How to Extract Transactions from Password-Protected Bank Statements

Why Banks Password-Protect Statements

Indian banks like SBI, HDFC, ICICI and fintechs like Jio Payments Bank encrypt every monthly PDF with your account number, DOB, PAN or phone as password. This satisfies RBI guidelines but breaks naive extractors that cannot handle AES-256 encrypted streams. Unlike scanned images, these PDFs still contain a selectable text layer — but tools must first decrypt the stream with the correct password, then parse layout. Downloading the PDF to disk unencrypted violates the bank's security intent, so the unlock must happen in isolated memory.

Common password formats vary: SBI uses aaaaa6789 (first 4 of PAN + DOB), HDFC uses customer ID, Jio uses phone + DOB. StatementIQ normalizes these variations and accepts any custom password you set — including alphanumeric with spaces — without storing it. See our Smart PDF OCR Engine for the full list of 100+ supported layouts.

How StatementIQ Decrypts In-Memory — Zero Logging

When you upload a locked PDF on upload, the password travels over TLS 1.3 and is held in a short-lived buffer passed to pdfplumber via stdin — never argv (avoiding ps leakage) and never written to disk or Postgres. The Python worker at scripts/parse_pdf.py opens the file with pdfplumber.open(path, password=stdin.strip()), extracts text and tables, then the buffer is overwritten and freed. If the password is wrong, the worker returns incorrect_password in under 200 ms and prompts you to retry — no file is persisted.

We verify decryption by checking for a text layer of at least 40 characters after stripping spaces. Scanned image PDFs without selectable text return no_text_layer and we surface a clear error: "This PDF is a scan, so it cannot be read" — preventing silent hallucination of numbers.

Step-by-Step: Extract Transactions in 30 Seconds

1. Drag & drop the PDF on the dashboard — if locked, a modal asks for the password; toggle "Apply to all" for bulk uploads with the same PAN.
2. Automatic layout detection finds transaction tables, merges wrapped description lines, and identifies money columns via regex plus balance-movement confirmation.
3. Math audit reconciles opening balance + sum(credits) − sum(debits) == closing balance; any skipped row forces needs_review rather than silent success.
4. Review & export — the statement detail shows 142-item tables, category tags and confidence scores; one click exports clean XLSX for Tally/QuickBooks/Xero.

Troubleshooting & Security Guarantee

Wrong password? You'll see "Incorrect password. Please enter the correct password." with inline retry — no limit, no lockout. Forgot the format? Try your registered mobile, DOB DDMMYYYY, or PAN as printed on your income-tax letter. After successful extraction you can delete the source PDF permanently via Settings → Data; the encrypted file on Cloudinary or local /uploads is removed and the DB row is cascaded.

Our Zero Data Training guarantee means the PDF bytes and password never train any model — they are processed in an isolated worker and purged. For large CA firms handling 500 statements/month on Enterprise, this audit trail satisfies SOC 2 confidentiality controls.