Which Numbers in a Document Are Most Dangerous If They Leak?
Not every identifier carries the same risk. See which numbers a fraudster can actually use, ranked by harm, with what to mask first when time is short.
Not every number in a document is equally risky if it leaks. A stolen card number can be used for a payment within minutes. A stolen Social Security number can fuel identity theft for years. This guide ranks common identifiers by what a criminal can actually do with them, using official consumer-protection sources, so you know what to mask first when time is short.
Which numbers can a criminal actually use?
Some numbers open a bank account. Others open a criminal case in your name. The risk depends on what the number unlocks, not on how official it looks. A membership number looks impressive but does little alone. A card number with its security code can move money the same day.
| Identifier | What a fraudster can do with it | Mask fully or partially? |
|---|---|---|
| Card number + security code | Make an online, card-not-present payment | Fully: the number and the code |
| Social Security or national ID number | Open credit, claim benefits, or file a fraudulent tax return in your name | Fully |
| Passport or driving licence number, with a photo | Apply for real documents or accounts using your identity | Fully |
| IBAN | With your name and address, authorize a fraudulent direct debit | Fully in a public document. Safe to give a trusted payer directly |
| Date of birth, with name and address | Pass identity checks or security questions that use these three facts | Fully, when the three appear together |
| Phone number or email address | Attempt phishing, social engineering, or account recovery | Usually only needed when paired with other identifiers |
Which numbers carry the highest risk?
A full card number combined with its three-digit security code is the fastest one to abuse. Together they are enough to attempt an online, card-not-present payment, no PIN or physical card needed. That is why receipts and statements mask most of the number, but a leaked document with both pieces together removes that protection entirely.
A Social Security number or a national ID number works differently. It does not move money by itself, but it unlocks new credit, benefit claims, and tax accounts opened in your name. In the United States, the FTC has flagged cases where a stolen Social Security number was used to file a fraudulent unemployment claim. The damage often surfaces months later, which makes it harder to fix.
Why does partial masking work for a card number but not a passport?
The payment industry has an official answer for cards. The PCI Security Standards Council, which sets the rules banks and merchants follow, calls the first six and last four digits the starting baseline for a displayed card number, with everything in between hidden. Those digits alone cannot complete a payment, so showing that much is considered safe.
- A passport, driving licence, or national ID number has no equivalent official partial-display rule, so the safer default is to mask it completely.
- An IBAN is meant to be given out so people can pay you, but a document that also carries your name and address turns a safe number into three pieces a fraudster needs together.
- A date of birth is only three short facts, so hiding one of the three, day, month, or year, still leaves the other two, plus the name, doing most of the work.
Which combinations multiply the risk?
A number rarely travels alone in a real document. The UK's Information Commissioner's Office lists your name, date of birth, and current or previous addresses as the personal information fraudsters steal to impersonate someone and open accounts in their name. None of the three is secret by itself. Together, they often pass an identity check.
Jane Example is applying for a small-business loan and attaches a scanned pay slip to prove her income. The pay slip already shows her full name and date of birth in the header. If she also leaves her home address visible in the footer, a reader now has the exact three facts a bank's identity check usually asks for.
What should you mask first when you only have five minutes?
- Any card number shown with its security code or expiry date.
- Any Social Security, national ID, passport, or driving licence number.
- IBAN or bank account numbers, especially next to your name and address.
- Date of birth, if the name and address are also visible.
- Everything else, phone numbers, emails, and reference numbers, once the first four are done.
A masking tool can apply this order automatically. ONYRI Sanitize runs in the browser and finds card numbers checked with the Luhn algorithm, IBANs, national ID and Social Security numbers for the countries it covers, dates, and phone numbers, then removes them before the file ever leaves your device. Its limit: detection is not exhaustive, and it masks each value in full rather than keeping the last four digits.
Whichever tool you use, the underlying rule stays the same. Rank the numbers in front of you by what they unlock, not by how long or official they look, and mask the ones that let someone impersonate you or spend your money first.
Frequently asked questions
Which single number is the most dangerous if it leaks?
It depends on what is attached to it. A card number next to its security code lets someone pay immediately. A Social Security or national ID number takes longer to abuse, but the damage, new accounts, fraudulent tax filings, benefit claims, can run for months before you notice it.
Is it safe to share my IBAN?
Yes, an IBAN is meant to be given out so people can pay you. The risk appears when a document also shows your full name and address next to it. France's CNIL and Germany's Verbraucherzentrale both describe fraudsters using exactly that combination to authorize a payment or a direct debit in your name.
Why do receipts show the last four digits of a card, if masking should be complete?
A receipt uses the PCI Security Standards Council's own display rule, which allows the first six and last four digits so you can recognize your card. That rule exists to let a business show a reference, not to redact a document. When you are removing a number from a document entirely, mask all of it.
Does a date of birth matter if my name is not on the same page?
Less, but check the rest of the document. A date of birth mainly helps a fraudster when it sits next to a name and an address, the three facts the UK's ICO lists as the core set used to impersonate someone. On its own, a birth date is a weak clue.
What about a phone number or an email address?
On their own, they mostly enable phishing attempts or a password-reset request, not a completed fraud. They matter more paired with a name, a date of birth, or a card number, since they help a criminal contact you convincingly or intercept a one-time code meant for you.
Sources & references
- What To Know About Credit Freezes and Fraud AlertsFederal Trade Commission (Consumer Advice)
- Identity TheftFederal Trade Commission (Consumer Advice)
- Identity theftInformation Commissioner's Office (UK)
- What are acceptable formats for truncation of primary account numbers?PCI Security Standards Council
- Fuite de données sur internet et vol de votre IBANCNIL (France)