CITT

    Scan results

    PostFinance App

    Android

    PostFinance App is a comprehensive banking platform for managing accounts, payments, and investments. Features include account monitoring, QR-bill scanning, secure biometric access, and payment services including Google Pay and PostFinance Pay.

    CITT SCORE
    52
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: PostFinance customers comfortable with usage analytics

    What It Means For You

    User devices are fingerprinted by ThreatMetrix for fraud detection. App performance and crash data are shared with Firebase Crashlytics and Splunk. User financial data may not be fully protected within the app, a consideration given the sensitivity of the banking information this app manages.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (30)

    Data Security

    13 total
    2 Critical
    4 High
    5 Medium
    2 Low

    Network Security

    2 total
    2 Low

    Code Security

    8 total
    1 Critical
    1 High
    4 Medium
    2 Low

    Privacy

    7 total
    1 Critical
    2 High
    3 Medium
    1 Low

    Third-Party Services

    ThreatMetrix, Splunk RUM, Firebase Crashlytics, Unblu, Swissquote, Google Play Services, Google Maps, Samsung Pay, TWINT, OkHttp, Retrofit

    Security Strengths

    • ✓Hardware-backed cryptographic keys (Android Keystore with TEE)
    • ✓Modern encryption algorithms (AES-256-GCM, EC secp256r1)
    • ✓HTTPS-only enforcement with certificate pinning
    • ✓Heavy code obfuscation (ProGuard/R8)
    • ✓FIDO2/WebAuthn phishing-resistant authentication
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    banking
    sensitive data
    authentication
    biometric
    payments
    third party tracking
    device fingerprinting

    Package

    ch.postfinance.android

    Version

    6.0.0 (1764922547)

    Analysis Date

    Feb 2, 2026

    Classes Analyzed

    61,915

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 13 findings (2 critical, 4 high, 5 medium, 2 low)

    Network Security - 2 findings (2 low)

    Code Safety - 0 findings

    Privacy - 7 findings (1 critical, 2 high, 3 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    The app collects device identifiers, behavioral signals, and usage patterns. ThreatMetrix builds a detailed fingerprint of user devices to identify users across sessions for fraud detection purposes. Firebase Crashlytics gathers diagnostic information about how the app performs on user devices. Splunk RUM collects real-time interaction data to monitor app behaviour.

    Third-Party Data Sharing

    User data is shared with the following third-party services:

    • ThreatMetrix - Device fingerprinting and fraud detection
    • Splunk RUM - Real user monitoring and performance telemetry
    • Firebase Crashlytics - Crash reporting and diagnostics
    • Unblu - Customer engagement and co-browsing
    • Swissquote - Financial services integration
    • Google Play Services - Core Android platform services
    • Google Maps - Location and mapping features
    • Samsung Pay - Payment processing
    • TWINT - Swiss mobile payment integration
    • OkHttp / Retrofit - Network communication libraries

    Understanding the Scores

    • Security: 55/100
    • Privacy: 50/100
    • Data Security: 45/100
    • Network Security: 92/100
    • Code Safety: 60/100
    • Data Collection: 55/100
    • Data Sharing: 58/100
    • User Control: 52/100

    Positive Security Features

    • No strong security controls were identified in this version of the app.

    Areas for Improvement

    • User financial data may not be fully protected within the app, particularly given the sensitivity of what this app manages.
    • A high number of third-party services have access to user device data and usage patterns, with limited transparency about what each collects and why.
    • The ability to control or limit data collection and analytics sharing is restricted, making it difficult to reduce exposure for users who wish to.

    About This Analysis

    App Details

    • App: PostFinance App
    • Package: ch.postfinance.android
    • Version: 6.0.0 (1764922547)
    • Scan Date: 2026-02-02

    Right of Reply

    Developer not yet contacted