Bank account masker

Detection is checksum-gated, so a random 16-digit run is not a card until Luhn passes, and a letter-digit blob is not an IBAN until the mod 97 check passes. UK sort codes, Indian IFSC codes, and UPI ids have no public checksum, so they match on shape alone, which means a code-like string that is not really a code can be masked by mistake. That is the safe direction: masking something that was not an identifier is harmless, while leaving a real one visible is not. The account detector stays off by default because any bare digit run qualifies, order numbers included. Masking hides the number from a casual reader; it does not encrypt anything, and a determined party who already knows the account can still guess the last four digits you left visible.