Masking PII in Fedwire Files
Abstract: This article discusses the content and obfuscation of historically used banking industry files using the IRI FieldShield data masking tool on proprietary tag-based formats (e.g., {1500}, {4200}. For Fedwire files using newer ISO 20022 XML formats, use IRI DarkShield.
Fedwire files are structured electronic messages that conform to the Federal Reserve’s required formats, enabling payments to be processed through the Fedwire Funds Service.1
These files are not relatively flat, however, because their format can vary depending on the content; e.g,
1. Header Information
- Sender (financial institution)
- Receiver
- Message type (e.g., funds transfer)
2. Payment Details
- Amount
- Sender’s account information
- Receiver’s account information
- Intermediate financial institutions (if any)
3. Additional Reference Data
- Originator information
- Beneficiary information
- Reference numbers
- Purpose of payment
Corporate or bank treasury systems can also generate files containing multiple Fedwire transfers, and upload or send them to a bank or FedLine system. Banks using FedLine services exchange Fedwire messages via encrypted file transfers (e.g., via FedLine Direct) or message-based protocols.
Following is a basic Fedwire file snippet containing some of the information described above, albeit already encoded for privacy when provided to IRI (but see masked result below):
D0000900110000000018300000020000WIREIN JVRIYAX Y DPOVTQVEC OVXSAO RW PJM (NWJJYP BRUZPIZO D0000900110000000018300001750200WIREIN HMDMLUC9HKJT CSS LVJV YES 2616 TLNXLE BS QOR 20 D0000900110000000018300000150000WIREIN UUP E IYNB VDSSQC; VWH.YPV UEQS XZWWEA IDWL ITFHPZI D0000900110000000018300017624287WIREIN AMWQUZH JALFS ZB QMULBB89128950; ZSL 959201VT EFM C6 D0000900110000000018300000935781WIREIN WNJVP WIIKMCFL OK VYAEO D0000900110000000016300000100000WIREOUT Z A ZSQSCEWOKU 20241213B4LB4U1C000002 D0000000009800240711400000210000WIREOUT PracqhjFdfvkiotXmanvd.20241213B4LB4U1C000003 D0000900110000000016300000210000WIREOUT PracqhjFdfvkiotXmanvd.20241213B4LB4U1C000003 D0000000009001792511400001682884WIREOUT Ybtqatnkp Jrstudjk Prh20241213B4LB4U1C000004 D0000000009601330411200055267563WIREOUT WYHPJU XCPTEC AUJHA 20241213B4LB4U1C000005
To define and mask this data, you could create (by hand, or via wizard in the IRI Workbench GUI for FieldShield built on Eclipse), a job script in the domain-specific “SortCL” 4GL, like this:
/INFILE=ALT_UPACH.TXT /PROCESS=RECORD # WIREIN RECORDS /FIELD=(WIREIN_SECTION1,POSITION=1,SIZE=32,TYPE=ASCII) /FIELD=(WIREIN_FIELD, POSITION=33, SIZE=6)#This says WIREIN /FIELD=(WIREIN_NAME,POSITION=40,SIZE=53,TYPE=ASCII) # WIREOUT RECORDS /FIELD=(WIREOUT_SECTION1,POSITION=1,SIZE=32,TYPE=ASCII) /FIELD=(WIREOUT_FIELD, POSITION=33, SIZE=7)# This says WIREOUT /FIELD=(WIREOUT_NAME, POSITION=41,SIZE=22, TYPE=ASCII) /FIELD=(WIREOUT_LAST, POSITION=63,SIZE=30, TYPE=ASCII) /REPORT /OUTFILE=ALT_UPACH.out /PROCESS=RECORD /INCLUDE WHERE WIREIN_FIELD == "WIREIN" /FIELD=(WIREIN_SECTION1, POSITION=1, SIZE=32, TYPE=ASCII) /FIELD=(WIREIN_FIELD, POSITION=33, SIZE=6, TYPE=ASCII) /FIELD=(ENC_FP_WIREIN_NAME=enc_fp_aes256_alphanum(WIREIN_NAME), POSITION=40, SIZE=53, TYPE=ASCII) /OUTFILE=LT_UPACH.out /PROCESS=RECORD /INCLUDE WHERE WIREOUT_FIELD == "WIREOUT" /FIELD=(WIREOUT_SECTION1, POSITION=1, SIZE=32, TYPE=ASCII) /FIELD=(WIREOUT_FIELD, POSITION=33, SIZE=7, TYPE=ASCII) /FIELD=(ENC_FP_WIREOUT_NAME= enc_fp_aes256_alphanum(WIREOUT_NAME), POSITION=41, SIZE=22, TYPE=ASCII) /FIELD=(WIREOUT_LAST, POSITION=63, SIZE=30, TYPE=ASCII)
Notice that there are two output files with the same name to cover both types of record formats (“wirein” and “wireout”). To mask the transaction sender and recipient names, a deterministic masking (format-preserving encryption) function was applied to the name fields.
After running this FieldShield job from the GUI, command line, or job scheduler, the masked output file could look like this, noting the same character casing and spacing in the name field:
D0000900110000000018300000020000WIREIN EURFRBE M QKBGLVQHN MWRVON OD QMJ (YNCVXW MJUKAHXW D0000900110000000018300001750200WIREIN FMOOUKY0XVHK RHL HKQV DJM 3298 BKOCVG LX QLF 23 D0000900110000000018300000150000WIREIN MHP V IUEP OMFEHF; QTS.ATN KXEA XCJVYP GWDM SSALUEH D0000900110000000018300017624287WIREIN BKVCIDT RMXZX VE BNMOCV14312813; BYA 874389WN EBU Y4 D0000900110000000018300000935781WIREIN YFGNI SOWPUXVI AO GSKPQ D0000900110000000016300000100000WIREOUT S T ZCEUDIPPLY 20241213B4LB4U1C000002 D0000000009800240711400000210000WIREOUT GqaptyvDyedqhtxQjiqjv.20241213B4LB4U1C000003 D0000900110000000016300000210000WIREOUT GqaptyvDyedqhtxQjiqjv.20241213B4LB4U1C000003 D0000000009001792511400001682884WIREOUT Diltmcick Zrdkjskn Duo20241213B4LB4U1C000004 D0000000009601330411200055267563WIREOUT IFZPNS MCZVLO QDOJH 20241213B4LB4U1C000005
There are many other data masking functions available to FieldShield users, and all can be centralized as data class rules to preserve data integrity across a range of data sources.
End Note: Please email fieldshield@iri.com with any questions, see this article on masking data in ACH files, and this article for more data masking use cases in the BFSI industry.
