Finding IBANs and bank account details in Jira attachments
Finance and operations teams move money on the strength of documents — invoices, remittance advices, direct-debit mandates, payout spreadsheets — and a lot of those documents end up attached to Jira issues. Every one of them tends to carry an IBAN, a sort code, or an account number. Bank details are sensitive personal and commercial data, and they’re also a fraud vector: a leaked or altered IBAN is how invoice-redirection scams succeed. If you want to find IBANs and bank account details in Jira attachments, the strong, standardised format of an IBAN makes it one of the most reliably detectable identifiers you’ll deal with.
Why bank details deserve attention
Bank account data is sensitive on two fronts. As personal and commercial data it falls under your data-protection obligations, so you need to know where it lives. As a fraud target it’s actively dangerous: business email compromise and invoice fraud rely on getting a fraudulent IBAN in front of someone who pays it. A pile of historic invoices and payment files in Jira is both a compliance liability and a reconnaissance goldmine for anyone who gains access. Knowing where account details sit is the first step to controlling both risks.
The same blind spot, again
Bank details live inside attached files — invoice PDFs, scanned mandates, payout spreadsheets — and Jira’s search reads issue fields, not file contents, so they never surface in a query. Malware scanning sees a clean invoice. Text-based DLP misses anything that arrives as a scanned document or a photo. Where invoices are scanned rather than digital, only OCR can read the account number off the page.
IBANs are made for pattern matching
An IBAN has a precise, internationally standardised structure: a two-letter country code, two check digits, then up to thirty alphanumeric characters, with a country-specific length (a German IBAN is 22 characters, a French one 27). That regularity makes it an excellent regex target — a pattern like [A-Z]{2}\d{2}[A-Z0-9]{11,30} captures candidates well, and the built-in IBAN check digits let you validate matches to strip out false positives, much as Luhn does for cards. For domestic formats you can add patterns for sort codes and account numbers, and anchor on labels such as IBAN, Account, or Bank. Attachment Scanner for Jira takes these patterns directly — text or regex — scoped with JQL to wherever payment documents accumulate.
Scoping and running it
Target finance, accounts-payable, procurement, and any service desk that handles refunds or payouts. The app reads every supported attachment — Office documents and CSVs, text-layer and scanned PDFs, plain text, and images — using OCR for scanned invoices and photographed mandates. A document-only scan covers digital invoices and payout spreadsheets for free; a full scan adds the scanned and photographed documents. A tight JQL scope keeps the results focused and the OCR credit use predictable.
From findings to action
Each match arrives with the issue key, file name, extraction type, matched IBAN or account number, and context, so you can tell a supplier’s published IBAN on a standard invoice from account details that genuinely shouldn’t be sitting in a ticket. The statistics dashboard shows where bank data concentrates across projects and work items. When a file holds account details that ought to be removed, bulk-select and delete those attachments — an explicit, admin-confirmed action recorded in the audit log, never automatic. For fraud-sensitive workflows, that record also helps you demonstrate that payment data is being actively governed rather than left to accumulate.
Privacy, limits, and getting started
As with all sensitive financial content, the scanning model matters: OCR on dedicated EU/EEA GPU hardware, no public AI service, attachments processed in memory and discarded, and only matched snippets stored in Atlassian’s Forge storage, isolated per site. IBAN detection is among the most accurate scans you can run thanks to the check-digit validation, but no regex is flawless and OCR depends on scan quality, so treat results as a prioritised worklist. The app is on-demand and Jira Cloud only for now. Within that scope, it gives finance and security teams a practical way to find account data hiding in attachments — including the scanned invoices nothing else reads. You can try it free for 30 days from the Atlassian Marketplace.
Request