CITT

    Scan results

    Bank of Ireland Mobile Banking

    Android

    Manage your Bank of Ireland accounts on the go. Check balances, pay other BoI customers, apply for mortgages and loans, manage cards with spend alerts, set up standing orders, view statements, and access insurance products. Requires Android 8.0+.

    CITT SCORE
    30
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Bank of Ireland customers who need mobile access

    Not For: You share your device with others

    What It Means For You

    Usage patterns and app behavior are tracked by Firebase Analytics and AppDynamics. Push notification data flows through ExtremePush, a third-party service outside the bank. Financial data may not be fully protected during transmission and on the device.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (17)

    Data Security

    5 total
    2 High
    3 Medium

    Network Security

    3 total
    2 High
    1 Medium

    Code Security

    4 total
    1 Critical
    1 High
    2 Medium

    Privacy

    5 total
    4 Critical
    1 High

    Third-Party Services

    ExtremePush, AppDynamics (Cisco), Firebase Analytics, HID Global ActivCastle SDK, Google Tink

    Security Strengths

    • ✓Hardware-backed Android Keystore with RSA-2048 encryption
    • ✓Certificate pinning for banking APIs
    • ✓Backup protection disabled (allowBackup=false)
    • ✓Root detection implemented (RootBeer library)
    • ✓EncryptedSharedPreferences for sensitive data
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    banking
    sensitive data
    location
    ads
    analytics

    Package

    com.bankofireland.mobilebanking

    Version

    3.4.4

    Analysis Date

    Jan 28, 2026

    Classes Analyzed

    14,544

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 5 findings (2 high, 3 medium)

    Network Security - 3 findings (2 high, 1 medium)

    Code Safety - 0 findings

    Privacy - 5 findings (4 critical, 1 high)

    Privacy Concerns

    What Data is Collected

    Firebase Analytics and AppDynamics collect behavioral and session data from user interactions with the app. This includes which features are used, how long users spend in the app, and navigation patterns within banking sessions.

    Third-Party Data Sharing

    Data is shared with the following third-party services:

    • ExtremePush - Receives push notification data and device identifiers outside the bank's own infrastructure
    • AppDynamics (Cisco) - Receives performance and behavioral telemetry gathered during user sessions
    • Firebase Analytics - Receives usage and navigation data from user time in the app
    • HID Global ActivCastle SDK - Integrated for identity-related functions within the app
    • Google Tink - Used for internal data protection operations

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy25/100
    Data Security40/100
    Network Security45/100
    Code Safety40/100
    Data Collection20/100
    Data Sharing30/100
    User Control25/100

    Positive Security Features

    • No standout security protections were identified in this version of the app.

    Areas for Improvement

    • Multiple third-party analytics providers receive behavioral data from banking sessions, reducing user control over where financial activity information goes.
    • Data transmitted between the device and external services travels with less protection than expected for financial applications.
    • The app provides limited options for users to control or restrict data collection, leaving privacy settings largely outside user control.

    About This Analysis

    Independent automated analysis of the app's code and configuration as of the scan date. Results reflect the state of the app at the version listed below.

    App Details

    • App Name: Bank of Ireland Mobile Banking
    • Package ID: com.bankofireland.mobilebanking
    • Version: 3.4.4
    • Scan Date: 2026-01-28
    • Developer: Bank of Ireland

    Right of Reply

    Developer not yet contacted