CITT

    Scan results

    PRESTO

    Android

    PRESTO is a transit payment app enabling digital card management, NFC-based payments, and fare loading across major Canadian transit systems including GO Transit, TTC, and OC Transpo. Features include Google Wallet integration, autoload/renewal, and transaction history.

    CITT SCORE
    40
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Daily commuters comfortable with analytics tracking

    Not For: You prefer Facebook not linked to your transit use

    What It Means For You

    In-app behavior is tracked by Firebase and shared with Facebook, connecting transit and payment habits to advertising networks. Payment information is processed by a third-party gateway. Data sent between the app and its servers travels with less protection than expected, which could affect account or card details.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (12)

    Data Security

    4 total
    2 Critical
    2 Medium

    Network Security

    2 total
    1 Critical
    1 Medium

    Code Security

    2 total
    1 Critical
    1 Medium

    Privacy

    4 total
    2 High
    2 Medium

    Third-Party Services

    Firebase Analytics, Firebase Crashlytics, Facebook SDK, Microsoft MSAL (Azure AD B2C), Moneris Payment Gateway, Google Tink, BouncyCastle, Retrofit, OkHttp, Dagger 2, Azure Notification Hub

    Security Strengths

    • ✓Backup disabled (android:allowBackup="false") prevents ADB extraction
    • ✓EncryptedSharedPreferences for OAuth tokens using AES256-GCM
    • ✓Room ORM prevents SQL injection via parameterized queries
    • ✓Moneris PCI DSS tokenization (no plaintext card storage)
    • ✓HTTPS-only URLs (no cleartext HTTP)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    nfc
    location
    sensitive data
    payment processing
    authentication
    analytics
    ads

    Package

    com.metrolinx.presto.android.consumerapp

    Version

    2.1.24

    Analysis Date

    Jan 31, 2026

    Classes Analyzed

    49,993

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 4 findings (2 critical, 2 medium)

    Network Security - 2 findings (1 critical, 1 medium)

    Code Safety - 0 findings

    Privacy - 4 findings (2 high, 2 medium)

    Privacy Concerns

    What Data is Collected

    PRESTO collects transit usage patterns, payment card details, and in-app behavioral data. Account activity, including travel history and payment records, is retained to support app functionality and analytics reporting.

    Third-Party Data Sharing

    Behavioral and usage data is shared with the following third-party services:

    • Firebase Analytics - behavioral tracking and usage analytics
    • Firebase Crashlytics - crash and performance reporting
    • Facebook SDK - advertising and behavioral profiling
    • Microsoft MSAL (Azure AD B2C) - identity and authentication services
    • Moneris Payment Gateway - payment processing
    • Azure Notification Hub - push notification delivery

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy45/100
    Data Security40/100
    Network Security30/100
    Code Safety35/100
    Data Collection50/100
    Data Sharing45/100
    User Control40/100

    Positive Security Features

    • No notable positive security features were identified in this version of the app.

    Areas for Improvement

    • Data in transit is not adequately protected, meaning account details or payment card information may not be fully protected during use.
    • The app shares behavioral data with Facebook, giving an advertising network access to transit and payment habits with limited controls available to users.
    • The scope of data collected and retained goes beyond what is needed for a transit payment service, limiting users' ability to manage their personal information.

    About This Analysis

    App Details

    FieldValue
    AppPRESTO
    Packagecom.metrolinx.presto.android.consumerapp
    Version2.1.24
    Scan Date2026-01-31
    PlatformAndroid

    Right of Reply

    Developer not yet contacted