BBVA Perú | Banca Móvil Security & Privacy Scorecard
Android
App usage and behavior is analyzed by BioCatch for fraud detection and shared with AppsFlyer and Firebase for analytics and marketing. Salesforce Marketing Cloud receives user data to power targeted communications. User data travels with less protection than expected when connecting to the bank.
Best for
BBVA Peru customers who need mobile banking access
Findings
- 2 critical
- 2 high
- 6 medium
- 3 low
- 3 info
1 issue identified across security and privacy analysis.
Top security issues
- Cleartext Traffic Explicitly Enabled in Banking Application
- Unencrypted Payment Database (Redsys SDK)
- Test Activity Exported in Production Build
Top privacy issues
- Advertising ID Collection in Banking Application
- Location Tracking for Marketing Purposes
- AppsFlyer Attribution Without Pre-Consent Gating
Full analysis
BBVA Perú | Banca Móvil
What This Means for You
App usage and behavior is analyzed by BioCatch for fraud detection and shared with AppsFlyer and Firebase for analytics and marketing. Salesforce Marketing Cloud receives user data to power targeted communications. User data travels with less protection than expected when connecting to the bank.
Recommendation: Use With Caution
Best For: BBVA Peru customers who need mobile banking access
Key Findings
Data Security - 3 findings (1 high, 1 medium, 1 low)
Network Security - 2 findings (1 critical, 1 high)
Code Safety - 0 findings
Privacy - 3 findings (2 medium, 1 low)
Privacy Concerns
What Data is Collected
- Behavioral and biometric patterns collected by BioCatch for fraud detection
- App usage and session data shared with AppsFlyer and Firebase for analytics
- Location data accessed through Google Maps and Google Places
- Payment transaction data processed through Redsys and Samsung Pay
- Identity verification data handled by Veridas
Third-Party Data Sharing
- BioCatch - behavioral fraud detection
- AppsFlyer - marketing analytics and attribution
- Firebase - app analytics and performance monitoring
- Salesforce Marketing Cloud - targeted marketing communications
- Google Maps / Google Places - location services
- Redsys - payment processing
- Samsung Pay - mobile payments
- Veridas - identity verification
- Akamai Bot Manager - bot detection and protection
- FIDO UAF (Nok Nok Labs) - authentication framework
Understanding the Scores
| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 55/100 |
| Data Security | 40/100 |
| Network Security | 35/100 |
| Code Safety | 50/100 |
| Data Collection | 60/100 |
| Data Sharing | 65/100 |
| User Control | 70/100 |
Positive Security Features
- No notable positive security practices were identified for this version of the app.
Areas for Improvement
- Network security protections should be strengthened so that the connection to bank servers is better secured during banking sessions.
- Behavioral and usage data is shared with multiple analytics and marketing platforms. Making this data sharing optional would give users more control over how their information is used.
- Data handling practices within the app should be improved to better protect personal and financial information.
About This Analysis
Scores reflect the security and privacy practices found in the version of the app listed below. The analysis covers code structure, data handling, and third-party integrations.
App Details
| Field | Value |
|---|---|
| App | BBVA Perú | Banca Móvil |
| Package | com.bbva.nxt_peru |
| Version | 25.120.7 |
| Scan Date | 2026-02-14 |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #5 (current) | 50/100 |