CITT

    Scan results

    Chase Mobile

    Android

    Chase Mobile app by JPMorgan Chase enables secure banking, payments via Zelle, mobile check deposit, credit monitoring, budgeting, and investment management with $0 commission trades and goal-based wealth planning.

    CITT SCORE
    38
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Existing Chase customers managing accounts on the go

    Not For: You prefer not to share behavioral data with third parties

    What It Means For You

    In-app behavior is recorded by QuantumMetric and device activity is shared with Adobe for ad targeting. Bugsnag receives crash data from user sessions. Location is processed via Google when users use branch or ATM finders.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (11)

    Data Security

    2 total
    1 Critical
    1 High

    Network Security

    2 total
    1 Critical
    1 High

    Code Security

    3 total
    2 High
    1 Medium

    Privacy

    4 total
    1 Critical
    2 High
    1 Medium

    Third-Party Services

    QuantumMetric, Adobe Demdex, Bugsnag, Zimperium, Google Maps API, Google Places API, Split.io

    Security Strengths

    • ✓Certificate pinning implemented for *.chase.com domains
    • ✓Professional mobile threat defense (Zimperium SDK)
    • ✓Hardware-backed biometric token encryption (AES-256)
    • ✓Extensive code obfuscation (ProGuard/R8)
    • ✓Root and malware detection with scoring system
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    session recording
    third party analytics
    banking
    payments

    Package

    com.chase.sig.android

    Version

    4.712

    Analysis Date

    Feb 5, 2026

    Classes Analyzed

    67,075

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 2 findings (1 critical, 1 high)

    Network Security - 2 findings (1 critical, 1 high)

    Code Safety - 0 findings

    Privacy - 4 findings (1 critical, 2 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    The app collects behavioral and session data from user interactions, crash reports from user sessions, and location data when users use branch or ATM finder features. Device identifiers and usage patterns are also gathered to support analytics and fraud detection functions.

    Third-Party Data Sharing

    User data is shared with multiple third-party companies:

    • QuantumMetric - records in-app behavior and session activity
    • Adobe Demdex - receives device activity for advertising targeting
    • Bugsnag - receives crash data and diagnostic information from user sessions
    • Zimperium - processes device security signals for fraud detection
    • Google Maps API / Google Places API - processes location when users use branch or ATM finders
    • Split.io - receives usage data to support feature testing and rollouts

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy40/100
    Data Security25/100
    Network Security50/100
    Code Safety45/100
    Data Collection50/100
    Data Sharing35/100
    User Control60/100

    Positive Security Features

    • No specific positive security practices were identified in this analysis.

    Areas for Improvement

    • Data transmitted during user sessions travels with less protection than expected, which means financial information may not be fully protected under certain network conditions.
    • Behavioral and session data is distributed to a broad range of advertising and analytics companies. Reducing the scope of third-party data sharing would better protect user privacy.
    • Sensitive information stored on the device is not handled according to current best practices, creating additional risk if the device is accessed by someone else.

    About This Analysis

    This scorecard reflects analysis of the app's code and observed behaviors as of the scan date above. Results represent a point-in-time assessment and may not capture all behaviors.

    App Details

    • App: Chase Mobile
    • Package: com.chase.sig.android
    • Version: 4.712
    • Platform: Android
    • Scan Date: 2026-02-05

    Right of Reply

    Developer not yet contacted