Redact an Invoice Before You Send It
An invoice is a document built to be paid, which means it carries the exact routing details a fraudster needs. Sending one to a new client, a factor, or an accountant usually requires hiding more than the price.
Free, no account, and the image never leaves your browser.
The invoice is the most-targeted business document there is
Business email compromise follows a predictable pattern, and invoices are the vehicle. An attacker who obtains a real invoice learns the supplier's letterhead, the finance contact's name, the invoice numbering format, and — critically — the bank details. They then send a near-identical invoice with the account number changed, timed to a real payment cycle. The recipient has already seen the format, so nothing looks wrong.
That is why the bank block is the field that matters most on an invoice, and why publishing a complete invoice anywhere public is a genuinely bad idea. The amount is commercially sensitive; the account and routing numbers are an attack surface.
There is a second audience problem. Invoices get forwarded. A freelancer sends one to a client, who forwards it to their accountant, who forwards it to a bookkeeper, who stores it in a shared drive. Every hop is a copy, and the original is almost never withdrawn. Reducing the document to what each recipient actually needs is the only way to limit that spread, and it is increasingly what data minimization rules expect.
What to cover, in the order that matters
The first four items are the fraud vector. The rest is commercial and personal disclosure that depends on who is receiving the document.
- Bank account and routing numbers
- The single most dangerous field on the page. Cover both in full, including any repetition in a payment-terms block or a footer.
- IBAN, SWIFT, and sort code
- The non-US equivalents, often printed alongside an account name and bank address. Cover the whole block rather than the number alone.
- Tax identification numbers
- EIN, VAT number, ABN, GST/HST number. These identify the business to a tax authority and are not needed by most recipients.
- Account holder name in the bank block
- Usually printed separately from the signature or the letterhead. Combined with the account number it completes the payment instruction.
- Client name, address, and contact details
- On an outbound invoice the recipient already knows who they are, so the bill-to block is often safe to keep. On an invoice used as a sample or a portfolio piece, cover it.
- Line-item descriptions
- These disclose what was bought, at what rate, sometimes with an internal project code. Cover anything that reveals a client's business.
- Invoice and purchase-order numbers
- Usable as a lookup key on a supplier portal, sometimes with nothing more than an email address. Worth covering on anything public.
- Signature and stamp
- A scanned signature is reusable on other documents. Cover it if the invoice is going anywhere other than the named recipient.
- QR codes and payment links
- Increasingly printed for instant payment. A QR code that resolves to a payment page is worse than a visible account number, because it is not obviously financial at a glance.
Where automatic detection helps on an invoice
Invoices are usually crisp digital documents or clean scans, which is the input the recognition pass handles best. But the fields that matter most here are not the ones it looks for.
Found automatically
- Card numbers of 13 to 19 digits that pass the Luhn checksum, when a card was the payment method
- Email addresses in the header, footer, and remittance instructions
- US phone numbers in the supplier contact block
- IPv4 addresses, which occasionally appear in a footer or an e-invoicing reference
- Social Security numbers in the separated form, on contractor invoices that should not be printing one
Needs a box by hand
- Bank account and routing numbers. These are not one of the six matched patterns, so the most important field on the page always needs a box drawn by hand.
- IBAN and SWIFT codes, for the same reason.
- Tax identification numbers. The format varies by country and is not recognized.
- Client names, addresses, and line-item descriptions.
- Invoice numbers, which are alphanumeric and not a matched pattern.
- QR codes and payment links.
Clearing an invoice for a third party
Decide who the recipient is before you start. An accountant needs the totals and the tax breakdown; a new client does not need your bank details in a preview document.
Convert the PDF to an image first
If the invoice is a PDF, screenshot it or export the page as PNG. Covering text in a PDF with a shape leaves the original text layer readable underneath.
Cover the bank block completely
Draw one box across the whole payment instruction rather than one box per number. A single wide box is easier to verify and cannot leave a digit between two boxes.
Cover the tax identifiers
EIN, VAT, and equivalents. These sit in the header or footer, which is exactly where people stop looking.
Decide on the bill-to block
Keep it for the named recipient. Cover it if the invoice is being used as a sample, a portfolio piece, or a template.
Cover the codes and the signature
QR code, payment link, scanned signature, and company stamp. All four are reusable material.
Export and zoom in on the bank block
Open the PNG at actual size and check that no digit survives at the edge of the box. Financial documents are the case where a one-pixel sliver is genuinely expensive.
Why an overlay on a PDF invoice is not enough
A PDF stores text as positioned glyphs in a text layer and draws them. Adding a black rectangle adds another drawing object on top. The text is still there, in order, extractable with a select-all or a text dump. This is not a theoretical weakness — it has caused real disclosures from law firms, courts, and public bodies.
Proper PDF redaction requires destroying the underlying glyphs, which most consumer tools do not do. The reliable alternative for a document you only need to share as a page is to rasterize it first: turn the page into an image, then redact the image. What remains is pixels with no text layer behind them.
That is the workflow this tool supports, deliberately. It works on images, not PDFs. Convert, then redact. The trade-off is that the text becomes unselectable for the recipient too, which matters if they need to copy figures into a ledger. For an invoice going to a third party, that trade is usually worth making.
One more thing worth knowing about invoices specifically: the bank block is often the only field that repeats. It appears in the payment terms near the bottom and again in a header summary on some templates. A single box on the first occurrence leaves the second one intact, and the second one is the one a fraudster would change.
Invoices, statements, and contracts usually arrive as a batch rather than one at a time. If you want the general workflow before working through this specific document, you can redact image online in four steps, and the mistakes listed there apply to every document on this site.
Frequently asked questions
- Should I redact the bank details before sending an invoice to a client?
- If the client needs to pay by transfer, they need the details. The safer pattern is to send the redacted invoice as a preview or a quote and provide payment details through a separate, verified channel.
- Can I redact a PDF invoice directly?
- Not with this tool. Convert the page to an image first, then redact the image. A shape drawn over a PDF leaves the text layer intact and readable.
- Does detection find the IBAN or the account number?
- No. Account, routing, IBAN, and SWIFT formats are not among the six matched patterns. Draw those boxes by hand every time.
- Will the exported file still carry the invoice's metadata?
- The export is drawn on a fresh canvas and encoded from pixel data, so the source image's metadata container is not carried across. Document properties from an original PDF are not part of the image at all.
- Is anything uploaded while I do this?
- No. There is no upload step and no server-side processing. The image is decoded in the browser tab and the download is created locally.