Redacting Financial Information from WhatsApp for Legal Use

People share financial information in WhatsApp constantly - account numbers for payments, card details for purchases, IBANs for international transfers, and sort codes for domestic transactions. Most of the time this is convenient and harmless. But when a WhatsApp conversation becomes relevant to legal proceedings or a regulatory process, that financial data poses a problem. Submitting it unredacted creates unnecessary risk and may be contrary to court requirements.

Types of Financial Data Commonly Shared in WhatsApp

Financial data in WhatsApp conversations appears in a variety of formats. Straightforward payment exchanges often include a full account number and sort code typed directly into a message. Overseas payments generate IBANs and BIC/SWIFT codes. Card-based purchases sometimes involve card numbers or the last four digits of a card being shared to confirm which account to use.

• Bank account numbers - typically 8 digits in the UK, often accompanied by a sort code
• Sort codes - 6-digit codes in XX-XX-XX format, used to route UK domestic payments
• IBANs - international bank account numbers, up to 34 characters
• Debit and credit card numbers - 13–19 digit sequences
• Payment app handles - Revolut tags, PayPal email addresses, Cash App usernames
• Transfer amounts - specific sums that, in context, could be sensitive or irrelevant to proceedings

Why Financial Data Needs Redacting

Financial data in a court exhibit or HR document creates two distinct problems. The first is fraud risk - account numbers, sort codes, and card numbers shared unredacted in a document that may be seen by multiple parties, filed in a registry, or emailed between legal teams, could facilitate financial fraud or identity theft. This risk is real even in apparently secure contexts such as legal proceedings, which routinely involve shared document repositories accessed by many people.

The second problem is relevance. Courts and tribunals require parties to disclose only information that is relevant to the issues in dispute. A bank account number shared to facilitate a payment between the parties is rarely relevant to the legal question being decided - it is background noise that serves no evidential purpose and should be removed as a matter of good practice. Leaving it in invites objections and can complicate the admissibility of the exhibit.

Automatic Redaction of Financial Data

Pattern-based redaction handles the majority of financial data in WhatsApp conversations reliably. Card numbers follow well-defined formats (the Luhn algorithm can validate them) and are readily detected. IBANs have a standardised country-code prefix and length. UK sort codes follow a consistent XX-XX-XX pattern. These formats allow redaction rules to identify and replace financial identifiers with high accuracy across the full text of a conversation.

WaChat to PDF's financial data redaction category covers card numbers (13–19 digit sequences matching card formats), IBAN strings, UK sort codes, and common account number patterns. Each matched value is replaced with [REDACTED] before the PDF is rendered, so the values are never written into the output file. Enabling the financial data category alongside other PII categories allows you to redact the full range of sensitive identifiers in a single pass.

What Automatic Redaction May Miss

Pattern matching catches structured financial data precisely because it is structured. It will not catch information expressed in a less structured way. 'The last four digits are 7823' does not look like a card number to a pattern matcher. 'Send it to the joint account ending in 4412' contains a partial account reference but not a detectable format. 'The sort code is zero one, zero two, zero three' written as words will not trigger a numeric pattern.

Similarly, payment app handles - a Revolut username, a PayPal email address, or a Cash App $cashtag - may not be detected by financial-specific patterns, particularly when they look like ordinary text. Transfer amounts stated as round numbers ('send me £500') are not PII in the strict sense but may be sensitive in certain contexts, and no automated tool will judge their relevance to your specific proceedings.

Manual Review Process

After running automated redaction, a manual review of the preview is essential before downloading the final PDF. Focus the review on messages where financial transactions were being discussed or arranged - these are the messages most likely to contain non-standard financial references. Read each message carefully, paying attention to partial numbers, verbal descriptions of account details, and any message where a payment platform handle was used.

For long conversations, use the date-range filter in WaChat to PDF to isolate the period when financial exchanges took place, and focus your review on those messages. Once you are confident that both structured and contextual financial references have been addressed, the PDF is ready for legal or business use.