CITT

    Scan results

    Amex Payment Test Emulator

    Android

    This mobile application enables Level 3 POS Pre-Certification testing activities for American Express contactless cards and Consumer Presented QR (CPQR) code. For Merchants, Processors, Acquirers, Point of Sale Vendors, and related payment professionals. Using test data only.

    CITT SCORE
    45
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Internal testers with controlled device access

    Not For: Personal or everyday payment use

    What It Means For You

    Payment data is handled with several serious unresolved weaknesses in how it is stored on the device. Sensitive information entered may not be adequately protected while at rest on the phone. This app is intended for internal testing, not personal financial transactions.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (12)

    Data Security

    5 total
    3 Critical
    2 High

    Code Security

    6 total
    2 Critical
    2 Medium
    2 Low

    Privacy

    1 total
    1 Medium

    Security Strengths

    • ✓Zero analytics or tracking SDKs
    • ✓No network connectivity (fully offline)
    • ✓SQL injection protection via parameterized queries
    • ✓Android backup disabled (allowBackup=false)
    • ✓Release build properly configured (not debuggable)
    • ✓No WebView implementation
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    testing tool
    pos certification
    emv payment
    contactless
    offline
    test data only

    Package

    com.americanexpress.android.testemulator

    Version

    1.0.39 (Build 15)

    Analysis Date

    Feb 3, 2026

    Classes Analyzed

    82

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 5 findings (3 critical, 2 high)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 1 finding (1 medium)

    Privacy Concerns

    What Data is Collected

    User activity within the app stays on the device and is not forwarded to external analytics platforms.

    Third-Party Data Sharing

    User information is not shared with outside advertising or analytics companies.

    Understanding the Scores

    • Security: 35/100
    • Privacy: 55/100
    • Data Security: 25/100
    • Network Security: 100/100
    • Code Safety: 60/100
    • Data Collection: 100/100
    • Data Sharing: 100/100
    • User Control: 100/100

    Positive Security Features

    • Network communications are properly secured
    • User activity is not forwarded to external advertising or analytics services
    • User data is not shared with third-party companies
    • Users retain full control over their personal data

    Areas for Improvement

    • How payment information is stored on the device needs significant attention, as sensitive data may be accessible if the device is ever compromised.
    • Multiple serious data storage issues put information entered at risk while it remains on the phone.
    • This app should be restricted to controlled test environments and never used with real payment information.

    About This Analysis

    This scorecard reflects the security and privacy posture of the app at the time of the scan, based on analysis of the app's code and configuration.

    App Details

    • App Name: Amex Payment Test Emulator
    • Package ID: com.americanexpress.android.testemulator
    • Version: 1.0.39 (Build 15)
    • Scan Date: 2026-02-03

    Right of Reply

    Developer not yet contacted