Is it safe to upload a utility bill as proof of address?

Usually yes, if you started the contact and the portal belongs to the organisation you think it does. But a proof-of-address check reads four things: your name, the address, who issued the bill, and the date. It does not read the account number, the meter's supply number, the Direct Debit details or how much electricity you used, and all of those are on the page. For most recipients you can remove them. SEAL does it by rebuilding the page from pixels, so the numbers are gone from the file rather than hidden under a box, and the bill is never uploaded to do it.

What the check actually looks at

Whether it is a person or a piece of software, a proof-of-address check asks the same questions of the document:

• Is the name yours, matching the name on the application?
• Is the address the one you gave?
• Who issued it? A recognisable supplier, council or bank, which is why a utility bill is asked for at all: it comes from a third party with a reason to know where you live.
• Is it recent? Three months is the common limit, so the bill date or the billing period has to be legible.

That is the whole of it. Nothing in that list depends on the account number, the tariff or the meter.

What else is on the bill

A bill is written for you and for the supplier's own systems, not for a stranger checking your address, so it carries a good deal the stranger has no use for:

• The account number. It is what a supplier's phone line asks you to quote. Together with your name and address, which are on the same page, it is most of what a caller needs to sound like you.
• The supply number and the meter serial. In Great Britain an electricity bill shows the MPAN, a 21-digit number usually printed in a box beginning with S, and a gas bill the MPRN. They identify the meter at your address, and a change of supplier is keyed on them.
• How you pay. A Direct Debit line often names the last digits of the bank account and sometimes part of the sort code.
• Your usage and readings. Kilowatt-hours by period, and sometimes by time of day on a smart tariff, say something about when the home is occupied.
• Notes that are nobody else's business. Some bills mention a payment plan or arrears, a prepayment arrangement, or registration on the Priority Services Register, which exists for people with a medical condition, a disability or a need for extra help.
• The file itself. A PDF downloaded from a supplier's account was written by a billing system, and such a system can put the account number in the PDF's own Title or Subject field as well as on the page. X-RAY shows whether yours does.

Who is asking, and what they need

The top row is the one to be careful with, for the same reason as a payslip sent to a mortgage lender: a regulated firm checking identity is doing something the law requires of it, and a document that has been altered is a bigger problem than the numbers you wanted to keep back. Ask whether a redacted copy is acceptable. Many will say yes to the account number going; if the answer is no, send it as issued through their own portal.

If you are not sure the request is genuine at all, that comes first. A bill is a good document to ask for if you are building a false identity, because it is exactly what everyone else asks to see.

Removing the numbers properly

1. Download the PDF from your supplier's account rather than photographing the paper bill. It is sharper, it has no GPS position in it, and a checker reads it more reliably.
2. Keep the original. Work on a copy.
3. Open the copy in SEAL and drag a box over the account number, the supply number and meter serial, the payment line, and anything else from the list above that the recipient does not need.
4. Leave the name, the address, the supplier's name and the bill date alone. Those are what the check reads, and a bill with its date blacked out is a bill that gets rejected.
5. Burn in and export. SEAL paints the boxes into an image of each page and writes a new PDF from those images, so there is no text layer left to copy from and no document information carried across: the export's Title, Author, Subject and Producer are empty.
6. Check the result. Open it, press Ctrl+A or Cmd+A and try to copy the text. There should be none to copy.

That last check is the one that catches the usual failure. A black rectangle drawn in a PDF viewer or an annotation app sits on top of text that is still in the file, and anybody who selects it gets the number back. That is how redactions fail in court filings, and it happens with bills for the same reason.

We tested this on a bill made for the purpose, with an account number, an MPAN, a meter serial, a Direct Debit line, a payment plan and a Priority Services note on it, and the account number repeated in the PDF's Title and Subject fields. After SEAL, the exported file had no extractable text at all, empty document information, and six solid black areas where those lines had been; the name, address, supplier, dates and charges were still readable.

Checking what a bill contains, and marking it up in SEAL, is free. Saving the redacted copy needs OBSCURA Pro, or a $5 day pass if this is the one document you need it for.

If you only have a photograph of the paper bill

A photo taken on a phone carries the place it was taken in its EXIF data, which for a bill on the kitchen table is your home, and it carries the camera and the time. The address is on the bill anyway, so the location matters less here than for most photos, but it is still one more copy of it. BASTION blacks out areas of an image, writes a flat copy with none of the original's metadata, and can stamp who the copy is for across it.

Sending it

Use the organisation's own upload page where there is one. It is the one piece of the standard advice that is right. If the only route is email, put the file in an encrypted container and send the passphrase another way: CAPSULE makes one that opens in any browser, so the recipient installs nothing.

And do not upload the bill to a website to redact it. That puts the whole thing, account number and all, on somebody else's server before any of it is removed. Everything above runs in the tab you have open, which you can confirm by loading the page and then turning the network off.