To redact an SSN from client documents, work on a copy, use a redaction tool that deletes the digits rather than covering them, remove hidden data, save a new file, then test it: search for the last four digits and try to copy the blacked-out area. If either test finds the number, the redaction failed.
When should a firm redact SSNs from client documents?
A firm should redact SSNs from client documents whenever a file leaves the firm for someone who does not need the number: a lender checking income, an attorney on a divorce, a financial adviser, a software vendor running a test. Records the firm files with the IRS, and its own working papers, usually have to keep the full number.
The test is need. A mortgage lender verifying income wants the wages, the employer and the year. It rarely needs the client's full Social Security number printed on every W-2 page. A vendor demonstrating a tool needs a realistic document, not a real taxpayer.
Redaction is one control, not the whole sharing decision. Whether the client has authorized the disclosure, and which channel to send it through, are covered in the post on secure document exchange with other CPAs, lenders and attorneys. Read that first. Redaction comes after the firm knows the file may go out at all.
Some records must keep the whole number. Returns, and information returns the firm files for a business client, go to the IRS with complete TINs, as a later section explains. The firm's own copy of a client's source documents usually stays complete too, because the preparer needs to match names and numbers. A redacted copy is a second file made for a specific recipient, never a replacement for the original.
Keep a short note of what was redacted and for whom: "W-2 2025, Harbor Logistics, SSN removed, sent to lender, March 4 (example)." If the recipient comes back asking for the number, the note shows what they received.
Why do black boxes fail to redact SSNs in PDFs?
Black boxes fail to redact SSNs in PDFs because a box drawn on a page is a separate object sitting on top of the text. The digits underneath are still in the file. Anyone can select, copy or search them, and a PDF can also carry hidden layers, comments and metadata the box never touches.
The National Security Agency described this failure two decades ago, and it has not changed. Its paper Redacting with Confidence: How to Safely Publish Sanitized Reports Converted From Word to PDF (NSA report I333-015R-2005, Dec. 13, 2005) says covering text with black rectangles "is a common and effective means of redaction for hardcopy printed materials. It is not effective, in general, for computer documents." It calls covering text with black "the most common mistake."
The same paper lists two more traps. Covering part of an image with separate graphics "is generally not effective for computer documents distributed in softcopy form." And most office files "contain substantial hidden information about the document," which it says "is often as sensitive as the original document."
Here is how each failure shows up in a client file:
- A drawn rectangle or highlight. The text layer is intact. Selecting across the box and pasting into a blank document returns the digits.
- A box in Word before converting to PDF. The NSA paper notes that converting a Word file "does not remove all metadata automatically," and images placed on top of text carry over "with the same layout."
- Comments and form fields. A preparer's note reading "SSN XXX-XX-4821 confirmed (example)" can sit in a comment that no one sees on screen.
- Metadata. The file's title, author or keywords can hold a client name or number typed in months earlier.
A printed page with marker over it is a different case. Once scanned, it becomes an image, which brings its own checks covered below.
How to redact an SSN in a PDF so it stays gone
To redact an SSN in a PDF so it stays gone, mark the digits with a true redaction tool, apply the redaction, remove hidden information, save the result as a new file, and then verify it. A true redaction tool deletes the marked text and image data from the file rather than drawing over it.
Adobe's help pages show the sequence in one common PDF editor. The page Redact sensitive content in Acrobat Pro (last updated Aug. 31, 2026) gives the steps: select "All tools > Redact a PDF," choose "Redact text and images," drag over the text, select "Apply," choose whether to "sanitize and remove hidden information," then save under a new name in the "Save Sanitized Document" dialog. Marking alone does nothing until the redaction is applied and saved.
For a document with the number in many places, the page Search and redact text in Acrobat Pro (last updated Sep. 23, 2025) describes "Find text and redact," which searches for a word, several words or "Patterns," lets you "Check All" occurrences, and then marks them for redaction. Review each hit before applying, because a search for four digits will also catch an invoice number.
The hidden-data step has its own page. Sanitize PDFs in Acrobat Pro (last updated Sep. 23, 2025) says PDFs "may contain hidden information," including "metadata, comments, hidden layers, and other sensitive content," and offers "Remove all" or "Selectively remove."
Five-step redaction and verification checklist (example)
- Copy. Save a copy named for the recipient, such as
Reyes_W2_2025_for-lender.pdf(example). Never redact the only original. - Mark and apply. Mark every instance of the SSN with the redaction tool, including headers, footers and attachment pages, then apply.
- Sanitize. Remove hidden information: metadata, comments, hidden layers, attachments.
- Save as new. Save the sanitized file under the new name and close it.
- Verify. Reopen the saved file. Search for the last four digits. Select across each black bar, copy and paste into a blank note. Check the file's properties.
Before and after test (example)
| Test on the saved file | Failed redaction (rectangle drawn on top) | Proper redaction (applied and sanitized) |
|---|---|---|
| Search for "4821" | 3 hits, highlighted under the black bars | 0 hits |
| Copy across the bar and paste | The full nine digits paste into the note | Nothing pastes, or only surrounding words |
| Document properties | Title field reads "Reyes SSN XXX-XX-4821" | Title field blank |
| Comments panel | One note: "SSN confirmed" | No comments |
The failed column is the result a reviewer gets when someone used a drawing or comment tool and saved. Every row passes on the right only after steps 2 to 4.
Truncated SSNs on client forms: what the last four digits allow
A truncated SSN is one where the first five digits are replaced with Xs or asterisks, leaving the last four. Federal rules let filers use a truncated number on most statements furnished to a payee, but never on anything filed with the IRS or the Social Security Administration.
The rule is in 26 CFR 301.6109-4. It says the truncated number takes "the same format of the identifying number it replaces," such as XXX-XX-1234, and that "Use of a TTIN is permissive and not mandatory." It also says a truncated number "may not be used on any return, statement, or other document that is required to be filed with or furnished to the Internal Revenue Service or the Social Security Administration," and that a person "may not truncate its own taxpayer identifying number."
The IRS repeats the practical version in the General Instructions for Certain Information Returns (2025): filers "are permitted to truncate a payee's TIN (SSN, ITIN, ATIN, or EIN) on most payee statements," but "The payee's TIN may not be truncated on Form W2-G," and "A filer may not truncate a payee's TIN on any forms the filer files with the IRS."
For redaction, this means two things. A client's 1099 that arrives already truncated may need no further work before sharing. And when the firm prepares the IRS copy of an information return for a business client, the full number has to stay. Redacting a copy for a third party is a separate file and does not change what goes to the IRS.
Redacting SSNs from scanned images and phone photos
Scanned images and phone photos are pictures of a page, with no text inside them, so text search will not find the SSN and a text redaction tool may skip it. Redact them by marking the area of the image, then run OCR on the result and confirm the digits did not come back as searchable text.
Adobe's page Redact images in PDFs (last updated Sep. 23, 2025) says to select "All tools > Redact a PDF," double-click the image you want to redact, and then apply and save in the same way as text. For an SSN inside a scan, mark the area of the page that shows the digits rather than the whole image.
Images bring three extra checks:
- The OCR layer. A scanned PDF may carry invisible text recognized from the image. Redacting the picture without the hidden text layer leaves the number searchable. After applying, search the saved file for the last four digits.
- Hand-blacked paper. A client who blacks out a number with a marker and photographs it may leave digits readable at an angle or under a flash. Zoom in on the saved copy before trusting it.
- Several copies. Clients often send a photo and then a PDF of the same page. Redact both, or only send one.
SSN redaction edge cases: filenames, email subjects and spreadsheets
An SSN redaction edge case is any place the number survives outside the document body. The common ones are filenames, email subject lines and message text, spreadsheet cells and hidden columns, and old copies in sent folders and backups. A clean PDF does not help if it is attached to an email titled with the client's number.
Filenames. A file named W2_XXX-XX-4821.pdf (example) carries the number in every folder, zip file and share link it touches. Rename before sharing, and name files by client, form and year.
Email subjects and bodies. Subject lines show up in previews, notifications and search results. Never put an SSN in a subject line, and check the quoted thread below a reply for a number a client typed weeks earlier.
Spreadsheets. Look for hidden columns, filtered rows and cell comments, which can hold a number the visible sheet does not show. Copy only the needed cells into a new workbook, check for hidden sheets, and save that file.
Copies left behind. The unredacted original still lives in the firm's files, sent mail and backups. When it is no longer needed, the steps in the post on secure document destruction for accountants apply.
Many of these copies exist because documents arrive as email attachments in the first place. When each client uploads through a single link, as Schema CPA's collect and classify workflow is built around, fewer files travel with a number in the subject line. That reduces copies; it does not redact anything, and every file sent out still needs the checklist above.
Two related controls sit next to redaction. The post on ransomware protection for accounting firms covers what happens when files are stolen in bulk. The post on how to read a SOC 2 report for accounting software covers vetting a vendor before any client file goes to it, redacted or not.