CITT

    Scan results

    BoursoBank

    Android

    BoursoBank is a comprehensive mobile banking app offering account opening, payments via Google Pay, transfers, investment management, stock trading, insurance, loans, and secure card management. Over 5 million users trust this French financial services platform.

    CITT SCORE
    50
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Everyday banking with standard analytics tradeoffs

    Not For: You want a bank that does not share behavior data

    What It Means For You

    In-app behavior, taps, and navigation patterns are collected by Heap Analytics and ContentSquare and used to analyze how users interact with the app. Adjust and Firebase track user activity across sessions. Payment interactions touch third-party services including Visa, Samsung Pay, and Google Pay.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (16)

    Data Security

    6 total
    3 Critical
    1 High
    2 Medium

    Network Security

    3 total
    1 Critical
    2 High

    Code Security

    4 total
    1 Critical
    2 High
    1 Medium

    Privacy

    2 total
    1 High
    1 Medium

    Third-Party Risk

    1 total
    1 Medium

    Third-Party Services

    IBM Trusteer, Heap Analytics, ContentSquare, Firebase Analytics, Adjust SDK, Visa Digital Enablement, Samsung Pay, Google Pay, AriadNext IDCheckIO, Didomi SDK, Google Maps, Google Play Integrity

    Security Strengths

    • ✓IBM Trusteer fraud detection and device fingerprinting
    • ✓Biometric authentication (fingerprint, face) and passkey support
    • ✓Play Integrity API for app attestation
    • ✓Visa VDE and Samsung Pay for secure payments
    • ✓Root detection implementation
    • ✓Encrypted secure storage (flutter_secure_storage with Android Keystore)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    location
    camera
    contacts
    ads

    Package

    com.boursorama.android.clients

    Version

    7.60.5

    Analysis Date

    Feb 8, 2026

    Classes Analyzed

    26,817

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 6 findings (3 critical, 1 high, 2 medium)

    Network Security - 3 findings (1 critical, 2 high)

    Code Safety - 0 findings

    Privacy - 2 findings (1 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    User taps, screen interactions, and in-app navigation patterns are collected by Heap Analytics and ContentSquare. Adjust and Firebase Analytics record user sessions and activity over time. Payment flow interactions pass through Visa Digital Enablement, Samsung Pay, and Google Pay. IBM Trusteer and AriadNext IDCheckIO process device and identity signals during security checks.

    Third-Party Data Sharing

    Behavioral data from user sessions is shared with Heap Analytics and ContentSquare for usage analysis. Adjust receives attribution and session data. Payment activity is processed by Visa, Samsung Pay, and Google Pay integrations. Identity and device data is shared with IBM Trusteer and AriadNext IDCheckIO. Google Maps and Google Play Integrity receive data during normal app use. Didomi SDK manages user consent preferences across these data flows.

    Understanding the Scores

    • Security Score: 45/100
    • Privacy Score: 55/100
    • Data Security: 35/100
    • Network Security: 50/100
    • Code Safety: 55/100
    • Data Collection: 60/100
    • Data Sharing: 70/100
    • User Control: 65/100

    Positive Security Features

    • IBM Trusteer integration provides active fraud detection to help protect accounts from unauthorized transactions.
    • AriadNext IDCheckIO adds identity verification during account-sensitive actions.
    • Google Play Integrity checks confirm the app is running in an unmodified environment.
    • Didomi SDK provides a consent management layer, giving users some control over data collection preferences.

    Areas for Improvement

    • Sensitive data stored on the device may not be fully protected, which could expose account information if the phone is accessed by someone else.
    • Data sent between the app and its servers travels with less protection than expected.
    • Behavioral tracking by multiple analytics platforms operates broadly, giving users limited visibility into how in-app activity is used beyond the app itself.

    About This Analysis

    This scorecard is based on automated static analysis of the BoursoBank Android app. Scores reflect the security and privacy posture observed at the time of the scan. Real-world risk depends on how the app is used and the user's personal threat model.

    App Details

    • App: BoursoBank
    • Package: com.boursorama.android.clients
    • Version: 7.60.5
    • Platform: Android
    • Scan Date: 2026-02-08

    Right of Reply

    Developer not yet contacted