ING Banking Security & Privacy Scorecard
Android
Account activity and device data are processed by Twilio for messaging and voice calls, IBM Trusteer for fraud detection, and Sentry for crash reporting. Firebase handles push notifications. Payment interactions work with Google Tap and Pay, and Google ML Kit supports on-device features.
Best for
Everyday ING customers comfortable with standard services
Findings
- 0 critical
- 0 high
- 2 medium
- 1 low
- 4 info
1 issue identified across security and privacy analysis.
Top security issues
- Extensive Deep Link Attack Surface
- PDF Payment Recognition File Processing
- JavaScript-Enabled WebView with Native Bridge
Top privacy issues
- Trusteer SDK Device Fingerprinting
- Sentry Session Replay Capability
- Third-Party Telemetry Without Certificate Pinning
Full analysis
ING Banking
Version: 2026.4.0
Scan Date: 2026-03-05
What This Means for You
Account activity and device data are processed by Twilio for messaging and voice calls, IBM Trusteer for fraud detection, and Sentry for crash reporting. Firebase handles push notifications. Payment interactions work with Google Tap and Pay, and Google ML Kit supports on-device features.
Recommendation: Trustworthy
Best For: Everyday ING customers comfortable with standard services
Key Findings
Data Security - 2 findings (1 medium, 1 info)
Network Security - 1 finding (1 info)
Code Safety - 0 findings
Privacy - 2 findings (2 info)
Privacy Concerns
What Data is Collected
Device identifiers and usage patterns are collected to support fraud detection, crash diagnostics, and in-app communication. Payment-related interactions are processed to enable contactless and digital payment features.
Third-Party Data Sharing
User data is shared with the following third parties as part of core app functionality:
- Twilio - messaging and voice call processing
- IBM Trusteer - fraud detection and device risk assessment
- Sentry - crash and error diagnostics
- Firebase - push notification delivery
- Google ML Kit - on-device processing features
- Google Tap and Pay - contactless payment support
Understanding the Scores
| Category | Score |
|---|---|
| Security | 93/100 |
| Privacy | 100/100 |
| Data Security | 96/100 |
| Network Security | 100/100 |
| Code Safety | 94/100 |
| Data Collection | 100/100 |
| Data Sharing | 100/100 |
| User Control | 100/100 |
Positive Security Features
- Network communications achieved a perfect score, reflecting strong practices for protecting data sent between the app and its services.
- Data collection, sharing, and user control all achieved perfect scores, indicating the app handles user information responsibly.
- An overall security score of 93 reflects a carefully maintained app with a strong security baseline.
Areas for Improvement
- A small number of data storage practices on the device could be further hardened to reduce exposure in shared or compromised device scenarios.
- Minor informational items were identified in how certain network responses are handled, though these carry no practical impact on everyday security.
About This Analysis
This scorecard is based on automated static analysis of the app binary. Scores reflect observed behaviors and practices in the app code at the time of scanning.
App Details
- App: ING Banking
- Package ID: com.ing.banking
- Version: 2026.4.0
- Scan Date: 2026-03-05
- Platform: Android
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 96/100 |