Why bank statements come with a password
Banks protect emailed statements because email can be forwarded, intercepted or left in a shared inbox. The PDF is encrypted, and the password is built from details only the account holder should know, such as part of the name and the date of birth, a customer ID, or a code chosen when the statement was requested. Most statements emailed by Indian banks and card issuers arrive this way.
Common password patterns
The email that carries the statement usually explains how its password is made, so check it first. The patterns used most often are:
- The first four letters of the name followed by the date of birth as DDMM, for example
anil0703orANIL0703. Upper or lower case depends on the bank. - The same four letters followed by a customer ID instead of the date of birth.
- A customer ID or account number on its own.
- A short code you chose yourself when you asked for the statement.
Formats banks publish on their own websites
These are quoted from each bank's own help pages, checked on 10 October 2026. Banks change their formats, so the email you received is always the final word.
| Statement | Password, as the bank describes it | Source |
|---|---|---|
| HDFC Bank account statement downloaded from NetBanking | Your numeric Customer ID (CustID). More on HDFC statements | HDFC Bank FAQ |
| ICICI Bank credit card e-statement | First four letters of your name as printed on the card, in lowercase, followed by your date and month of birth as DDMM. No spaces or special characters. | ICICI Bank FAQ |
| Axis Bank credit card e-statement | Four letters of your name in upper case, as it appears on the statement (ignore spaces and periods), followed by four digits of your date of birth. Alternative: the same four letters followed by your nine-digit customer ID. | Axis Bank support |
| SBI savings e-statement requested by SMS | The 4-digit code you chose when you sent the SMS ESTMT <account number> <code>. | SBI Quick |
Kotak Mahindra Bank, HDFC Bank credit cards and other statements are not listed because the banks' own pages did not state the format when checked. Their statement emails normally say how the password is made.
If the password does not work
- Check the letter case. Some banks use capitals, others lowercase.
- Use the name exactly as the bank prints it, without titles such as Mr or Ms, and without spaces.
- Write the date with leading zeros: 5 March is
0503, not53. - On a credit card statement, use the name printed on the card, which can differ from the account name.
- After ten wrong tries on the same file, DocFig pauses that file for an hour to stop guessing.
How DocFig handles the password
The password is sent over HTTPS with the file and used once, in memory, to open the PDF. It is never written to disk, logged, counted or sent to the AI model that reads the transactions, and the unlocked copy is discarded with the rest of the upload. Account and card numbers are masked before any text leaves the server. Every step is on the Security page.
Once open, the statement is converted like any other: debit and credit columns, Cr balances and Indian digit grouping such as 1,23,456.00 are all handled, and each row is checked against the printed balances. See bank statement to Excel for what the workbook contains.