Bank Austria MobileBanking Security & Privacy Scorecard

by UniCredit Bank Austria AG · iOS

83
Overall trust score
Trustworthy
79
Security
92
Privacy

Data collection is minimal: Firebase analytics is fully disabled and FCM is used only for push notifications. Third-party services include ThreatMark for fraud detection, Dynatrace for performance monitoring, and Gini for document scanning. Fraud detection data is routed through Bank Austria's own servers rather than sent directly to third parties.

Best for

Bank Austria customers managing accounts on mobile

Findings

  • 0 critical
  • 2 high
  • 5 medium
  • 4 low
  • 5 info

2 issues identified across security and privacy analysis.

Top security issues

  • Hardcoded Gini Banking API OAuth Client Secret in App Bundle
  • directLinkNavigation Deep Link Allows Arbitrary URL Open via InAppBrowser
  • Banking Session Cookies Persisted to localStorage via Cordova HTTP Plugin

Top privacy issues

  • Dynatrace Instruments Authenticated Banking Sessions with Identity-Linked Data Collection
  • ThreatMark Fraud Detection SDK Collects Precise Location with Vague Disclosure
  • Cordova Native Bridges Lack Confirmed URL-Layer Origin Restriction

Full analysis

Bank Austria Mobile Banking

What This Means for You

Crafted links from other apps or websites can silently pre-fill your payment forms with incorrect amounts or account numbers before you tap confirm, and a banking service password stored openly in the app's code exposes a back-end processing account to anyone who downloads the app file.

Recommendation: Use With Caution

Critical vulnerability: hardcoded banking API credentials exposed in app. Multiple deep-link and session handling flaws present. Bank Austria users should monitor accounts closely and apply recommended security measures immediately.

Best For: Bank Austria customers needing mobile banking with active fraud protection and minimal ad tracking

Key Findings

Data Security - 4 findings (1 high, 1 medium, 1 low, 1 info)

Network Security - 4 findings (1 medium, 1 low, 2 info)

Code Safety - 3 findings (2 medium, 1 low)

Privacy - 4 findings (1 medium, 1 low, 2 info)

Privacy Concerns

What Data is Collected

  • Personal information: user identity linked to session activity and app interactions
  • Device information: device ID, location (precise and coarse), crash data
  • Usage data: banking screen navigation, login events, payment signing activity, performance metrics
  • Location data: precise and coarse location collected by fraud detection service

Third-Party Data Sharing

The following third parties may receive your data:

  • Dynatrace - performance analytics and session monitoring, linked to your identity, transmitted to US-hosted servers
  • ThreatMark - fraud detection and behavioral risk scoring, proxied through Bank Austria's own servers
  • Firebase (Google) - push notification delivery only; advertising analytics are explicitly disabled
  • Gini - banking document processing service (check deposits, document scanning)

Understanding the Scores

Security: 79/100
Privacy: 92/100

Security Breakdown

  • Data Security: 77/100 - A banking service password is stored in the app bundle; session cookies are kept in standard browser storage rather than protected secure storage
  • Network Security: 89/100 - All production connections use HTTPS with proper transport security; one help page link uses unencrypted HTTP and one deep link can open arbitrary external websites inside the app
  • Code Safety: 86/100 - Payment-related links can be crafted by external apps to pre-fill transfer details; native device capabilities lack confirmed origin restrictions in the web layer

Privacy Breakdown

  • Data Collection: 92/100 - Data collection is minimal for a banking app; no advertising identifiers or ad networks present
  • Data Sharing: 92/100 - Third-party data sharing is limited; the main concern is identity-linked session analytics sent to Dynatrace's US infrastructure
  • User Control: 94/100 - Users retain strong control; Firebase advertising tracking is fully disabled and fraud detection data routes through Bank Austria's own servers

Positive Security Features

  • Fraud detection service uses active connection verification to its backend, preventing a compromised network from substituting fraudulent responses
  • All sensitive authentication factors (login tokens, one-time passwords, biometric keys) are stored exclusively in the iOS Keychain with device-only binding and no iCloud backup
  • Firebase advertising analytics are explicitly and fully disabled at both code and configuration level; Firebase is used solely for push notifications
  • All production server connections use HTTPS with no cleartext exceptions for any external domain
  • Fraud detection telemetry is routed through Bank Austria's own API gateway rather than sent directly to third-party servers

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

  1. Clearer Location Data Disclosure
    The location permission prompt states only "to increase your security" without explaining that location is used for fraud risk scoring and behavioral profiling. A more specific explanation would better meet transparency requirements under GDPR Article 13.

  2. Identity-Linked Analytics Consent
    Session analytics linked to authenticated user identity are transmitted to a US-based third-party service. Providing users with clear disclosure and opt-out options for this data collection would strengthen compliance.

Security Enhancements

  1. Remove Exposed Banking Service Password
    The password for the document processing service should be retrieved at runtime from a secure server rather than stored inside the app file, where it is accessible to anyone who downloads the app.

  2. Restrict External Link Handling
    Deep links that can open external websites inside the app's interface should validate destinations against an approved list before opening, preventing them from being used to display deceptive pages that mimic Bank Austria.

  3. Protect Session Information
    Banking session cookies managed by the HTTP plugin are currently stored in standard browser storage. Moving this to the iOS Keychain would prevent extraction on compromised devices.

Technical Context

App Type: Mobile banking - high sensitivity, financial data
Classes Analyzed: 458
Third-Party Services: 13 identified (Dynatrace, ThreatMark, AuthenticVisionSDK, GiniBankSDK, GiniCaptureSDK, GiniBankAPILibrary, PRNewAppSDK, GlobalSecLib, SecLibCore, IONGeolocationLib, IONFilesystemLib, uchttpclientnative, Firebase FCM)
Context Tags: financial, sensitivedata, location, banking

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Bank Austria / UniCredit Group
Version: 9.8.1 (Build 90801503)
Analysis Date: 2026-05-01
Package: at.bankaustria.mobile

Analysis Limitations

  • Static analysis only (code review without running the app)
  • Based on IPA version 9.8.1 analyzed on 2026-05-01
  • May not reflect server-side security controls
  • Cannot detect all runtime behaviors

Versions & scan history

ScanDateOverall score
#3 (current) 83/100