CITT

    Scan results

    ING Banking

    Android

    ING Banking app enables secure management of accounts, cards, payments, savings, investments, and loans. Features include Google Pay integration, QR code payments, spending tracking tools, 24/7 digital assistant support, and biometric authentication for enhanced security.

    CITT SCORE
    96
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Everyday ING customers comfortable with standard services

    What It Means For You

    Account activity and device data are processed by Twilio for messaging and voice calls, IBM Trusteer for fraud detection, and Sentry for crash reporting. Firebase handles push notifications. Payment interactions work with Google Tap and Pay, and Google ML Kit supports on-device features.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (6)

    Data Security

    1 total
    1 Medium

    Network Security

    1 total
    1 Info

    Code Security

    2 total
    1 Medium
    1 Low

    Privacy

    2 total
    2 Info

    Third-Party Services

    Twilio Voice, Twilio Conversations, Trusteer (IBM Security), Sentry, Firebase Messaging, Google ML Kit, Google Tap and Pay

    Security Strengths

    • ✓Certificate pinning with 3-6 backup pins per domain
    • ✓Global cleartext traffic disabled
    • ✓Custom encrypted SharedPreferences (AES-256-GCM)
    • ✓Android KeyStore integration with hardware-backed keys
    • ✓Biometric authentication for sensitive operations
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    location
    camera

    Package

    com.ing.banking

    Version

    2026.4.0

    Analysis Date

    Mar 5, 2026

    Classes Analyzed

    35,267

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Trustworthy

    Key Findings

    Data Security - 2 findings (1 medium, 1 info)

    Network Security - 1 finding (1 info)

    Code Safety - 0 findings

    Privacy - 2 findings (2 info)

    Privacy Concerns

    What Data is Collected

    Device identifiers and usage patterns are collected to support fraud detection, crash diagnostics, and in-app communication. Payment-related interactions are processed to enable contactless and digital payment features.

    Third-Party Data Sharing

    User data is shared with the following third parties as part of core app functionality:

    • Twilio - messaging and voice call processing
    • IBM Trusteer - fraud detection and device risk assessment
    • Sentry - crash and error diagnostics
    • Firebase - push notification delivery
    • Google ML Kit - on-device processing features
    • Google Tap and Pay - contactless payment support

    Understanding the Scores

    CategoryScore
    Security93/100
    Privacy100/100
    Data Security96/100
    Network Security100/100
    Code Safety94/100
    Data Collection100/100
    Data Sharing100/100
    User Control100/100

    Positive Security Features

    • Network communications achieved a perfect score, reflecting strong practices for protecting data sent between the app and its services.
    • Data collection, sharing, and user control all achieved perfect scores, indicating the app handles user information responsibly.
    • An overall security score of 93 reflects a carefully maintained app with a strong security baseline.

    Areas for Improvement

    • A small number of data storage practices on the device could be further hardened to reduce exposure in shared or compromised device scenarios.
    • Minor informational items were identified in how certain network responses are handled, though these carry no practical impact on everyday security.

    About This Analysis

    This scorecard is based on automated static analysis of the app binary. Scores reflect observed behaviors and practices in the app code at the time of scanning.

    App Details

    • App: ING Banking
    • Package ID: com.ing.banking
    • Version: 2026.4.0
    • Scan Date: 2026-03-05
    • Platform: Android

    Right of Reply

    Developer not yet contacted