Your bank statement or payslip PDF asks for a password: what to do
Bank and credit card e-statements, payslips and some billing statements often arrive as PDFs that ask for a password before they open. It is not a mistake or a virus — it is the sender protecting a document full of account numbers and amounts while it sits in an email inbox. Here is how to open it, and what to do when you need to pass it on.
Why the file is locked
Email is not a private channel: messages are forwarded, inboxes are shared, phones are lost. A password on the PDF means that a statement which reaches the wrong person is still unreadable to them. That is why the password is usually something the sender already knows about you, rather than something they send in the same email.
The protection is the document's own encryption, so it travels with the file. Copying the PDF to another device or attaching it to another email does not remove it.
Finding the password
Read the email the PDF came with, and the sender's website or app. They almost always state how the password is formed — for example from parts of your details that you would know — and some let you set your own. Do not guess repeatedly in case the file or account has limits, and never enter the password on a website you reached from a link you were not expecting.
Be wary of any message offering to "unlock" your statement for you or asking you to reply with the password. Genuine senders do not need you to tell them.
When you need an unlocked copy
Loan, visa and rental applications often ask for recent statements or payslips, and many upload forms reject password-protected files because they cannot open them to check. In that case it is reasonable to save an unlocked copy — as long as you know the password and the document is yours.
Removing a password you already know simply writes the same document out without its encryption; nothing about the content changes. Tools that promise to remove a password you do not know are a different thing entirely, and are best avoided for documents that are not yours.
Share only what the recipient needs
An unlocked statement is exactly as sensitive as it looks. Send it only through the official upload form or address of the organisation that asked, and consider whether they need every page: a summary page and the pages with the relevant transactions are often enough, and account details that are not needed can be redacted.
Keep the unlocked copy only as long as the application needs it, and delete it from downloads and chat threads afterwards. The original, locked email copy remains your record.