Is it safe to upload a bank statement to ChatGPT?
Budgeting with an AI works well: it can sort a month of spending into categories in seconds. A statement is also the most detailed record of your life you own. It shows where you shop, who you pay, when you get paid and which account it all goes through.
What is on a bank statement
- your name, address and account number or IBAN, often the sort code or BIC;
- names of people you send money to or receive it from: rent to a landlord, transfers to family;
- payees that say more than you think: a clinic, a pharmacy, a union, a place of worship, a dating app;
- your employer, through the salary line;
- balances, overdraft, loan repayments.
What the AI needs to answer you
To categorise spending or spot subscriptions, it needs dates, amounts and merchant names. It does not need your name, your account number or the names of private individuals in transfers. Those are the lines to tag. If a merchant name itself is sensitive to you, replace it with a category like "pharmacy" before sending.
What can go wrong
A statement uploaded to a chatbot sits in the conversation history for as long as the provider keeps it. In 2025 a US court order in the New York Times case obliged OpenAI to keep ChatGPT conversations, including deleted ones, from May until late September (summary of the order). Rules like that are outside your control. An account number and a list of the people you pay are exactly what a phishing message needs to sound real.
A safe way to ask
- Export the statement as a PDF or copy the transaction lines, and open Hide personal data before ChatGPT.
- Let it tag your name, IBAN and contact details. In "Also replace", add the names of people who appear in transfers.
- Send the tagged text with your question: "group these by category", "which payments repeat every month?".
- Paste the answer back if you want the real names restored, or keep the tagged version.
When not to use an AI at all
Never paste online banking passwords, card numbers with their security code, or one-time codes into any chatbot, tagged or not. For a dispute with your bank or a suspected fraud, call the bank directly from the number on your card.
Questions
Is it enough to hide only the IBAN?
No. Your name, address and the names of the people you pay identify you just as well. Hide those, keep amounts, dates and shop names.
Can I upload the PDF from my bank directly?
If it has selectable text, open it in the tool and it will read it in your browser. If it is a scan, redact it in the Sumi app and upload the redacted copy instead.
Do Claude or Gemini handle this differently?
Each has its own settings. Anthropic lets Claude Free, Pro and Max users choose whether chats are used for training; with training allowed, data is kept up to five years, otherwise 30 days (Anthropic). The safest choice is the same everywhere: send only what the question needs.
What about the card number on the statement?
Statements usually show it masked. If the full number appears, the tool flags card numbers that pass the Luhn check so you can tag them.