CommBank Security & Privacy Scorecard

Android

86
Overall trust score
Trustworthy
85
Security
87
Privacy

App usage and behaviour are monitored for fraud detection using behavioural biometrics. Analytics tools collect data on how users interact with the app, shared with Adobe and Splunk. Third-party data sharing is minimal, and users retain reasonable control over their information.

Best for

CommBank customers wanting mobile banking

Findings

  • 0 critical
  • 3 high
  • 7 medium
  • 9 low
  • 7 info

4 issues identified across security and privacy analysis.

Top security issues

  • PII stored under deprecated AES cipher with weak Firebase-derived key derivation and a silent cleartext fallback path that stores customer names and mobile numbers unencrypted on exception
  • Helix WebView JavaScript bridge exposes session termination, step-up auth, and app-to-app commands without origin validation — exploitable if any CBA web infrastructure is compromised
  • NFC card tokenisation SIR token handles and full card resource JSON stored without encryption in plain SharedPreferences on a rooted device

Top privacy issues

  • BioCatch behavioral biometrics SDK declares 61 data collection categories (IMEI, IMSI, clipboard, VoIP call info, installed apps, high-rate sensors) with a server-side flag that can bypass the consent gate entirely
  • Adobe Analytics initialized unconditionally at app startup with global.privacy set to optedin before any user consent is obtained, forwarding data including persistent ECID to Adobe Audience Manager
  • QUERY_ALL_PACKAGES permission enables full installed app enumeration, with BioCatch DeviceApplications collector suggesting this list is transmitted to third-party fraud detection servers without explicit disclosure

Full analysis

What This Means for You

App usage and behaviour are monitored for fraud detection using behavioural biometrics. Analytics tools collect data on how users interact with the app, shared with Adobe and Splunk. Third-party data sharing is minimal, and users retain reasonable control over their information.

Recommendation: Trustworthy

Best For: CommBank customers wanting mobile banking

Key Findings

Data Security - 6 findings (2 medium, 3 low, 1 info)

Network Security - 5 findings (2 medium, 2 low, 1 info)

Code Safety - 0 findings

Privacy - 3 findings (1 medium, 1 low, 1 info)

Privacy Concerns

What Data is Collected

  • Behavioural patterns and interaction data collected for fraud detection
  • Biometric data used for authentication and identity verification
  • Crash reports and app usage events
  • Device identifiers for push notifications
  • Document and identity scan data during verification flows

Third-Party Data Sharing

Data is shared with a limited number of third-party services:

  • BioCatch - receives behavioural interaction data for fraud detection
  • Adobe Analytics - receives app usage and interaction data
  • Splunk MINT - receives crash reports and performance event data
  • Firebase FCM - receives device identifiers for push notifications
  • Daon / ID R&D - receives biometric data during authentication flows

Understanding the Scores

Category Score
Security 85/100
Privacy 87/100
Data Security 65/100
Network Security 83/100
Code Safety 85/100
Data Collection 83/100
Data Sharing 92/100
User Control 83/100

Positive Security Features

  • Biometric authentication built on FIDO2 standards protects accounts from unauthorised access
  • Continuous behavioural monitoring works silently in the background to detect fraud before it impacts users
  • NFC-based secure payment handling supports safe tap-to-pay transactions
  • Liveness detection during identity checks helps prevent spoofing during onboarding and verification

Areas for Improvement

  • Some data stored on the device could be better isolated from other apps installed on the same device.
  • Network communications could be more consistently hardened to reduce exposure on untrusted Wi-Fi networks.
  • Clearer in-app disclosure about which third-party services receive behavioural and usage data would give users better visibility into how their information is shared.

About This Analysis

This scorecard is based on automated static analysis of the app binary. Scores reflect the security and privacy posture of the app as shipped, not the developer's server-side practices.

App Details

Field Value
Package com.commbank.netbank
Version 5.48.1.2576
Scan Date 2026-03-29
Platform Android

Versions & scan history

ScanDateOverall score
#1 (current) 86/100