Why bank statements come with a password
Banks protect emailed statements because email can be forwarded, intercepted or left in a shared inbox. The PDF is encrypted, and the password is built from details only the account holder should know, such as part of the name and the date of birth, a customer ID, or a code chosen when the statement was requested. Most statements emailed by Indian banks and card issuers arrive this way.
Common password patterns
The email that carries the statement usually explains how its password is made, so check it first. The patterns used most often are:
- The first four letters of the name followed by the date of birth as DDMM, for example
anil0703orANIL0703. Upper or lower case depends on the bank. - The same four letters followed by a customer ID instead of the date of birth.
- A customer ID or account number on its own.
- A short code you chose yourself when you asked for the statement.
Formats banks publish on their own websites
These are quoted from each bank's own help pages, checked on 10 and 12 October 2026. Banks change their formats, so the email you received is always the final word.
| Statement | Password, as the bank describes it | Source |
|---|---|---|
| HDFC Bank account statement downloaded from NetBanking | Your numeric Customer ID (CustID). More on HDFC statements | HDFC Bank FAQ |
| ICICI Bank credit card e-statement | First four letters of your name as printed on the card, in lowercase, followed by your date and month of birth as DDMM. No spaces or special characters. More on ICICI card statements | ICICI Bank FAQ |
| Axis Bank credit card e-statement | Four letters of your name in upper case, as it appears on the statement (ignore spaces and periods), followed by four digits of your date of birth. Alternative: the same four letters followed by your nine-digit customer ID. More on Axis card statements | Axis Bank support |
| BOBCARD (Bank of Baroda) credit card statement | First four letters of the name on the card, all in upper case, followed by your date of birth as DD/MM. | BOBCARD FAQ |
| Federal Bank account statement | First four letters of your name in capitals followed by your date of birth as DDMM. More on Federal Bank | Federal Bank |
| IndusInd Bank account statement | First four characters of your name in capitals followed by DDMM, or your 8-digit Customer ID. More on IndusInd | IndusInd statement email |
| Axis Bank account statement | Four letters of your name in upper case followed by your 9-digit Customer ID. More on Axis account statements | Axis statement viewer |
| SBI savings e-statement requested by SMS | The 4-digit code you chose when you sent the SMS ESTMT <account number> <code>. | SBI Quick |
The other banks below did not state the format on their own public pages when checked.
Formats reported by account holders
For these banks the format is not published by the bank. Each page below lists what account holders and finance sites report, with sources, in the order to try them.
- SBI: last 5 digits of the registered mobile number plus DDMMYY, or the first five characters of the first name in capitals plus DDMMYYYY.
- Union Bank of India: first four letters of the name in capitals plus DDMM.
- Punjab National Bank: the 16-digit account number, or the customer ID.
- Bank of Baroda: first four letters of the name in lowercase plus DDMM.
- Kotak Mahindra Bank: the CRN.
- ICICI Bank accounts: first four letters of the name in lowercase plus DDMM, or the 12-digit account number.
- Yes Bank: Customer ID followed by DDMMYYYY.
- Canara Bank: reports conflict; most careful sources say the Customer ID.
For every bank, the statement email or the download screen normally says how the password is made, and that always takes priority.
If the password does not work
- Check the letter case. Some banks use capitals, others lowercase.
- Use the name exactly as the bank prints it, without titles such as Mr or Ms, and without spaces.
- Write the date with leading zeros: 5 March is
0503, not53. - On a credit card statement, use the name printed on the card, which can differ from the account name.
- After ten wrong tries on the same file, DocFig pauses that file for an hour to stop guessing.
How DocFig handles the password
The password is sent over HTTPS with the file and used once, in memory, to open the PDF. It is never written to disk, logged, counted or sent to the AI model that reads the transactions, and the unlocked copy is discarded with the rest of the upload. Account and card numbers are masked before any text leaves the server. Every step is on the Security page.
Once open, the statement is converted like any other: debit and credit columns, Cr balances and Indian digit grouping such as 1,23,456.00 are all handled, and each row is checked against the printed balances. See bank statement to Excel for what the workbook contains.