IBKR Mobile Security & Privacy Scorecard

IBKR Mobile

What This Means for You

Your login session data is stored using an encryption key that is fixed inside the app itself, meaning anyone who gains access to your device's storage could potentially read it. Your account balances, trade details, and financial screens are also not blocked from appearing in automatic screenshot backups or the Android app-switcher preview.

Recommendation: Acceptable

Acceptable for active IBKR traders using standard, unmodified devices. A hardcoded encryption key and missing screenshot protection may expose login session data and account information if the device is compromised.

Best For: Active IBKR traders on standard devices who trust the platform's server-side security

Key Findings

Data Security - 1 finding (1 high)

Network Security - 2 findings (1 medium, 1 low)

Code Safety - 2 findings (1 medium, 1 low)

Privacy - 2 findings (2 medium)

Privacy Concerns

What Data is Collected

• Account and financial information: shared with Interactive Brokers servers to support trading, account management, and order execution
• Device information and app usage data: sent to Firebase Analytics and Firebase Crashlytics for performance monitoring
• Location data: may be collected per the app's Play Store data safety declaration
• Camera images for cheque deposit and identity scanning: accessed on your device and processed locally; this data stays on your device

Third-Party Data Sharing

The following third parties may receive your data:

• Firebase Analytics - app usage and behavior analytics
• Firebase Crashlytics - crash and error reporting
• Firebase Messaging - push notification delivery
• Google Play Services - authentication and device services
• Plaid - financial account linking for funding your IBKR account
• Amazon Device Messaging - push notification delivery
• TradingView - market data and charting

Understanding the Scores

Security: 76/100
Privacy: 85/100

Security Breakdown

• Data Security: 60/100 - Login session data is protected with an encryption key embedded in the app itself, which weakens the protection if a device's storage is accessed without authorization.
• Network Security: 87/100 - All primary trading and market data traffic uses encrypted connections, and most authentication flows are protected with verified link handling.
• Code Safety: 90/100 - Code-level protections are strong across the vast majority of the app's components, with secure patterns applied throughout the main application logic.

Privacy Breakdown

• Data Collection: 94/100 - The app limits data collection to what is needed for trading and account services, with camera-based document scanning performed entirely on your device.
• Data Sharing: 95/100 - Third-party data sharing is limited to core infrastructure and service providers, with no evidence of advertising networks or behavioral profiling partners.
• User Control: 95/100 - You can request account data deletion through Interactive Brokers' privacy policy, and the app provides clear account management controls.

Positive Security Features

• Biometric authentication is backed by the device's secure hardware enclave, keeping biometric data protected even if the app itself is compromised
• Verified link handling correctly protects all primary account authentication flows from interception by other apps
• All trading, market data, and account communications use encrypted connections
• Cheque deposit scanning and QR code processing are performed entirely on your device without sending images to external servers

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Screenshot and Screen Recording Protection
   Enabling screen protection across all financial screens would prevent account balances, portfolio holdings, order confirmations, and authentication screens from appearing in photo backups, app-switcher previews, or being captured by screen-monitoring software.

2. Financial Document Storage Location
   Downloaded financial documents, including trade confirmations and cost impact summaries, are saved to the shared Downloads folder where other apps can access them. Saving these to app-private storage would better protect sensitive financial records.

Security Enhancements

1. Encryption Key Management
   Login session data is currently protected with a fixed encryption key built into the app. Migrating to hardware-backed key storage would ensure these protected values cannot be recovered even if device storage is directly accessed.

2. Authentication Callback Hardening
   Two-factor authentication and password reset callbacks use custom URL schemes that could be registered by other apps on the device. Migrating these to verified App Links would provide stronger protection for the authentication flow.

3. Debug Code Removal
   A disabled code path that can bypass encrypted connection validation ships in the production app. Removing it entirely would reduce the potential attack surface, even though it is off by default and requires server-side activation.

Technical Context

App Type: Financial trading application, high-sensitivity data
Classes Analyzed: 12,750
Third-Party Services: 14
Context Tags: financial, sensitive_data

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Interactive Brokers Group, Inc.
Version: 8.4.922 (versionCode 1922)
Analysis Date: 2026-06-13
Package: atws.app

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 8.4.922 analyzed on 2026-06-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors