CITT

    Scan results

    BBVA Perú | Banca Móvil

    Android

    BBVA Peru's official mobile banking app offering account management, money transfers via Plin, card control, bill payments, investments, business banking, and digital account opening with biometric authentication.

    CITT SCORE
    50
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: BBVA Peru customers who need mobile banking access

    What It Means For You

    App usage and behavior is analyzed by BioCatch for fraud detection and shared with AppsFlyer and Firebase for analytics and marketing. Salesforce Marketing Cloud receives user data to power targeted communications. User data travels with less protection than expected when connecting to the bank.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (13)

    Data Security

    3 total
    1 High
    1 Medium
    1 Low

    Network Security

    2 total
    1 Critical
    1 High

    Code Security

    4 total
    1 Critical
    3 Medium

    Privacy

    3 total
    2 Medium
    1 Low

    Permission Usage

    1 total
    1 Low

    Third-Party Services

    BioCatch, Salesforce Marketing Cloud, Firebase, AppsFlyer, Google Maps, Google Places, Redsys, Samsung Pay, Veridas, Akamai Bot Manager, FIDO UAF (Nok Nok Labs)

    Security Strengths

    • ✓Comprehensive certificate pinning
    • ✓All production endpoints use HTTPS
    • ✓Strong encryption for app-specific data
    • ✓Hardware-backed key storage
    • ✓Backup disabled
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    location
    camera
    ads

    Package

    com.bbva.nxt_peru

    Version

    25.120.7

    Analysis Date

    Feb 14, 2026

    Classes Analyzed

    31,448

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 3 findings (1 high, 1 medium, 1 low)

    Network Security - 2 findings (1 critical, 1 high)

    Code Safety - 0 findings

    Privacy - 3 findings (2 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    • Behavioral and biometric patterns collected by BioCatch for fraud detection
    • App usage and session data shared with AppsFlyer and Firebase for analytics
    • Location data accessed through Google Maps and Google Places
    • Payment transaction data processed through Redsys and Samsung Pay
    • Identity verification data handled by Veridas

    Third-Party Data Sharing

    • BioCatch - behavioral fraud detection
    • AppsFlyer - marketing analytics and attribution
    • Firebase - app analytics and performance monitoring
    • Salesforce Marketing Cloud - targeted marketing communications
    • Google Maps / Google Places - location services
    • Redsys - payment processing
    • Samsung Pay - mobile payments
    • Veridas - identity verification
    • Akamai Bot Manager - bot detection and protection
    • FIDO UAF (Nok Nok Labs) - authentication framework

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy55/100
    Data Security40/100
    Network Security35/100
    Code Safety50/100
    Data Collection60/100
    Data Sharing65/100
    User Control70/100

    Positive Security Features

    • No notable positive security practices were identified for this version of the app.

    Areas for Improvement

    • Network security protections should be strengthened so that the connection to bank servers is better secured during banking sessions.
    • Behavioral and usage data is shared with multiple analytics and marketing platforms. Making this data sharing optional would give users more control over how their information is used.
    • Data handling practices within the app should be improved to better protect personal and financial information.

    About This Analysis

    Scores reflect the security and privacy practices found in the version of the app listed below. The analysis covers code structure, data handling, and third-party integrations.

    App Details

    FieldValue
    AppBBVA Perú | Banca Móvil
    Packagecom.bbva.nxt_peru
    Version25.120.7
    Scan Date2026-02-14

    Right of Reply

    Developer not yet contacted