue. MEER0705 and 07051990 are both eight characters, so an email that says 'your eight-character password' tells you nothing. What does tell you is whether letters appear at all. If the rule mentions your name, the password starts with letters; if it mentions only your birth date, it is all digits.

The name part is the one people get wrong, so find the printed version before you type. It is at the top of any earlier statement from the same bank, on your cheque book or passbook, and in the profile page of the bank's app. For a card, it is the name embossed or printed on the card itself, which is often shorter than your full legal name. Whatever order and spelling you see there is the order and spelling the password uses.

Suppose Meera's Axis statement prints her name as K Meera Nair, with a family initial first. Her usual password now fails, and each fix she tries produces a different string. A PDF only tells you 'incorrect password', so here is what each near miss looks like against the rule.

So a statement from before a change opens only with the rule that was in force then. HDFC is the case on record: some older HDFC account statements use the Customer ID rather than name letters and DDMM. If a two-year-old statement refuses the current format, that is the first thing to try, not a sign that something is wrong with your account.

If you do not know when the rule changed, the covering emails tell you. Open the email that carried the old file, not the latest one, and read its password line. When that email is gone, you still have two routes. A fresh download of the same period from net banking or the app is usually locked with today's rule, or sometimes not locked at all. Failing that, the bank can reissue the statement.

If the bank changes the rule going forward, nothing needs doing beyond reading the next email. The one habit worth having is to note the new rule somewhere private the month it changes, because in two years you will not remember which files came before it.

Count what the lock actually protects. Your name is printed on the email and on the statement, so the four letters are known to anyone holding the file. That leaves the date. There are 366 possible DDMM values, counting 29 February, so a name-plus-DDMM password falls to at most 366 attempts, or 732 if the case is unknown. A program runs that in well under a second.

The ICICI-style full date is not much better. Anyone who knows your birth year has 365 dates to try; anyone who knows only the decade has 3,652. Next to all 100,000,000 eight-digit strings, a decade of birth dates is 0.0037 percent of the space.

That is not a flaw to complain about. The lock is built to stop a statement being read by whoever glances at a forwarded email or a shared laptop, and to keep it out of plain view in a mail server. It is not built to stop someone who has the file and wants in. The practical conclusion is about you, not the bank.

You need the password once to remove it. After that, the usual route is to make an unprotected copy, and it works in most readers and browsers.

Print to PDF: open the statement, enter the password, choose Print, and pick Save as PDF as the printer. The new file has no password. On a desktop PDF editor there is usually a security or protection setting where you can remove the password and save a copy. On a Mac, Preview's export can save a copy without encryption.

Three things to check afterwards. First, whether the copy is still text: some readers produce an image when printing, which means you cannot search it or select an amount. Try selecting a line. Second, whether the file allowed printing at all: some statements restrict it, and then the print route fails while the editor route may still work. Third, where the copy went. Save as PDF drops files into Downloads by default, which is exactly where a statement should not sit for a year.

Often you do not need an unlocked copy at all. A portal that asks for your statement usually lets you supply the password alongside the file; give it that rather than a permanently open copy.

An unlocked statement carries your account number, your balance, your salary credit with your employer's name, and every UPI ID you paid or were paid by. For anyone trying to impersonate you to a bank, a lender or a relative, that is a script. Most leaks are not theft. They are copies left where copies collect.

Opening the file is the small problem. The larger one is that a statement is laid out to be filed, not read: recurring debits are scattered across pages, UPI lines show a handle rather than a shop, and nothing tells you what next month is already committed to.

Unyfy parses statement PDFs from Axis, HDFC, ICICI, Kotak and Federal Bank. After you upload one, you see the period's transactions, with UPI handles turned into merchant names using a database of about 10,000 entries. If the same debit has already reached Unyfy from an SMS or email alert, it is counted once. On Pro, the Fixed Expenses screen turns the recurring debits into next month's committed outflows, the EMIs, SIPs, rent, bills, subscriptions and card bill, and its Subscriptions list shows each recurring subscription with its amount and whether it is due or paid.

You supply the statement and, where it is locked, the password that opens it, built as described above. It never asks for your bank password or UPI PIN, and every payment is one you authorise. Install Unyfy on Android, or use the web app at app.unyfy.co.in on an iPhone.