BT Pay Security & Privacy Scorecard

BT Pay - Banca Transilvania

What This Means for You

Your health and activity data may be used to target you with commercial offers, and your in-app navigation behavior is tracked automatically to an analytics system on every launch without asking your permission first.

Recommendation: Use With Caution

Strong encryption and biometric authentication protect your transaction signing keys, but a network-level weakness in the signing flow and privacy concerns around health data used for marketing targeting warrant caution. BT bank customers who need mobile banking access can use the app, but should be aware of the analytics and health data practices before granting permissions.

Best For: BT bank customers who need full-featured mobile banking and accept analytics tracking on bank-controlled infrastructure

Key Findings

Data Security - 4 findings (3 medium, 1 info)

Network Security - 2 findings (1 high, 1 info)

Code Safety - 6 findings (2 medium, 2 low, 2 info)

Privacy - 3 findings (2 medium, 1 info)

Privacy Concerns

What Data is Collected

• Personal information: name, email, phone number, Romanian national identification number (CNP equivalent to a Social Security Number)
• Financial data: account numbers, transaction history, insurance policy details, vehicle information
• Health and activity data: step count, exercise time, walking distance (used for commercial offer targeting)
• Behavioral data: in-app screen interactions and user actions linked to your identity
• Device information: device identifiers used for analytics and fraud detection

Third-Party Data Sharing

The following third parties may receive your data:

• Dynatrace - behavioral session analytics (routed to bank-controlled infrastructure, not shared externally)
• Firebase Crashlytics (Google) - app crash reports and diagnostics
• Firebase Cloud Messaging (Google) - push notification delivery
• Onfido - identity verification for onboarding
• ThreatFabric - fraud detection and device risk assessment
• Evam - marketing personalization and targeting

Understanding the Scores

Security: 83/100
Privacy: 83/100

Security Breakdown

• Data Security: 79/100 - Strong default file encryption, but some files may use weaker protection settings and sensitive Romanian insurance data is stored without an additional encryption layer
• Network Security: 83/100 - Core banking API connections are well-protected, but the transaction signing screen loads from a domain that does not share those same protections
• Code Safety: 88/100 - Biometric-gated Secure Enclave keys are a strong foundation, offset by non-production server domains included in the production app and a generic custom URL scheme that other apps could invoke

Privacy Breakdown

• Data Collection: 84/100 - Health data collected for commercial profiling and automatic behavioral tracking without opt-in lower an otherwise reasonable collection scope
• Data Sharing: 100/100 - Behavioral analytics stay on bank-controlled servers; Firebase used only for crash reporting, messaging, and installation tracking
• User Control: 88/100 - Biometric authentication and clear permission requests in most areas, but session tracking begins without a user consent gate

Positive Security Features

• Transaction-signing private keys are stored in the device's Secure Enclave hardware and require Face ID or Touch ID for every signing operation, meeting strong authentication standards for digital payments
• All app files are encrypted by default using the strongest iOS file protection class, making data inaccessible while the device is locked
• Core banking API connections are protected with multiple backup public key hashes per endpoint, and all network traffic uses HTTPS exclusively with no plain-text connections found
• Firebase Analytics is intentionally disabled in the production build, preventing Google from receiving behavioral tracking data
• The app's stored secrets are scoped to a single, app-specific container with no sharing across other applications
• Biometric authentication is integrated throughout sensitive flows including account access and payment authorization

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Health Data Consent for Marketing Use
   Health and activity data is a special category under EU data protection law, requiring explicit, separate consent when used for commercial targeting. The app should present a clear, standalone consent request explaining that health data will be used to personalize offers, separate from the general app permission request.

2. Analytics Opt-In Before Data Collection
   Behavioral session data collection begins automatically on launch. Adding an opt-in consent step before analytics begin would align with EU data protection requirements and give users meaningful control over data that reveals their financial interests and in-app behavior.

3. Data Minimization for Health Write Access
   The app requests permission to write health data back to the device, but no user-facing feature requires this. Removing the write permission request would reduce the app's data footprint and better align with the principle of collecting only what is necessary.

Security Enhancements

1. Extend Network Protection to the Document Signing Flow
   The screen used for signing contracts and transactions loads content from a domain that does not have the same network-level protections as the main banking API. Applying equivalent protections to this domain would prevent a network attacker from substituting fraudulent signing content.

2. Remove Non-Production Servers from Production App
   The production app is configured to trust deep links from test and staging servers, which typically have weaker security controls than production. Removing these non-production entries from the released app would eliminate an unnecessary trust boundary.

3. Audit Backup-Eligible Stored Secrets
   Some stored authentication data uses a setting that allows it to be included in iCloud backups and restored to other devices. Switching these items to device-bound storage would prevent them from being replayed from a backup if an Apple account were compromised.

4. Remove Test Data Files from Release Builds
   Three development data files containing simulated account schemas, transaction formats, and internal infrastructure details are bundled into the production app. These files should be excluded from release builds as they expose internal API structure.

Technical Context

App Type: Mobile banking application - high sensitivity financial platform with PSD2 payment authentication
Classes Analyzed: iOS binary symbols, headers, plists, and framework metadata analyzed
Third-Party Services: 26 third-party frameworks and SDKs identified
Context Tags: financial, sensitive_data, health, location, biometric, gdpr, psd2

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Banca Transilvania
Version: 4.7.1 (build 38965)
Analysis Date: 2026-04-17
Package: com.bancatransilvania.btpay

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on iOS IPA version 4.7.1 analyzed on 2026-04-17
• May not reflect server-side security controls
• Cannot detect all runtime behaviors