How to Mask SSNs and Bank Routing Numbers in Payroll CSVs

Quick Answer

Format-preserving masking replaces SSNs and routing numbers with synthetic values that retain the original format — XXX-XX-XXXX for SSNs, 9 digits for ABA routing numbers — so the masked file passes platform import validators during staging tests. Redaction (replacing with "REDACTED" or blanks) breaks import validation because the platform expects a correctly formatted value even in test runs. Use SplitForge Data Masking to apply format-preserving masks to sensitive columns in your browser — no upload, no server receives your payroll file.

---

Not legal advice. Data handling requirements for HR and payroll data vary by jurisdiction and employer type. Consult legal and compliance counsel before finalizing masking procedures.

---

TL;DR: Payroll CSVs shared for auditor review, IT staging, or manager approval need sensitive fields masked — SSNs, ABA routing numbers, bank account numbers — while retaining the fields the recipient actually needs (salary, department, job title, earning codes). Format-preserving masking retains the field format of masked values so the file can still be validated against platform import templates during pre-production testing. The masking workflow runs entirely in your browser via Web Worker threads: no file upload, no GDPR Article 28 processor relationship created for the masking step. Keep masked files and production files in separate, clearly named workflows — masked files are for review and staging only, never for live platform imports.

---

A compensation analyst is preparing a salary equity review for an external HR consulting firm. The firm needs the payroll extract — job titles, departments, pay grades, salary values, hire dates — to run the analysis. They do not need SSNs, bank routing numbers, or account numbers. But the export from ADP Workforce Now includes all of it in a single file.

Sharing the unmasked file with the consulting firm creates a GDPR Article 28 processor relationship for the consulting firm (documented in HR Payroll CSV GDPR Compliance) and exposes 430 SSNs, 430 routing numbers, and 430 account numbers to every person at the firm who touches the engagement file.

The correct workflow: mask the sensitive columns before sharing, retain everything the auditor needs, and do it without uploading the file to a cloud tool that would create a second processor relationship during the masking step.

Masking behaviors described here reflect SplitForge Data Masking v1 functionality as of May 2026.

---

What Format-Preserving Masking Is

Masking approaches for payroll data fall into three categories, with meaningfully different outcomes for import-workflow compatibility:

Redaction replaces the value with a fixed placeholder — "REDACTED", "XXX", or a blank. Redaction is simple but breaks platform import validators. ADP, Workday EIB, and QuickBooks Payroll validate SSN format (XXX-XX-XXXX) and routing number format (9 digits) on import. A redacted SSN fails format validation and causes an import error. A blank routing number field in a QuickBooks Payroll direct-deposit file is treated as an intentional blank and overwrites existing banking data.

Removal deletes the column entirely. Removal is appropriate when the recipient genuinely has no use for the column. It is not appropriate for pre-import staging tests, where the platform validator needs the column to be present and correctly formatted.

Format-preserving masking replaces the value with a substitute that retains the field's structure. The tool provides two techniques relevant to payroll columns:

• Substitution (for SSNs): generates a fully synthetic SSN in the same XXX-XX-XXXX format — different numbers, same structure. A real SSN 547-82-3901 becomes a synthetic SSN 219-45-7823. Each row gets a distinct synthetic value.
• FPE — Format-Preserving Encryption (for routing numbers and account numbers): replaces each digit with a randomly selected digit (0–9) and preserves non-digit characters such as hyphens. The digit count and structural layout are maintained; the specific digit values change. Use FPE for columns the tool does not auto-detect as SSN type.

The masked file passes platform format validators because the field structure is intact; the real identifying values are not present.

For payroll workflows that include pre-import staging tests — where you validate the import file structure in a test environment before the production run — format-preserving masking is the only approach that lets you use the masked file for staging validation.

---

The Reality: What an Unmasked Payroll Row Looks Like

Here is a representative row from an ADP Workforce Now payroll export (all values fictional):

EMP-10382,Johnson,Michael,547-82-3901,021000021,13857294016,3200.00,REG,80,Bi-Weekly

The columns are: Employee ID, Last Name, First Name, SSN, ABA Routing Number, Account Number, Salary, Earning Code, Hours, Pay Frequency.

After format-preserving masking of SSN, Routing Number, and Account Number, with Salary retained:

EMP-10382,Johnson,Michael,219-45-7823,073947123,98743021857,3200.00,REG,80,Bi-Weekly

The non-sensitive columns — Employee ID, name, salary, earning code, hours, pay frequency — are unchanged. The SSN is replaced with a Substitution-technique synthetic value in XXX-XX-XXXX format. The routing number and account number values are illustrative of FPE output — digit count and hyphen structure maintained, specific digit values replaced. An import validator examining this row sees correctly structured fields throughout. The external auditor receives salary and earning code data without SSNs or banking information.

---

What to Mask and What to Retain

Before configuring masking, identify which columns the recipient needs and which they do not.

The general rule: mask or remove any column the recipient does not need for the specific task. Minimum necessary access is a GDPR data minimization principle (Article 5(1)(c)) and a sound operational practice regardless of jurisdiction.

---

Step-by-Step Masking Workflow

Step 1 — Identify sensitive columns

Before loading the file, review the export schema and identify: SSN, routing number, account number, any columns containing home addresses or personal contact information. For payroll files with earning codes, note whether any codes identify health conditions — medical leave, disability, or short-term disability codes — these may require additional handling under GDPR Article 9.

Step 2 — Load the file into Data Masking

Open SplitForge Data Masking. Drop your payroll CSV. The file is read by the browser's File API and loaded into a Web Worker thread — no upload, no network transmission. Loading is instantaneous for typical payroll file sizes.

Step 3 — Configure SSN masking

Select the SSN column. In the technique dropdown, select Substitution — this is not the default. The tool auto-detects SSN columns and recommends Redaction, which produces partial output like XXX-XX-3901, not the fully synthetic value needed for staging validation. Substitution generates a complete synthetic SSN in XXX-XX-XXXX format for each row. Values are generated per-row — each masked SSN is distinct, preventing record correlation through repeated synthetic values.

Step 4 — Configure routing number masking

Select the ABA routing number column. The tool does not have a dedicated routing number type — routing numbers are detected under the account number type, whose default technique is Tokenization (random alphanumeric output, not format-preserving). For digit-preserving output, select the FPE technique in the technique dropdown. FPE replaces each digit with a randomly selected digit (0–9) and preserves hyphen structure; the digit count and structural layout are maintained.

Step 5 — Configure account number masking

Select the bank account number column. As with routing numbers, the default technique for account number columns is Tokenization — random alphanumeric output, not format-preserving. Select the FPE technique for digit-for-digit replacement that maintains the field's digit count and hyphen structure. Account numbers vary in length across banks; FPE preserves the length of each row's value.

Step 6 — Handle address and contact fields

For home address fields: remove the column if the recipient does not need geographic data. If some geographic granularity is needed (for regional analysis), generalize to ZIP prefix (first 3 digits of ZIP code) rather than retaining full address. For personal email and phone: remove unless the recipient has a legitimate need.

Step 7 — Preview and validate

Use the before/after preview to verify: SSN column shows synthetic XXX-XX-XXXX values (Substitution technique selected), routing number and account number columns show digit-replaced values with the original digit count and hyphen structure intact (FPE technique selected), salary column retains original values, earning codes are unchanged. Verify that no row contains a blank value in a column that should be masked — a blank in the routing number column in a masked file intended for import staging will fail validation or, in QuickBooks Payroll, silently overwrite existing banking data.

Step 8 — Export

Export the masked file via the browser's local download. No upload occurs during export. The masked file lands in your local downloads folder.

Step 9 — Name and separate from production

Rename the masked file immediately to distinguish it from the production file:

• Production: payroll-2026-Q2-PRODUCTION.csv
• Masked: payroll-2026-Q2-MASKED-review.csv

Never submit the masked file to a live platform import. Masked SSNs will not match existing employee records in update imports; masked routing numbers will corrupt direct deposit data if submitted to a live payroll run.

---

Masking for Different Sharing Scenarios

External auditor — salary equity or compliance review

Mask: SSN, routing number, account number, home address, personal email, personal phone. Retain: employee ID, name, job title, department, pay grade, salary, hire date, earning codes, pay frequency.

Include a cover note confirming that the file has been masked and does not contain SSNs or banking information — so the auditor does not attempt to use it for identity verification.

IT team — HRIS migration staging validation

Mask: SSN, routing number, account number. Retain: all structural columns needed for import validation — employee ID, all field types, earning codes, dates. The IT team needs to confirm the file structure is import-ready; they do not need real SSNs or routing numbers to do so. Format-preserving masked values let them run the same platform validation the production import would run.

Manager compensation review

Mask: SSN, routing number, account number, home address, personal contact. Consider masking or removing salary for managers who should see relative grades but not absolute figures. Retain: employee ID, name, department, job title, pay grade, percentage-change columns if the review is about changes rather than absolute values.

---

Maintaining the Production/Masked Separation

The most common masking error in payroll workflows is submitting a masked file to a production import. The consequences:

• Masked SSN submitted to ADP update import: ADP attempts to match employee records by SSN. Synthetic SSNs do not match existing records. Import either fails entirely or creates duplicate records with masked identifiers.
• Masked routing number submitted to QuickBooks Payroll direct deposit import: QuickBooks Payroll writes the synthetic routing number to the employee record. No error message. Direct deposit fails at the next payroll run.
• Masked account number submitted to any banking system: Account number corruption — the synthetic account number is written as the authoritative value.

Enforce the separation at the workflow level:

• Keep masked files in a separate folder (/payroll/masked/) from production exports (/payroll/production/)
• Include the masking date and reviewer in the filename (payroll-Q2-MASKED-auditor-review-20260523.csv)
• Document in your payroll SOP that masked files are not for live import use under any circumstances

---

FAQ