CITT

    Scan results

    Capital One Mobile

    Android

    Capital One's official banking app for account management, payments, credit monitoring, rewards redemption, and money transfers via Zelle. View balances, pay bills, activate cards, and access CreditWise credit monitoring tools.

    CITT SCORE
    70
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Capital One customers comfortable with standard analytics

    What It Means For You

    Activity is tracked by Kochava and Google Ads for marketing purposes, and behavioral data flows to Firebase and New Relic for performance monitoring. Financial interactions and usage patterns are shared with multiple third-party services. Network connections are well protected, but the data footprint extends beyond Capital One itself.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (21)

    Data Security

    5 total
    2 High
    2 Medium
    1 Low

    Network Security

    1 total
    1 Medium

    Code Security

    8 total
    1 Critical
    1 High
    4 Medium
    2 Low

    Privacy

    7 total
    2 Critical
    3 High
    2 Medium

    Third-Party Services

    Kochava Tracker, Medallia Digital, Firebase Analytics, Firebase Crashlytics, New Relic APM, Google Ads, Google Maps, ApiGuard3, RootBeer, MiTek MiSnap

    Security Strengths

    • ✓Excellent code obfuscation (R8/ProGuard)
    • ✓Strong certificate pinning implementation
    • ✓JWT-based payload encryption (RSA-OAEP-256)
    • ✓Production debug mode disabled
    • ✓Secure biometric credential storage
    • ✓No known CVEs in third-party SDKs
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    location
    camera
    ads

    Package

    com.konylabs.capitalone

    Version

    6.37.5 (Build 1622311000)

    Analysis Date

    Jan 31, 2026

    Classes Analyzed

    51,722

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Acceptable

    Key Findings

    Data Security - 5 findings (2 high, 2 medium, 1 low)

    Network Security - 1 finding (1 medium)

    Code Safety - 0 findings

    Privacy - 7 findings (2 critical, 3 high, 2 medium)

    Privacy Concerns

    What Data is Collected

    Capital One Mobile collects device identifiers, in-app usage patterns, financial interaction history, and behavioral data. This information supports both core app functionality and third-party marketing and analytics purposes.

    Third-Party Data Sharing

    Data is shared with multiple third-party services: Kochava and Google Ads receive data for advertising attribution and targeting; Firebase receives crash reports and usage analytics; New Relic receives performance telemetry; Medallia receives user feedback signals; Google Maps receives location context for branch and ATM features; and MiTek MiSnap processes document and image data for identity-related flows.

    Understanding the Scores

    CategoryScore
    Security78/100
    Privacy62/100
    Data Security82/100
    Network Security95/100
    Code Safety85/100
    Data Collection58/100
    Data Sharing65/100
    User Control70/100

    Positive Security Features

    • Network communications are strongly protected, reducing the risk of data being intercepted in transit.
    • The app includes integrity-checking measures that make unauthorized modification significantly harder.
    • Crash and error reporting is handled through established services with defined data handling practices.

    Areas for Improvement

    • User data reaches a broad set of advertising and analytics partners. Reducing the number of third-party recipients would better protect financial privacy.
    • The app collects behavioral and usage data that extends beyond what is needed to deliver core account management features.
    • Users have limited visibility into, and control over, how marketing-oriented third parties connected to the app use data after it is shared.

    About This Analysis

    This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect observed behaviors at the time of the scan and may change with app updates.

    App Details

    • App Name: Capital One Mobile
    • Package ID: com.konylabs.capitalone
    • Version: 6.37.5 (Build 1622311000)
    • Scan Date: 2026-01-31
    • Platform: Android

    Right of Reply

    Developer not yet contacted