"Mask SSN" does not mask SSNs on Form 5471 Schedule O p1 and Schedule P p4 (TY2025)

Posting this publicly because any firm filing a Form 5471 is likely shipping client SSNs in documents they believe are masked, and has no way of knowing. Would appreciate a moderator escalating this to the product team.

The problem

In ProConnect Tax Online (TY2025, 1040), the "Mask SSN and add watermark" print option does not mask the identifying number on two Form 5471 schedules:

• Schedule O, page 1 — Part II, Section A, the "Name, address, and identifying number of shareholder(s) filing this schedule" block. On a joint return this exposes both spouses’ SSNs.
• Schedule P, page 4 — the page-header "Identifying number" field.

Every other identifying-number field in the same PDF masks correctly to *********.

It is field-level, not page-level. On Schedule O page 1, Section B masks correctly while Section A — three inches above it, same page — does not.

Likely cause

The two failing fields emit the number as nine bare digits with no separators. The masking routine appears to match only the hyphenated NNN-NN-NNNN format, so those fields pass straight through. Fields emitting the hyphenated form on the same page mask fine.

How to check your own files

1. Open a 1040 with a Form 5471 where both spouses are U.S. shareholders (Category 3/4/5), with Schedules O and P generated.
2. File return → Print → Partial print to PDF → select Form 5471.
3. Print options → "Mask SSN and add watermark" ON → any watermark → Create PDF → Download PDF.
4. Look at Schedule O page 1, Part II Section A and Schedule P page 4 header.

Expected: *********. Actual: the full nine-digit SSN in plaintext. The digits are live text in the PDF, not just visible — they select and copy.

The obvious verification does not catch this. If you search the PDF for the NNN-NN-NNNN pattern to confirm your masking worked, you get a clean result on a leaking file. We did exactly that and it passed. It was only caught by rasterising a page and looking at it. To check programmatically, search for a bare nine-digit run instead, and exclude amounts — large dollar figures can also present as nine consecutive digits.

Why it matters

The masked print is what we hand to clients, upload to portals, and email to third parties. It carries a watermark and masks everywhere else, so it presents as safe to distribute. There is no diagnostic, warning, or UI indication that two fields are unredacted. A single 93-page print in our office exposed two individuals’ SSNs across six pages.

Workaround

Post-process every masked print to remove bare nine-digit runs using true PDF redaction — removing the text, not drawing a box over it. A filled rectangle leaves the digits extractable underneath. This is a manual per-print step and is easy to forget, which is why we are asking for a fix at source.

What we are asking

1. Extend the masking routine to match unformatted nine-digit identifying numbers, not only the hyphenated form.
2. Confirm whether other forms emit identifying numbers unformatted and share the same gap. We have only audited Form 5471.
3. Confirm whether prior tax-year modules are affected, so firms can assess whether already-distributed client copies need to be recalled.

Happy to provide a redacted sample PDF or work through it with an engineer through a private channel.