Guide

Masking an IBAN, a NIR or a SIRET in a document

Bank details, social security numbers and company numbers sit in payslips, statements and invoices. Each says more than it seems, and each has a check digit that helps find it.

Updated

In short

  • An IBAN gives access to direct debits; a NIR reveals sex, year, month and place of birth.
  • A SIREN or SIRET is public for a company, but identifies a person when they work as a sole trader.
  • These numbers are written with or without spaces, across lines, in tables: a simple search misses some.
  • Their check digits tell a real number from a lookalike: use them to find every occurrence.

What each number reveals

NumberShapeWhat it saysCheck
IBANFR76 then 23 characters for a French account (27 in all)The bank, the branch and the account; enough to set up a direct debitMOD-97 on the whole number
BIC8 or 11 letters and digitsThe bank and its countryStructure only
NIR (social security number)13 digits and a 2-digit keySex, year and month of birth, department and town of birthKey: 97 minus the number modulo 97; 2A and 2B for Corsica
SIREN9 digitsThe company, or the sole trader behind itLuhn
SIRET14 digits: the SIREN and a 5-digit establishment numberOne establishment of the companyLuhn, with one documented exception

Where they hide

The same number often appears several times in one file, in different forms:

  • payslips: the NIR at the top, the SIRET of the employer, sometimes the IBAN of the employee;
  • bank details (RIB) and statements: the IBAN, the BIC, the account number broken into bank code, branch code, account and key;
  • invoices and quotes: the SIRET, the VAT number built from the SIREN, the IBAN for payment;
  • certificates, tax and benefit documents: the NIR, written with or without spaces;
  • e-mails and their signatures, tables exported from business software, scanned forms with one digit per box.

When to mask them, and when not

Mask a number whenever the recipient does not need it. A landlord needs proof of income, not the NIR on the payslip; an expert needs the amounts of a statement, not the IBAN; a court exhibit rarely needs the account details of a third party.

Keep it when it is the point: the IBAN on bank details sent to be paid, the SIRET of a supplier on a public invoice. The SIREN or SIRET of a company is public information; that of a sole trader identifies a person, and deserves the same care as a name.

Why a simple search is not enough

Searching a PDF for a number finds it only if it is written exactly the same way. FR76 3000 6000 0112 3456 7890 189 and FR7630006000011234567890189 are the same IBAN; a NIR can be split across two lines or two table cells; a scanned page has no searchable text until it is read by OCR.

Check digits solve the opposite problem: a sequence of 13 digits is not necessarily a NIR. A tool that checks the key tells a real number from a phone number or an order reference, and avoids masking what should stay.

Masking them with Obscelis

Obscelis looks for these numbers with bounded patterns, then validates each candidate: MOD-97 for the IBAN, the control key for the NIR, Corsican 2A and 2B included, Luhn for the SIREN, the SIRET and payment cards. A nearby label ("IBAN", "N° de sécurité sociale", "SIRET") raises the confidence; a pattern alone never gets high confidence for a number with a key.

Scanned pages are read with OCR first, and forms with one digit per box are read box by box. You accept or reject each finding, apply a decision to every occurrence of the same number in one go, and add your own identifiers, such as client or file references, in Settings.

Questions

Is it risky to send my IBAN?

An IBAN is meant to be shared to receive payments, but it is also what a direct debit needs. Send it when someone has to pay you; mask it on documents sent for another reason, such as statements attached to a rental application.

Can I keep the last digits visible?

Some organisations mask all but the last few digits so that the number can still be recognised. Decide what the recipient needs; the safest default is to mask the whole number.

Does Obscelis recognise numbers from other countries?

IBANs from every country that uses them are validated with their own length. The NIR, SIREN and SIRET are French; for other identifiers, you can define your own rules.

Try Obscelis for 30 days

Download it for macOS, Windows or Linux: the trial needs no account and no card. A question, or a demonstration for your team? Write to us.

Download ObscelisWrite to us

latelierdudev.contact@gmail.com

Opens your e-mail app. We only use your address to reply.