Why mask personal data instead of refusing the message
Refusing a comment because it contains a phone number throws away everything else the person wrote. On a marketplace or a support chat that is almost always the wrong trade: the message is fine, one part of it should not be public. Masking that part keeps the conversation and loses the number, and the author does not have to write it all again.
What it finds
Email addresses, including the forms people use because they know a plain one gets stripped: name (at) domain (dot) com, [at] and [dot], arroba and punto. Phone numbers, as runs of at least nine digits with or without separators and a country code. Bank accounts as IBAN, payment card numbers, Spanish DNI and NIE numbers, the French NIR, the Italian codice fiscale, the Dutch BSN, the Portuguese NIF and the German Steuer-ID, and Spanish plates. Each one is a signal under personal_data with a reason in a sentence, and the disguised email adds a second one under evasion.
How a number is checked before it is reported
A long number is not personal data on its own; most of them are order references, tracking codes and invoice numbers. So everything here with a check digit is verified. An IBAN is rearranged, its letters turned into numbers, and must leave a remainder of one modulo 97. A card must pass Luhn and start with a prefix a real issuer uses, which keeps a phone number with the right length from passing one time in ten. A DNI or NIE must end in the letter its number gives modulo 23, and the other national numbers carry their own check digit or letter, which is verified the same way. A plate has no check digit, so it scores lower than the rest.
What redact returns
With redact: true, the answer carries redacted: the text you sent with each finding replaced by [redacted]. The positions come from detectors that matched the raw text, so the mask lands on the right words. Overlapping findings are merged before anything is replaced, because an IBAN contains a run of digits the phone matcher also sees, and masking one while skipping the other would leave half a bank account published. Replacement runs from right to left, since every mask changes the length of the string. Positions are never capped: a message with forty addresses comes back with forty masks.
Evidence that does not repeat the number
The signal shows what was found, so a moderator can see why a message was held. Card numbers are quoted with only their last four digits and phone numbers with the middle taken out, because a detector whose job is to notice a number that should not be public must not be the thing that copies it into logs and API responses.
