How to open a password-protected bank statement PDF

The short answer

Your bank locks a statement so that if the e-mail or the file goes astray, only someone who knows details about you can read it. The password is usually built from information the bank already holds: often part of your name and your date of birth, sometimes digits of your mobile number, customer ID, card or account number. The exact rule is written in the e-mail that carries the statement, and usually on the bank's website or in its app where you download statements.

To open the file, type the password into any PDF reader: a web browser, your phone's file viewer or a PDF app. When a password fails, the cause is usually small: capitals where small letters are expected, a missing zero in the date, or your name spelled differently from the bank's records.

Why banks lock statements

E-mail is a convenient way to deliver a statement but not a private one. Messages pass through several servers, sit in inboxes that family members or colleagues sometimes share, are forwarded by mistake and stay on old phones and laptops. A statement, meanwhile, says a great deal about you: your name and often your address, part of your account or card number, your balance, and every payment made or received in the period, which reveals your employer, your landlord, your insurers and your habits.

A password on the PDF means that a misdirected e-mail, or a copy left on a shared computer, cannot be read at a glance. It is a modest protection, not a strong one: a password made of your name and date of birth can be worked out by anyone who knows them. Treat every statement as a confidential document, locked or not.

Where your password rule is written

• The covering e-mail. The mail that carries the statement usually explains how the password is formed, in a sentence near the top or at the foot of the message, sometimes with an example built on a made-up name.
• The bank's website or app. Look in the help or FAQ pages about e-statements, or on the screen where you download a statement in net banking or the app. A statement you download yourself may follow the same rule, a different one, or none.
• The bank itself. If you still cannot find the rule, ask through the phone number printed on your card or passbook or listed on the bank's official website, not a number or link from an unexpected message.

A genuine bank never needs you to reply with your statement password, your net banking password or a one-time password (OTP). A mail asking you to sign in through a link to "unlock" or "view" a statement is a familiar form of phishing; open your bank's app, or type its address yourself, instead.

Common password patterns

Each bank sets its own rule, and one bank may use different rules for savings accounts, credit cards and loan statements. Most rules combine one or two pieces from this list:

• letters of your name, often the first four, in capitals or small letters, as the bank records it;
• your date of birth, as day and month (DDMM) or the full date (DDMMYYYY);
• the last four or five digits of your registered mobile number;
• your customer ID, or the last digits of your card or account number;
• part or all of your PAN.

As an illustration only: a rule of "the first four letters of your name in capitals, followed by your day and month of birth" would give RAVI0907 for a made-up Ravi born on 9 July. Your own bank's rule may be quite different; follow the wording in its mail.

If the password you work out does not open the file, check:

• capitals and small letters, which a PDF password treats as different;
• zeros: 9 July is 0907 as DDMM, not 97;
• your name as the bank holds it, which may include an initial or a spelling you do not use;
• whose details to use for a joint account or an add-on card, as the mail states;
• spaces, which passwords of this kind usually leave out.

Keeping statements safe

• Keep the original, locked PDF. If you need an unlocked copy, make it for one purpose and delete it afterwards.
• Do not forward unlocked statements by e-mail or messaging apps. If someone such as your accountant needs a statement, send the locked file and give the password separately, by a different channel.
• Do not write the password in the same e-mail, in the file's name or in a note stored next to the file.
• Download statements on your own device rather than a shared or public computer, and clear the downloads on any device you do not control.
• Check the sender's address before opening an attachment, and be wary of a statement you did not expect, or one from a bank you do not use.
• If a statement shows a transaction you did not make, report it to your bank straight away and also on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or the helpline 1930. Under RBI's directions for commercial banks, for electronic transactions from 1 January 2027, a fraud caused by a breach elsewhere in the system costs you nothing if you report it within five calendar days; after that, your liability depends on the bank's policy.

The same directions count careless handling of banking credentials, such as sharing a PIN, password or OTP, as negligence on the customer's part. A statement password is not a banking credential, but the same care is a good habit.

Removing the password from your own copy

The statement is your document, and sometimes you may want a copy without the password: a lender, an employer or a visa application may ask you to upload statements, or you may keep them in a folder that is already protected. You need the password to make the copy. Two common ways:

• Print to PDF in a browser. Open the PDF in Google Chrome and enter the password. Choose File, then Print (Ctrl + P on Windows, ⌘ + P on a Mac), set the destination to Save as PDF, and save. The new file opens without a password.
• Preview on a Mac. Open the file and enter the password, choose File, then Edit Permissions, turn off Require Password To Open Document and click Apply, then save the file.

If the bank's file does not allow printing or changes, these steps may not work; use the bank's own download options instead. Before you send a copy, check that every page and every row is there, and remember that anyone who receives it can read it. If the person asking will accept the locked file with the password sent separately, that is the safer choice.

How FinLens opens locked statements

FinLens reads bank and card statements you upload and, if you connect Gmail, the statement PDFs your bank attaches to its mails. When a file is locked, FinLens first tries the password already kept for that file. Then it tries the passwords each issuer's usual rule would make from details in your profile, such as letters of your name with digits of your date of birth, the last digits of your mobile number, your PAN or the last four digits of your cards and accounts, along with any passwords you saved under Statement PDF passwords in your profile. The passwords worked out from your details exist only in memory while the file is read and are not stored.

If the statement came by mail and none of them opens it, the one or two sentences of the mail that explain the password, with every name and number masked, may be read by an AI model to work out the rule; the rest of the mail and the file itself are not sent. Only if all of this fails does FinLens ask you, once, showing what the mail said about the password. The password that opens the file is kept, encrypted with a key that belongs to your account, for that file alone, so neither the reader nor the document viewer asks again. Tick "use it for my other locked files too" to have it tried on your other waiting files.

FinLens never asks for your net banking password. The Security page and the Privacy Policy explain how files and passwords are protected; Bank accounts and Credit cards list what is read from each statement.

Frequently asked questions

Sources

1. Google Chrome Help: Print from Chrome (destination Save as PDF)
2. Apple Support: Password-protect a PDF in Preview on Mac (Edit Permissions)
3. Reserve Bank of India: (Commercial Banks – Responsible Business Conduct) Third Amendment Directions, 2026, on fraudulent electronic banking transactions
4. National Cyber Crime Reporting Portal, Government of India